Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity Defense > Incident Response > Flashcards

Incident Response Flashcards

1
Q

What can initiate incident response? (6)

A
  1. Automated detection systems or sensor alerts
  2. Company user report
  3. Contractor or third-party ICT service provider report
  4. Internal or external organizational component incident report or situational awareness update
  5. Third-party reporting of network activity to known compromised infrastructure, detection of malicious code, loss of services, etc.
  6. Analytics or hunt teams that identify potentially malicious or otherwise unauthorized activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What do preparation activities include? (5)

A
  1. Documenting and understanding policies and procedures for incident response
  2. Configuring the environment to detect suspicious and malicious activity
  3. Establishing staffing plans
  4. Educating users on cyber threats and notification procedures
  5. Leveraging cyber threat intelligence (CTI) to proactively identify potential malicious activity
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why is it important to define baselines (systems and networks) before an incident occurs?

A

To understand the basics of “normal” activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

To be able to ensure resilient architectures and systems to maintain critical operations in a compromised state, what preparation activities should be included? (3)

A
  1. Having infrastructure in place to handle complex incidents, including classified and out-of-band communications
  2. Developing and testing courses of action (COAs) for containment and eradication
  3. Establishing means for collecting digital forensics and other data or evidence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

As part of preparation activities, what needs to be done in terms of policies and procedures? (3)

A
  1. Document incident response plans, including processes and procedures for designating a coordination lead (incident manager).
  2. Put policies and procedures in place to escalate and report major incidents and those with impact on the agency’s mission.
  3. Document contingency plans for additional resourcing and “surge support” with assigned roles and responsibilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What should policies address in terms of law enforcement? (3)

A
  1. notification
  2. interaction
  3. evidence sharing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What sources should be leveraged for cyber threat intelligence? (4)

A
  1. government
  2. trusted partners
  3. open source
  4. commercial entities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What includes threat indicators? (3)

A
  1. Atomic indicators, such as domains and IP addresses, that can detect adversary infrastructure and tools
  2. Computed indicators, such as Yara rules and regular expressions, that detect known malicious artifacts or signs of activity
  3. Patterns and behaviors, such as analytics that detect adversary tactics, techniques, and procedures (TTPs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the problem of atomic indicators?

A

Adversaries often change their infrastructure (e.g., watering holes, botnets, C2 servers) between campaigns, the “shelf-life” of atomic indicators to detect new adversary activity is limited. They might also switch to new infrastructure during a campaign when their activities are detected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What should businesses use to identify malicious activity when possible?

A

Patterns and behaviors, or adversary TTPs, as TTPs provide more useful and sustainable context about threat actors, their intentions, and their methods rather than atomic indicators alone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is active defense?

A

Ability to redirect an adversary to a sandbox or honeynet system for additional study, or “dark nets”—to delay the ability of an adversary to discover the agency’s legitimate infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What can be implemented to enable defenders to study the adversary’s behavior and TTPs and thereby build a full picture of adversary capabilities?

A

Honeytokens (fictitious data objects) and fake accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What has to be established to be able to share information between the incident handlers?

A

Communication channels (chat rooms, phone bridges) and method for out-of-band coordination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Measures should be taken to ensure that IR and defensive systems and processes will be operational during an attack, particularly in the event of pervasive compromises—such as a ransomware attack or one involving an aggressive attacker that may attempt to undermine defensive measures and distract or mislead defenders. What are those measures? (5)

A
  1. Segmenting and managing SOC systems separately from the broader enterprise IT systems.
  2. Managing sensors and security devices via out-of-band means.
  3. Notifying users of compromised systems via phone rather than email.
  4. Using hardened workstations to conduct monitoring and response activities
  5. Ensuring that defensive systems have robust backup and recovery processes.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What should be done to void “tipping off” an attacker? (3)

A
  1. Have processes and systems to reduce the likelihood of detection of IR activities
  2. Do not submit malware samples to a public analysis service.
  3. Do not notify users of potentially comprised machines via email
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What capabilities should be implemented in terms of technical infrastructure? (2)

A
  1. Capabilities to contain, replicate, analyze, reconstitute, and document compromised hosts
  2. Capability to collect digital forensics and other data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What needs to be established for incident data and reporting sharing?

