Incident Response Process (OBJ 4.8) Flashcards
7 Step of Incident Response
- Preparation
- Detection
- Analysis
- Containment
- Eradication
- Recovery
- Post-Incident Activity/ Lesson Learned
Preparation Phase
Policy, standard, training, testing and exercises of simulated incidents
Detection Phase
Identifies security incident
Analysis Phase
- Involves a thorough examination and evaluation of the incident.
- Stakeholders are notified
- containment begins
- initial response actions are taken.
Containment
Limit the scope and magnitude of the incident by securing data and protecting business operations.
Eradication
Starts after containment and aims to remove malicious activity from the system network.
Hybrid Password samples
admin1
Xyz@123
qwertyABCD!
$ecUr3P@55
Penetration Testing tools
Metabolites
Cobalt Strike
Kali Linux
ParrotOS
Commando OS
Directory Traversal Attack sample
Time | Source IP | Request URL | HTTP Status
18:02:00 | 198.51.100.2 | /images/logo.png | 200
18:02:10 | 198.51.100.2 | /css/style.css | 200
18:02:15 | 198.51.100.2 | /api/products | 200
18:02:20 | 198.51.100.2 | /../../../etc/passwd | 404
18:02:25 | 198.51.100.2 | /images/../../../../etc/shadow | 404
Distributed Denial of Service
Time | Source IP | Destination IP | Destination Port | Protocol | Event | Packets
20:00:00 | 192.0.2.10 | 203.0.113.5 | 80 | TCP | Connection Attempt | 10000
20:00:01 | 192.0.2.11 | 203.0.113.5 | 80 | TCP | Connection Attempt | 10000
20:00:01 | 192.0.2.12 | 203.0.113.5 | 80 | TCP | Connection Attempt | 10000
20:00:01 | 192.0.2.13 | 203.0.113.5 | 80 | TCP | Connection Attempt | 10000
20:00:01 | 192.0.2.14 | 203.0.113.5 | 80 | TCP | Connection Attempt | 10000
…
20:00:02 | 192.0.2.250 | 203.0.113.5 | 80 | TCP | Connection Attempt | 10000
XML injection
Time | Source IP | Request URL | HTTP Status | Payload
21:45:00 | 203.0.113.4 | /api/createUser | 200 | <user><name>John</name><password>abc123</password></user>
21:45:05 | 203.0.113.4 | /api/createUser | 200 | <user><name>Jane</name><password>xyz789</password></user>
21:45:10 | 203.0.113.4 | /api/createUser | 400 | <user><name>Bob</name><password>123&<isAdmin>1</isAdmin></password></user>
21:45:15 | 203.0.113.4 | /api/createUser | 400 | <user><name>Alice</name><password>456<!-- injected --></password></user>
Playbook
Is a checklist of actions for specific incident responses
Runbook
Automated versions of playbooks with human interaction points
