Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIH > Module 4: CSIRT > Flashcards

Module 4: CSIRT Flashcards

1
Q

What does CSIRT stand for

A

Computer Security Incident Response Team (CSIRT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary job function of CSIRT

A

To review, receive, and respond to incidents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does an Incident Response Team help an organization do

A

Recover from computer security breaches and threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the goal of a CSIRT

A
  • Manage the security problems
  • Reduce and control the damage
  • Provide effective response and recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Why is a clear vision for the CSIRT needed

A

A vision acts as a guiding principle for teams and helps them remain focused to achieve a predefined business objective.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the purpose of a CSIRT Mission Statement

A

Infers what a team is trying to achieve

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a CSIRT’s constituency

A

The region where the CSIRT is bound to serve.

Such as the constituency of Gulfstream can be “Gulfstream Aerospace Corporation” and “gulfstream.com”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What type of issues does a CSIRT constituency have to face

A
  • Constituencies that overlap (have clear rules of what their services are)
  • Relationship to Constituency (level of authority)
  • Promoting the CSIRT to the Constituency (how is it viewed to the public)
  • Gaining Constituency Trust
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a full constituency relationship

A

The CSIRT has fully authority to make any decision(s) on behalf of their constituency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a shared constituency relationship

A

The CSIRT provide direct support to their constituents and share in the decision-making process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a none constituency relationship

A

The CSIRT have no authority and act as advisors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

TRUE or FALSE: With all the many different CSIRT’s from around the world it is not encouraged to co-operate with one another in order to get their jobs done.

A

FALSE

Cooperation and coordination is the heart of the CSIRT framework

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a internal CSIRT

A

Offers incident handling services to their parent organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a national CSIRT

A

Provides services to an entire nation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a coordination center

A

They coordinate and facilitate the handling of the incidents across various CSIRT’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is an analysis center

A

To use synced data from various sources such as patterns to provide early warning and predict future activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are vendor teams

A

They are teams that coordinate with organizations who report and track vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What do Incident Response Providers do

A

Provide assistance regarding incident handling services to paid clients

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What steps need to be done to create a CSIRT

A
  1. Obtain management’s support and buy-in
  2. Determine the CSIRT strategic plan
  3. Gather relevant information
  4. Design the CSIRT vision
  5. Communicate the CSIRT vision and operational plan
  6. Begin CSIRT implementation
  7. Announce the operational CSIRT
  8. Evaluate CSIRT effectiveness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

TRUE or FALSE: It is important to get management support for creating a CSIRT. (or for creating any project)

A

TRUE

They can approve the funding that makes it happen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What relevant information needs to be gathered for a CSIRT

A

The expectations, strategic direction, definitions, and responsibilities of the CSIRT

22
Q

When designing the CSIRT vision what is the main focus

A

To communicate clearly the definition and what is expected from the CSIRT.

*The ultimate goal is to provide response to incidents

23
Q

Why must you create the CSIRT’s vision and communicate it with management.

A

Because you might have to modify or make changes to the plan. It also helps gain additional information that was missed during the info gathering process

24
Q

What are some steps that need to occur when implementing a CSIRT

A
  • Hiring staff
  • Purchasing equipment
  • Developing policies
  • Develop incident-tracking system
  • Develop incident-tracking guidelines and forms
25
Q

Who needs to announce to the organization that the organization has a CSIRT now

A

Management

26
Q

According to EC Council, what is the role of a CSIRT

A

To provide IT security services such as prevention, detection, correction, and awareness building to their constituency

27
Q

What services does the CSIRT provide

A
  • Awareness raising
  • Detection
  • Correction
28
Q

A few common roles in an Incident Response Team are

A
  • Incident Coordinator (IC) - (Acts a link between groups)
  • Incident Manager (IM) - (Handles incident from management and technical POV)
  • Incident Analyst (IA) - (Eradicates and recovers from the incident)
  • Constituency - (Stakeholder in the incident)
  • Administration - (Ensures the office operations return to normal)
  • HR - (Responsible for human aspect of the disaster)
  • Public Relations - (Responsible for stakeholder communications)
29
Q

What are the three categories of CSIRT services

A
  • Reactive services
  • Proactive services
  • Security quality management services
30
Q

How does a reactive service work

A

It identifies and rectifies any threats against the CSIRT systems

31
Q

What are the reactive services that are provided

A
  • Alerts and warnings
  • Incident handling
  • Vulnerability handling
  • Artifact handling (a malicious file or object on the computer system)
32
Q

How does a proactive service work

A

It is to prevent the occurrence of an incident and to minimize their impact and scope.

33
Q

What are the proactive services that are provided

A
  • Announcements
  • Technology Watch
  • Security Audits or Assessments
  • Config and Maintenance of Security Tools, Applications, Infrastructures, and services
  • Development of Security Tools
  • IDS
  • Security-related information dissemination
34
Q

How does a security quality management service work

A

They are designed to include feedback and lessons learned while responding to the security incidents

35
Q

What are the security quality management services that are provided

A
  • Risk analysis
  • Business Continuity and Disaster Recovery Planning
  • Security Consulting
  • Awareness building
  • Education/training
  • Product evaluation or certification
36
Q

What is the difference between policy and procedure

A

Policy is the governing principles which the organization and teams will adopt

Procedures defines the way how a team performs its activities without crossing the policy limits

37
Q

How is a policy defined

A
  • Attributes (important and necessary characteristics of a particular subject area)
  • Content (behavior in a specific subject area)
  • Validation (checks the ideas on whether they can be translated into real life)
  • Implementation, maintenance, and enforcement
38
Q

How CSIRT handles a case

A
  1. Keep a log book (FIR)
  2. Inform the appropriate people (Danny or the end user)
  3. Maintain a list of contacts (Kenny Quick, Chris Mitchell)
  4. Release the information (Emailing the end user)
  5. Follow up analysis (2nd level review from another shift or peer)
  6. Report (Send a report to Dave and Sheryl)
39
Q

What does CERT stand for

A

Community Emergency Response Team (CERT)

40
Q

What does CERT do

A

Helps to train people to be better prepared to respond to emergency situations in their communities.

41
Q

What does CERT-CC stand for

A

Community Emergency Response Team Coordination Center (CERT-CC)

42
Q

What does CERT-CC do

A

To provide response to major security incidents and analyze product vulnerabilities

43
Q

What does OCTAVE stand for

A

Operationally Critical Threat, Asset, and Vulnerability Evaulation (OCTAVE)

44
Q

What is OCTAVE used for

A

A set of tools, techniques, and methods for risk-based information security strategic assessment and planning.

45
Q

What are the three OCTAVE methods

A
  • OCTAVE Method
  • OCTAVE-S
  • OCTAVE-Allegro
46
Q

How does the OCTAVE Method work

A

Uses a three-phased approach to examine organizational and technology issues

47
Q

What are the 3 phases of OCTAVE Method

A

Phase 1. Build Asset-Based Threat Profiles
Phase 2. Identify Infrastructure Vulnerabilities
Phase 3. Develop Security Strategy and Plans

48
Q

How does OCTAVE-S work

A

It is under the assumption that the analysis team is aware of information about important assets, security requirements, threats, and security practices

49
Q

How does OCTAVE-Allegro work

A

It focuses on information assets to which they are connected.

50
Q

What is the CSIRT service category that artifact handling belongs to

A

Reactive services

CIH (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions