Module 1: Introduction to Incident Response and Handling Flashcards
What is a Computer Security Incident
A computer security incident might be any real or suspected adverse event in relation to the security of computer systems or networks
Types of Security Attacks
- Repeated unsuccessful login attempts
- Unavailability of services due to DDoS
- Unintentional modifications to software/hardware/firmware
- Unauthorized use of systems
- System and application crashes
- Unauthorized use of other user’s accounts
- Gaining admin privilege to perform unauthorized access
Five levels of Data Classification
- Top Secret
- Highly confidential Information
- Proprietary Information
- Information of Internal Use
- Public documents
What is Information System
It is a computer system that modifies the raw data into useful information to attain specific goals for an organization or an individual
What is Information Owner
This is a person who first creates, or initiates the creation or storage of the data
What is Information Custodian
This is a person who controls and implements security required to protect the information assets classified by the information owner
Different forms of information warfare
- Hijacking television and radio transmissions
- Jamming television and radio transmissions
- Disabling logistics networks
- Spoofing or disabling the communication networks
Weapons in information warfare
- Viruses
- Worms
- Trojan Horses
- Logic Bombs
- Trap Doors
- Rootkits
- Chipping
- Nano machines and Microbes
- Electronic jamming
What are the Key Concepts of Information Security
Confidentiality
Integrity
Availability
How is Confidentiality maintained?
Through user’s authentication and access control
What does integrity refer to?
The reliability and trustworthiness of the information
What is a vulnerability
It is a flaw or weakness in the system, if exploited, might result in undesirable events such as compromise of security, violation of system integrity, etc.
Examples of a vulnerability
- Weak passwords
- Software bugs
- Virus or malware
- Script code injection or a SQL injection
What is a threat
It is an event, person, or circumstance that has the ability to damage the system by altering, deleting, disclosing of confidential information
What is an attack
Attack is the deliberate action of causing harm to the computer systems by exploiting known vulnerabilities and threats
What are the types of Computer Security Incidents
- Malicious code or Insider Threat Attacks
- Unauthorized Access
- Unauthorized Use of Services
- Espionage
- Fraud and Theft
- Employee sabotage and abuse
- DoS
- Misuse
Typical indications of security incidents
- Failed logon attempts and creation of new user accounts
- The IDS, IPS, firewalls, and system alerts
- Log entries and audit files showing suspicious entries
- Network slowdown, DoS attacks, and denial of login to legitimate users
- Detecting of network traffic capturing devices like sniffers on the network
- Unusual system crashes or poor system performance
- Unusual occurrence of the security incident
- Unusual usage patterns
What is a Precursor Incident
Indicates the possibility of occurrence of a security incident.
What is a Indication Incident
Implies that an incident has probably occurred or is in progress.
Low level Incidents
- Loss of personal password
- Unsuccessful scans and probes in the network
- Request to review security logs
- Presence of any computer virus or worms
- Failure to download anti-virus signatures
- Suspected sharing of the organization’s accounts
- Minor breaches of the organization’s acceptable use policy
- Compromise of the system password
- Unknown sharing of the company’s account
- Misuse of the computer peripherals
Middle Level Incidents
- In-active external/internal unauthorized access to systems
- Unfriendly employee termination
- Localized worm/virus outbreak
- Breach of the organization’s acceptable usage policy
High Level Incidents
- DoS attacks
- Suspected break-in in any computer of a company
- The presence of harmful malware
- Cyber terrorism
What are the two factors to prioritize an incident
Technical effect & criticality of the affected resources
What is the goal of Incident Response
To handle the security incident in such a way that it reduces the damage and minimizes the cost and time to recover from the incident
Who is in charge of Incident response
The Incident Response Team of the organization
What is Incident Handling
It refers to a set of procedures and policies used to prepare for, detect, and overcome security incidents in an organization
What is Incident Reporting
The process of reporting the information regarding the encountered security breach in a proper format.
What is the time frame to handle incidents if they are a low-level incident
1 working day
What is the time frame to handle incidents if they are a middle-level incident
Within a few hours on the same day of its occurrence
What is the time frame to handle incidents if they are a high-level incident
These incidents are to be handled immediately
