Lecture 6

Question 1

What is incident response?

Answer 1

How an organization identifies, reacts, and recovers from a security issue.

Question 2

What are the key steps in incident response? (list 5)

Answer 2

1- Preparation: having clear response plans.

2- Identification: detecting and identifying the issue.

3- Containment: containing the threat from spreading further.

4- Eradication: removing the threat.

5- Recovery: restoring to normal operations.

Question 3

How does auditing help in incident response? (list 3 points)

Answer 3

-Helps detect suspicious behavior.

-Helps in investigating attacks and making a post-incident review.

-Help find the cause of incident to remove the threat.

Question 4

how can auditing help in fraud detection? (!!)

Answer 4

Auditing keeps record of all database activity, which helps in investigations and anomaly detection.

Question 5

List 3 types of fraud that can be detected using auditing:

Answer 5

-Insider Threat: employees who misuse their access.

-Financial fraud: manipulating financial data.

-Data Theft: authorized copying of data.

Question 6

What are 3 fraud detection techniques that are enhanced by database auditing? (!!)

Answer 6

-Anomaly detection via historical records.
-Data integrity monitoring.
-Privilege escalation detection