Incident Response

Question 1

What is an “incident” in the context of information security?

a) “Any real or suspected adverse event in relation to the security of computer systems or computer networks” – Example from CERT
b) “The act of violating an explicit or implied security policy” – Another example from CERT
c) Important for a company to define what an incident is for them.
d) All of the above

Answer 1

d)All of the above

Question 2

Incident Examples

a) Attempts (either failed or successful) to gain unauthorized access to a system or its data
b) Unwanted disruption or denial of service
c) Unauthorized use of a system for the processing or storage of data
d) Changes to system hardware, firmware, or software characteristics without the owner’s knowledge, instruction, or consent
e) Anything that violates cybercrime laws in your country
f) All of the above

Answer 2

f)All of the above

Question 3

Incident Response Teams are not known as

a) IR
b) Blue team
c) CSIRP(Computer Security Incident Response Team)
d) Response Team

Answer 3

d)Response Team

Question 4

An incident response team can be composed in any way suitable to the organization that operates it but a certain subset of skills should be present.

a) T
b) F

Answer 4

a)T

Question 5

The order of building a team and centre

a) Obtain-Determine-Design-Gather-Communicate-implement-announce-evaluate
b) Gather-obtain-determine-communicate-design-announce-evaluate-implement
c) obtain-determine-gather-design-communicate-implement-announce-evaluate
d) communicate-design-gather-determine-obtain-evaluate-announce-implement

Answer 5

c)obtain-determine-gather-design-communicate-implement-announce-evaluate

Question 6

Incident Response Processes:

a) Identification-Preparation-Containment-Eradication-Recovery-Lessons Learned
b) Preparation-Identification-Containment-Eradication-Recovery-Lessons Learned
c) Eradication-Recovery-Lessons Learned-Preparation-Identification-Containment

Answer 6

b)Preparation-Identification-Containment-Eradication-Recovery-Lessons Learned

Question 7

Example of an Incident:

a) Brute force
b) Phishing
c) Detection of an intellectual property (IP) stealing advanced persistent threat (APT) inside your network
d) Session Hijacking

Answer 7

c)Detection of an intellectual property (IP) stealing advanced persistent threat (APT) inside your network

Also:
Port scan
SSH brute force login attempts
SQL injection attempts against your web application
Large scale DDoS against your network
Malware

Question 8

Tier 1 Analysts – The “help desk” of IR. Read the alerts and determine if it’s a false positive or an actual incident.

a) T
b) F

Answer 8

a)T

Question 9

Tier 2 Analysts – General incident response. Receive the tickets from tier 1 and take the necessary action for large incidents (like a port scan)

a) T
b) F

Answer 9

b)F

for smal incidents

Question 10

Tier 3 Analysts – Serious incident response. Security professionals capable of alerting and mobilizing the IR team to respond to a major breach.

a) T
b) F

Answer 10

a)T

Question 11

Incident Response Tools

Answer 11

Specific Tools
Remote Syslog (rsyslog – Remote collection of system logs)
Windows Event Forwarding
Google Rapid Response (GRR – Endpoint agent for analysis)
Redline (Endpoint analysis)
MozDef (Mozilla Defense Platform)
Osquery (Endpoint analysis)
bulk_extractor (Disk image data extraction)
Hindsight (browser history analysis)
Custom Built Virtual Machines
Remnux (Malware)
SIFT (Disk Forensics)
Security Onion (Network Analysis)
Kali (Misc security, Imaging)

Question 12

General Categories of Incident Response Tools

Answer 12

Forensic Imaging & Analysis Software 
EnCase, FTK, DD SleuthKit
Forensic Memory Capture Software
Volatility, LiME, Memoryze, Rekall
Malware Analysis Tools
Traffic capture & Analysis
TCPDump, Wireshark, tshark
Timeline Tools
Highlighter, Log2timeline, Plaso,  Timesketch