InfoSec Incident Management Flashcards
How can configuration changes occur during an investigation?
Use the existing change control if it is sufficiently mature.
What is the best method for developing a cyber-incident response plan in an organization?
Use an industry accepted standard plan template and adapt it to reflect existing processes and technologies.
What do you do with a computer that is the subject of a forensic investigation?
Place the computer in a locked storage room
What do you do if an adversary has gained entry to a system via a compromised SSH key?
Revoke compromised keys and kill active processes
Who is the best choice for the role of incident commander for a lengthy cyber security incident?
Incident response team members in 8 hour shifts
What is the average amount of time an organization takes to become aware of an active security incident?
220 days?
What is the purpose of threat hunting with respect to cyber-incident responses?
It provides early detection of cyber attacks
If there is an attack on a public facing application, what should you do?
Declare a disaster and fail over to DR systems once the adversary has been constrained on primary systems.
What should be the course of action immediately following a breach?
Request an after-action review to understand how to improve response procedures
What is an AIW?
Acceptable Interruption Window: Maximum time period system can be down before affecting business value proposition
What is RPO?
Recovery Point Objective: Earliest point in time where data recoverability is tolerable – quantifies allowable amount of data loss per interruption
What is RTO?
Recovery Time objective: Time it takes to recover a business function or resource after an interruption occurs
What is MTO?
Maximum Tolerable Outage: Max amount of tie the enterprise can support data processing in the alternative site
What is SDO?
Service Delivery Objective: Level of services to achieve during stay at alternative site until restoration to main site is completed – relates to business processes and delivery of value proposition
What are the primary activities in an incident?
Preparation, detection, triage, containment, and Post-incident
