Introduction to Cyber Security

Question 1

What is Offensive Security

Answer 1

Offensive Security is the process of breaking into computer systems, exploiting software bugs, and finding loopholes to gain unauthorised access to them, before then recommending patches to fix the issues you used to gain this privilege.

Question 2

What is Defensive Security

Answer 2

Defensive security is the process of protecting an organizations network and computer systems by analysing and securing any digital threats.

Question 3

What are the two main tasks of Defensive Security?

Answer 3

Preventing Intrusion from occurring
Detecting Intrusion when it does occur and responding accordingly

Question 4

How is Cyber Awareness related to Defensive Security

Answer 4

Training users about cyber security can help protect against many attack vectors targeting systems, such as phishing attempts.

Question 5

How does Documenting and Managing Assets aid Defensive Security

Answer 5

Documenting and Managing assets aids defensive security as the cyber professional hired to do the work knows what systems they are in charge of and how they can protect it properly

Question 6

How does Updating and patching systems help Defensive Security?

Answer 6

Updating and Patching systems help with defensive security since it makes sure that the systems are up to date with defences against known vulnerabilities

Question 7

How does the process of setting up preventative security settings aid Defensive Security?

Answer 7

Firewalls and Intrusion prevention systems (IPS) are important for defensive security as you can manage what goes in and out of a network, while Intrusion Prevention Systems can block attacks which match known attacking systems.

Question 8

How does the presence of logging and monitoring devices aid Defensive Security

Answer 8

This aids with detection of malicious activities and intrusions, as well as recovering any damaged systems after an attack has stopped/been repelled.

Question 9

What are the two main topics of Defensive Security?

Answer 9

Malware Analysis & Threat Analysis

Question 10

What is a Security Operations Center?

Answer 10

The Security Operations Centre is a team of cyber professionals that monitor the network and system to detect malicious cyber security events.

Question 11

What are the main areas of interest for the SOC?

Answer 11

Vulnerabilities, Policy Violations, Unauthorized Activity, Network Intrusion

Question 12

What is Threat Intelligence?

Answer 12

Threat Intelligence is analysing the job of the client to understand what threats you may be going up against, to try and give you a better idea on what attacks might occur (i.e. a Nation State hacker may be much more skilled than a Ransomware hacker).

Question 13

What is Digital Forensics?

Answer 13

Digital Forensics is the application of science to investigate crimes and establish facts from analysing a system.

Question 14

What is Incident Response?

Answer 14

Incident Response can usually refers to Cyber Attacks or Data breaches, although it can also be less major events such as misconfigurations, intrusion attempts & policy violations.

Question 14

What are the four major phases of Incident Response?

Answer 14

Preparation, Detection & Analysis, Containment, Post-Incident Activity

Question 14

What areas does Digital Forensics focus on?

Answer 14

Digital forensics focuses on the analysis of File Systems, System Memory, System Logs & Network Logs.

Question 14

What occurs in the Containment, Eradication and Recovery Phase of Incident Response?

Answer 14

the Containment, eradication and recovery phase occurs when the incident is detected to stop it from affecting other systems, eliminating the incident, and recovering any lost files caused from the event.

Question 14

What is the Preparation Phase of Incident response?

Answer 14

The preparation phase of incident response is in charge of making sure a team is ready to combat any cyber attacks

Question 14

What is the Detection and Analysis phase of Incident Response?

Answer 14

The Detection and Analysis phase of incident response is where the team first detects an attack, and starts to analyse what the attack is attempting to do to better prevent any negative effects.

Question 14

What occurs in the Post-Incident Activity phase of Incident Response?

Answer 14

In the Post-Activity Phase, a report is produced, and any learned lessons are shared to defend against similar future events.

Question 14

What is Malware Analysis?

Answer 14

Malware Analysis is the analysis of any malicious software, where it be a virus, Trojan Horse, or ransomware

Question 15

What is the purpose of Malware Analysis?

Answer 15

Malware Analysis aims to learn about such malicious programs using various means, these can be inspecting the code of the malware without running it, or running it in a quarantined system so it is controlled.