Incident Handling Process Flashcards
1
Q
Incident Handling
A
- well-defined course of action whenever a computer or network security incident occurs
- only events with negative consequences are considered security incidents
- such events can be:
- system crashes
- packet floods
- unauthorized use of system privileges
- unauthorized access to sensitive data
- execution of destructive malware
2
Q
Cyber Kill Chain
A
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and Control
- Actions on Objectives
3
Q
NIST: Incident Handling Process
A
aka Incident Response Lifecycle
- Preparation
- Detection and Analysis
- Containment, Eradication, and Recover
- Post-incident Activity
4
Q
Preparation Phase Components
A
- Employees
- Documentation
- Defensive Measures
5
Q
Preparation Phase: Employees
A
- skilled response team
- IT security training
- security awareness/social engineering exercises
6
Q
Preparation Phase: Documentation
A
- well-defined policies
- well-defined response procedures
- breach/incident communication plan
- maintaining chain of custody actions
7
Q
Preparation Phase: Defensive Measures
A
- A/V, (H)IDS, DLP, EDR, Security Patches
- SIEM, UTM, Threat Intelligence
- NSM, Central Logging, Honeypots
- Incident Handling Starter Kit:
- Data acquisition software
- Read-only diagnostic software
- Bootable linux environment
- HDs, Ethernet TAP, cables, laptop
8
Q
Detection and Analysis Phase Components
A
- Means of detection
- Information and knowledge sharing
- Context-aware threat intelligence
- Segmentation of the architecture
- Good understanding/visibility of your network
- Establish baselines
9
Q
How do you start to establish “levels of detection”?
A
- logically categorize your network
10
Q
What are the “levels of detection”?
A
- Network perimeter
- Host perimeter
- Host-level
- Application-level
11
Q
Network Perimeter?
A
- Firewalls
- Internet-facing NIDS
- IPS
- DMZ
- Example: analyze packet capture in Wireshark [Statistics > IPv4 Statistics > Destinations and Ports]
12
Q
Host Permimeter?
A
- Occurs whenever we analyze data a host receives from the network or sends out to the network.
- Local firewalls or HIPS systems can assist such detection activities
- Example: Checking a hosts network and Internet connections [netstat -naob]
13
Q
What should you consider whenever performing detection activities at the host or network perimeter levels?
A
- Utilize packet destinations (network perimeter) and identified ports (network and host perimeter) to identify running services at the respective host
- Are the identified services actually running and part of your organization?
- In not, check for port abuse
Example: We see a packet trying to reach port 21 of a host, or we see a host listening on port 21. Is there legitimate FTP traffic, or is this malicious activity?
14
Q
Host-level
A
- Detection at the host level occurs whenever we analyze data residing in the host
- A/Vs and EDR solutions
15
Q
Application-level
A
- Application logs
- Web application logs, service logs, etc. can provide insight into user operations and inputs
- Example: abnormal activity in IIS logs [ /CMS/SiteContent/Mock/shelly.asp running for 18,600 seconds; could be the existence of a web shell]
16
Q
What should you consider before call an event an incident?
A
- Could this be user oversight?
- Scrutinize all evidence
- Base your decision on prior knowledge of the normal behavior
17
Q
When handling an incident, what questions should be asked?
A
- Are there any crown jewels that can be affected?
- What are the minimum requirements for effective exploitation? [privileged position on the LAN; valid credentials; just an Internet connection]
- Is this being actively exploited in the wild?
- Is there a proposed remediation strategy?
- Is there threat intel/evidence that suggests increased spreading capabilities?
18
Q
Containment
A
- preventing an incident from getting worse (i.e. preventing the intruder from getting any deeper)
- divided into 2 sub-phases: short-term and long-term containment
19
Q
Short-term containment
A
- render the intrusion ineffective without altering the machine’s hard drive (needs to be imaged for forensic activities)
- to do so:
- disable network connectivity
- place the machine in a separate/isolated VLAN
- Change DNS
- isolate the machine through router and firewall configurations
20
Q
Canary Token
A
- generates documents that call back to a designated email or webhook URL the moment they are accessed, mentioning the source IP address and other information
21
Q
Long-term containment
A
- make sure the intruder is locked out of the affected host and network
22
Q
Data Acquisition
A
- to preserve the evidence, you’re NOT supposed to work on the original machine when investigating, and you’re also NOT supposed to analyze and work on the first image you take.
- the original image is usually verified and then saved alongside the other parameters to protect it from tampering, while the work is done on copies of the original image
23
Q
Order of Volatility
A
- Registers
- CPU caches
- RAM
- HDD
- External and secondary storage devices
24
Q
What are the two types of data acquisition?
A
- static acquisition
- dynamic acquisition
25
Q
Static acquisition
A
- acquisition of data that is not volatile