A

Secure storage that is only accessible by incident responders

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What means need to be ready for collecting forensic evidence? (3)

A
  1. disk and active memory imaging
  2. safely handling malware
  3. analysis tools and sandbox software for analyzing malware
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What information should a ticket contain? (5)

A
  1. Anomalous or suspicious activity, such as affected systems, applications, and users
  2. Activity type
  3. Specific threat group(s)
  4. Adversary tactics, techniques, and procedures (TTPs) employed
  5. Impact
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What should be leveraged to create rules and signatures to identify the activity associated with the incident and to scope its reach?

A

Threat intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is often the most challenging aspect of the incident response process?

A

Accurately detecting and assessing cybersecurity incidents - incident triage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What activities are part of incident triage? (4)

A
  1. Determining whether an incident has occurred
  2. Determining the type of incident
  3. Determining the extend of the incident
  4. Determining the magnitude of the compromise (within cloud, OT, hybrid, host, and network systems)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

When detrmining the scope of the incident, available data needs to be leveraged to identify what? (3)

A
  1. The extent to which assets have been affected
  2. The level of privilege attained by the adversary
  3. The operational or informational impact
24
Q

What needs to be inspected to discover malicious activity? (3)

A
  1. The trail of network data
  2. Host-based artifacts
  3. Firewall (and other network devices) logs along with other network data, such as router traffic
25
Q

Data need to be collected and preserved for which activities? (6)

A
  1. Incident verification
  2. Categorization
  3. Prioritization
  4. Mitigation
  5. Reporting
  6. Attribution
26
Q

What needs to be done when an endpoint requires forensic analysis?

A

Capture a memory and disk image for evidence preservation.

27
Q

What needs to be done when performing a technical analysis of the incident? The goal this analysis is to examine the breadth of data sources throughout the environment to discover at least some part of an attack chain, if not all of it. (3)

A
  1. Develop a technical and contextual understanding of the incident
  2. Correlate information, assess anomalous activity against a known baseline to determine root cause
  3. Document adversary TTPs to enable prioritization of the subsequent response activities
28
Q

What needs to be done to allow the team to account for all adversary activity on the network that will assist in creating the findings report at the conclusion of the response? (2)

A
  1. Thoroughly document every step taken during this and subsequent phases.
  2. Create a timeline of all relevant findings
29
Q

When are indicators as standalone artifacts most valuable?

A

In the early stages of incident response, as they provide insight into the adversary’s capabilities and infrastructure

30
Q

What does responding to TTPs enables defenders to do?

A

Hypothesize the adversary’s most likely course of action

31
Q

What adversaries often use once they gain a foothold in an environment to avoid detection?

A

Leverage legitimate native operating system utilities and scripting languages

32
Q

What should be done to identify anomalous activity?

A

Assess and profile affected systems and networks for subtle activity that might be adversary behavior
Enables the team to identify deviations from the established baseline activity and can be particularly important in identifying activities such as attempts to leverage legitimate credentials and
native capabilities in the environment.

33
Q

What informs the triage and post-incident activity?

A

Identification of the conditions that enabled the adversary to access and operate within the environment.

34
Q

What should be the gathered TTPs compared to?

A

TTPs documented in ATT&CK, which should help to analyze how the TTPs fit into the attack lifecycle

35
Q

What do Tactics from TTP describe?

A

Tactics describe the technical objective an adversary is trying to achieve (“why”)

36
Q

What do Techniques from TTP describe?

A

Different mechanisms adversaries use to achieve it (“what”)

37
Q

What do Procedures from TTP describe?

A

How the adversary achieves a specific result (“how”).

38
Q

What needs to be done during an incident, as information evolves?

A

Update and communicate the scope to all stakeholders to ensure a common operating picture.

39
Q

What does the IR team need to use to modify tools to slow the pace of the adversarial advance and increase the likelihood of detection?

