Módulo 09 - Incident Response Flashcards
Acronym:
IR
Incident Response
List:
Types of security incidents
- Employee errors [Ignorance]
- Insider
- External intrusion attempts
- Malicious software
- Commercial Espionage
- Denial of Service
List:
Steps in the Incident Response Lifecycle
- Preparation
- Detection
- Analysis
- Containment
- Eradication
- Recovery
- Lessons learned
Define:
Security Incident.
An event or series of events resulting from a security policy violation, which may or may not adversely affect an organization’s ability to conduct business
Define:
Incident Response (IR) Policy
A set of resources, processes, and guidelines for managing cybersecurity incidents, ensuring appropriate actions are taken during the incident lifecycle
Define:
Isolation
Isolation limits the ability of a compromised process or application to harm the network or its assets by restricting access to resources.
Define:
Containment
Containment is the action taken immediately after detecting and identifying an event to limit its impact, such as disconnecting a machine from the network.
Define:
Segmentation
Segmentation is a network design strategy that separates network sections to prevent malicious actors from pivoting within the network.
Define:
Security Orchestration, Automation, and Response (SOAR)
A platform that compiles security data from various endpoints and allows analysts to automate solutions for security incidents based on predefined criteria.
Define:
Runbook
A condition-based series of protocols used to automate security incident response processes, accelerating assessment, investigation, and mitigation.”
Define:
Playbook
A checklist-style document specifying step-by-step procedures to respond to a security threat or incident, ensuring a consistent approach.
List:
Features of a SIEM system
- Vulnerability scan output
- SIEM dashboards
- Sensors
- Sensitivity
- Trends
- Alerts
- Correlation
Define:
SIEM
A system combining security information management (SIM) and security event management (SEM) functions into one security management platform.
Define:
Vulnerability Scan Output
The output from scanners that identify vulnerabilities across network assets and recommend remediation steps, delivered to IT admins via the SIEM dashboard.
Define:
SIEM Dashboard
A customizable interface showing real-time security and network information, allowing IT teams to monitor and respond to events effectively.\
Define:
Sensor (in SIEM)
A device or software programmed to send alerts to the SIEM based on activity at critical endpoints, services, or vulnerable locations.
Define:
Sensitivity (in SIEM)
The level of sensitivity configured for sensors, customizing the data sent to the SIEM based on the organization’s specific monitoring needs.
Define:
Trends (in SIEM)
Patterns of activity discovered and reported to the SIEM, used to establish baselines and help analysts identify anomalies.
Define:
Alert (in SIEM)
A notification sent by the SIEM to inform the IT team when a parameter is outside the acceptable range, often used for 24-hour monitoring.
Define:
Correlation (in SIEM)
The process by which SIEM software analyzes data from multiple sources, compares it to known malicious behavior, and identifies potential security events.
Acronym:
SIEM
Security Information and Event Management
Define:
Log Data
A critical resource for investigating security incidents, containing event message data and metadata generated by processes on network appliances and hosts.
Define:
Event Message Data
The specific notification or alert generated by a process, such as ‘Login failure’ or ‘Firewall rule dropped traffic.
Define:
Event Metadata
Information about the source and time of an event, including host/network address, process name, categorization, and priority fields.
Define:
Syslog
An open format, protocol, and server software for logging event messages, used by various hosts like routers, firewalls, and Linux servers.
Define:
PRI Code (Syslog)
A code in syslog messages calculated from the facility and severity level.
Define:
Metadata
Attributes of files or network activity that include information like timestamps, security attributes, permissions, and extended attributes like author or location.
Define:
Email Metadata
Information in an email header that includes sender, recipient, and originating account/IP. Security devices may add X-headers for accurate tracing.
