IS4550 CHAPTER 12 Flashcards
An individual who understands the organization’s capability to restore the system, application, network, or data. Also has access to call lists to contact anyone in the organization during off hours is called ___.
BUSINESS CONTINUITY REPRESENTATIVE
A legal term referring to how evidence is documented and protected. Evidence must be documented and protected from the time it’s obtained to the time it’s presented in court is called ___.
CHAIN OF CUSTODY
A legal term that refers to effort made to avoid harm to another party. It essentially refers to the care that a person would reasonably be expected to see under particular circumstances is called ___.
DUE CARE
An individual who is an expert on HR policies and disciplinary proceedings or employee counseling is called ___.
HUMAN RESOURCES REPRESENTATIVE
An event that violate an organizations security policies is called ___.
INCIDENT
A specialized group of people whose purpose is to respond to major incidents is called ___.
INCIDENT RESPONSE TEAM (IRT)
In the context of an IRT team, this position provides risk management and analytical skills. They may also have specialized forensic skills for collecting and analyzing evidence and is called ___.
INFORMATION SECURITY REPRESENTATIVE
An individual who has intimate knowledge of the systems and configurations of an organization. This individual is typically a developer, system administrator or network administrator. They have the needed technical skills to make critical recommendations on how to top an attack and is called ___.
INFORMATION TECHNOLOGY SUBJECT MATTER EXPERTS
The person who keeps track of all the activity of the IRT during an incident. They act ad the official scribe of the team.. All activity flows through this person and they record who is doing what. This person is called ___.
IRT COORDINATOR
This person is the IRT leader. This individual makes all the final calls on how to respond to and incident. They are the interface with management and is called ___.
IRT MANAGER
An individual who has an understanding of laws and regulatory compliance is called ___.
LEGAL REPRESENTATIVE
An attack using viruses, worms,Trojan horses, and scripts and is called ___.
MALICIOUS CODE ATTACK
A software tools that runs a series of network commands to determine security weakness is called ___.
NETWORK RECONNAISSANCE PROBE
In the context of the IRT team, this individual can advise on how to communicate to the public and customers that mights be impacted by the incident. This person is valuable in ensuring that accurate information gets out and damaging misconceptions are prevented and is called ___.
PUBLIC RELATIONS REPRESENTATIVE
- All incidents regardless of how small should be handled by an incident response team.
TRUE OR FALSE
FALSE
- Which of the following should not be in an information response team charter?
- Mission
- Organization structure
- Detailed line budget
- Roles and responsibilities
Detailed line budget
- Which of the following IRT members should be consulted before communication to the public about an incident?
- Management
- Public relations
- IRT manager
- All the above
Management
Public relations
IRT manager
- As defined by this chapter, what is NOT a step in responding to an incident?
- Discovering an incident
- Reporting an incident
- Containing an incident
- Creating a budget to compare options
- Analyzing an incident response
Creating a budget to compare options
- A method outlined in this chapter to determine if an incident is major or minor is to classify an incident with a ___ rating.
SEVERITY
- When containing an incident, you should always apply a long-term preventive solution.
TRUE OR FALSE
FALSE
- The IRT starts recording events once an ___.
Incident is declared
- During the containment step, you should also gather as much evidence as reasonably possible about the incident.
TRUE OR FALSE
TRUE
- During the containment step, you should also gather as much evidence as reasonably possible about the incident.
TRUE OR FALSE
FALSE
- What value does a forensic tool bring?
- Gathers evidence
- Helps evidence to be accepted by the court
- Can take a bit image of a machine
- All the above
Gathers evidence
Helps evidence to be accepted by the court
Can take a bit image of a machine
- How important is it to identify the attacker before issuing a final IRT report?
- Critically important: do not issue the report without it
- Moderately important: nice to have but issue the report if not available
- Not important: focus on the incident and do not include identity of attacker even if you have it
- Important: but allow law enforcement to brief management about attacker’s identity
Moderately important: nice to have but issue the report if not available
- When analyzing an incident, you must try to determine which of the following?
- The tool used to attack
- The vulnerability that was exploited
- The result of the attack
- All the above
The tool used to attack
The vulnerability that was exploited
The result of the attack
- Which IRT member is responsible for handling the media?
Public relations
- It is best practice to test the IRT capability at least once a year.
TRUE OR FALSE
TRUE
- A federal agency is not required by law to report a security incident.
TRUE OR FALSE
FALSE