A

Its developing understanding of the adversary’s TTPs

40
Q

What role should the IOC signatures play in the prevention and detection tools?

A
  1. Impose temporary operational cost upon the adversary
  2. Assist with scoping the incident
41
Q

What can an adversary do to subvert IOC-centric response mechanisms?

A

Introduce new tools to the network and/or modify existing tools

42
Q

What questions should be asked during the Detection & Analysis phase? (10)

A
  1. What was the initial attack vector? (i.e., How did the adversary gain initial access to the network?)
  2. How is the adversary accessing the environment?
  3. Is the adversary exploiting vulnerabilities to achieve access or privilege?
  4. How is the adversary maintaining command and control?
  5. Does the actor have persistence on the network or device?
  6. What is the method of persistence (e.g., malware backdoor, webshell, legitimate credentials, remote tools, etc.)?
  7. What accounts have been compromised and what privilege level (e.g., domain admin, local admin, user account, etc.)?
  8. What method is being used for reconnaissance? (Discovering the reconnaissance method may provide an opportunity for detection and to determine possible intent.)
  9. Is lateral movement suspected or known? How is lateral movement conducted (e.g., RDP, network shares, malware, etc.)?
  10. Has data been exfiltrated and, if so, what kind and via what mechanism?
43
Q

What is the objective of containment?

A

Prevent further damage and reduce the immediate impact of the incident by removing the adversary’s access.

44
Q

What drives the type of containment strategy used?

A

The particular scenario. The containment approach to an
active sophisticated adversary using fileless malware will be different than the containment approach for ransomware.

45
Q

When evaluating containment courses of action, what should be considered? (3)

A
  1. Any additional adverse impacts to mission operations, availability of services (e.g., network connectivity, services provided to external parties)
  2. Duration of the containment process, resources needed, and effectiveness (e.g., full vs. partial containment; full vs. unknown level of containment)
  3. Any impact on the collection, preservation, securing, and documentation of evidence
46
Q

Why should defenders develop as complete a picture as possible of the attacker’s capabilities and potential reactions?

A

To avoid “tipping off” the adversary.

47
Q

Why is containment challenging?

A

Because defenders must be as complete as possible in identifying adversary activity, while considering the risk of allowing the adversary to persist until the full scope of the compromise can be determined.

48
Q

What are containment activities?

A

Short-term mitigations to isolate threat actor activity and prevent additional damage from the activity or pivoting into other systems.

49
Q

As part of containment activities, when isolating impacted systems and network segments from each other and/or from non-impacted systems and networks, what has to be considered?

A

The mission or business needs and how to provide services so missions can continue during this phase to the extent possible

50
Q

As part of containment activities, what should be done to preserve evidence for legal use (if applicable) and further investigation of the incident?

A

Capturing forensic images.

51
Q

As part of containment activities, what should be done to isolate the compromised system on the network level?

A

Configure a firewall rule.

52
Q

As part of containment activities, what needs to be done if compromise is suspected?

A
  1. changing system admin passwords
  2. rotating private keys, API keys
  3. rotating service/application account secrets where
  4. revocation of certificates or privileged accesses
53
Q

As part of containment activities, if SOC is advanced, where can be the directed to monitor the actor’s activity, gather additional evidence, and identify attack vectors?

A

Sandbox

54
Q

What needs to be done, if new signs of compromise are found?

A

Return to the technical analysis step to rescope the incident.

55
Q

What needs to be done to successfully contain an incident?

A

Ensure that the containment scope encompasses all related incidents and activity—especially all adversary activity

56
Q

What needs to be done upon successful containment (i.e., no new signs of compromise)?

A

preserve evidence for reference or law enforcement investigation adjust detection tools move to eradication and recovery

56
Q

What is the objective of Eradication & Recovery?

A

Allow the return of normal operations by eliminating artifacts of the incident (e.g., remove malicious code, re-image infected systems) and mitigating the vulnerabilities or other conditions that were exploited.

Cybersecurity Defense (17 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions