Module 4 - 01-1 Flashcards
Important Cybersecurity Tools
Define Log
A record of events that occur within an organization’s systems.
Logs help security professionals identify vulnerabilities and potential security breaches.
What does SIEM stand for?
Security Information and Event Management (SIEM)
(pronounced as ‘sim’ or ‘seem’)
Define SIEM tool
An application that collects and analyzes log data to monitor critical activities in an organization.
How does a SIEM tool work?
- It collects real-time information, and allow security analysts to identify potential breaches as they happen.
- It reduces the amount of data an analyst must review by providing alerts for specific types of risks, threats, and vulnerabilities.
- It provides a series of dashboards that visually organize data into categories, allowing users to select the data they wish to analyze.
Define Dashboard
A tool used to visually communicate information or data
How would a security analyst use a SIEM tool?
- Analyze filtered events and patterns
- Perform incident analysis
- Proactively search for threats
What are two examples of SIEM tools?
1) Splunk
2) Chronicle (Google)
What is Splunk?
A data analysis platform
What is Splunk Enterprise and what do they provide?
A self-hosted tool used to retain, analyze, and search an organization’s log data.
It provides SIEM solutions.
What is Chronicle?
A cloud-native SIEM tool that stores security data for search and analysis
Define Playbook
A manual that provides details about any operational action, such as how to respond to an incident.
The purpose is to guide analysts through a series of steps to complete specific security-related tasks.
What is another name for a Network Protocol Analyzer?
Packet Sniffer
Define Network Protocol Analyzer (Packet Sniffer)
A tool designed to capture and analyze data traffic within a network.
The tool keeps a record of all the data that a computer within an organization’s network encounters.
What are two common network protocol analyzers?
1) tcpdump
2) Wireshark
What are two important playbooks that occur at the beginning of a forensic investigation?
1) Chain of Custody Playbook
2) Protecting and Preserving Evidence Playbook
Define Chain of Custody
The process of documenting evidence possession and control during an incident lifecycle
Briefly explain the Chain of Custody process
As a security analyst involved in a forensic analysis, you will work with the computer data that was breached. You and the forensic team will also need to document who, what, where, and why you have the collected evidence. The evidence is your responsibility while it is in your possession. Evidence must be kept safe and tracked. Every time evidence is moved, it should be reported. This allows all parties involved to know exactly where the evidence is at all times.
Define Protecting and Preserving Evidence
The process of properly working with fragile and volatile digital evidence
Define Order of Volatility
A sequence outlining the order of data that must be preserved from first to last
It prioritizes volatile data, which is data that may be lost if the device in question powers off, regardless of the reason.
What tool is designed to capture and analyze data traffic within a network?
- network protocol analyzer (packet sniffer)
- playbook
- security information and event management (SIEM)
- Structured Query Language (SQL)
network protocol analyzer (packet sniffer)
A packet sniffer, also known as a network protocol analyzer, is a tool designed to capture and analyze data traffic within a network.
What type of tool uses dashboards to organize data into categories and allows analysts to identify potential security incidents as they happen?
- Linux
- SIEM
- network protocol analyzers (packet sniffers)
- Python
SIEM
SIEM tools use dashboards to organize data into categories and allow analysts to identify potential security incidents, such breaches, as they happen.
What can cybersecurity professionals use logs for?
- To identify vulnerabilities and potential security breaches
- To research and optimize processing capabilities within a network
- To analyze data traffic within a network
- To select which security team members will respond to an incident
To identify vulnerabilities and potential security breaches
Cybersecurity professionals can use logs to identify vulnerabilities and potential security breaches, as well as other potential security incidents.
A _____ is a manual that provides details about operational actions.
- playbook
- case history
- checklist
- directory
playbook
A playbook is a manual that provides details about operational actions. Playbooks provide guidance when handling a security incident before, during, and after it has occurred.
