Incident Response Flashcards
What is incident response?
A set of procedures that an investigator follows when examining a computer security incident
What is an Incident Management Program?
Program consisting of the monitoring and detection of security events on a computer network and the execution of proper responses to those security events.
What are the 6 steps of incident response, in logical order?
- Preparation
- Identification
- Containment
- Eradication
- Recovery
- Lessons Learned
What is a CSIRT team?
A computer security incident response team.
A computer security incident response team, or CSIRT, is a group of IT professionals that provides an organization with services and support surrounding the assessment, management and prevention of cybersecurity-related emergencies, as well as coordination of incident response efforts.
The main goal of a CSIRT is to respond to computer security incidents quickly and efficiently, thus regaining control and minimizing damage.
What is a SOC?
A “Security Operations Centre”
A security operations center (SOC) is a facility that houses an information security team responsible for monitoring and analyzing an organization’s security posture on an ongoing basis. The SOC team’s goal is to detect, analyze, and respond to cybersecurity incidents using a combination of technology solutions and a strong set of processes.
What is “Out-of-band communication”?
Communication between people or devices that are outside of the normal primary channels of communication.
Important to avoid threat actors intercepting and actioning on this communication.
What is syslog / rsyslog / syslog-ng used for?
The logging of data from different types of systems to a central repository.
What is journalctl?
journalctl is a Linux command line utility used for querying and displaying logs from the journald, the systemd logging service on Linux.
What is nxlog?
Cross-platform, open source tool similar to syslog
What is netflow?
Netflow is a network protocol system created by Cisco that collects active IP network traffic as it flows in or out of an interface, including its point of origin, destination, volume and paths on the network.
What is sflow?
sflow is short for sampled flow. It’s an open source version of netflow. It provides a means for exporting truncated packets, together win interface counters for the purpose of network monitoring.
What is IPFix?
IPFix or the Internet Protocol Flow Information Export.
A universal standard of export for Internet Protocol flow information from routers, probes and other devices used by mediation systems. Used in accounting/billing for paid network services.
In forensic procedures, what is identification?
Ensure the scene is safe, secure the scene to prevent contamination and identify the scope of evidence to be collected.
In forensic procedures, what is collection?
Ensure authorisation to collect evidence is obtained, and then document and prove the integrity of the evidence collected.
In forensic procedures, what is analysis?
Create a copy of evidence for analysis and use repeatable methods and tools during analysis.
In forensic procedures, what is reporting?
Create a report of the methods and tools used in the investigation and present detailed findings and conclusions based on the analysis.
What is a legal hold?
A process designed to preserve all relevant information when litigation is reasonably expected to occur.
What are the 3 ethical requirements of forensic analysts?
- Analysis must be performed without bias
- Analysis methods must be repeatable by third parties
- Evidence must not be changed or manipulated
In forensic data acquisition, what’s the main legal challenge with BYOD?
BYOD can complicate data acquisition since you may not be able to legally search or seize the device
What is tracert/traceroute?
Tracert/Traceroute is a network diagnostics command for displaying possible routes and measuring transit delays of packets across an IP network.
What is nslookup/dig?
These are utilities to determine the IP address associated with a domain name, obtain mail server settings for a domain, and other DNS information.
What is ipconfig/ifconfig?
Utilities that display all the network configurations of the currently connected network devices and can modify the DHCP and DNS settings.
