Operation Security

Question 1

What are the operations security triples?

Answer 1

threats, vulnerabilities, and assets

Question 2

Security baselining

Answer 2

is the process of capturing a point-in-time understanding of the current system security configuration.

Question 3

term vulnerability management

Answer 3

is used rather than just vulnerability scanning to emphasize the need for management of the vulnerability information.

Question 4

Zero-day exploit

Answer 4

rather than vulnerability, refers to the existence of exploit code for a vulnerability that has yet to be patched.

Question 5

zero-day vulnerability

Answer 5

The term for a vulnerability being known before the existence of a patch is zero-day vulnerability.

Question 6

Configuration Management

Answer 6

is a process of identifying and documenting hardware components, software, and the associated settings.

Involves development of a security-oriented baseline configuration.

It involves tasks such as disabling unnecessary services; removing unnecessary programs; enabling security capabilities such as firewalls, antivirus, and IDS; and the configuration of security and audit logs.

Question 7

Configuration Management process

Answer 7

o	The change is requested.
o	The change is approved.
o	The change is documented in the change log.
o	The change is tested and presented.
o	The change is implemented.

Question 8

Change management

Answer 8

purpose of the change control process is to understand, communicate, and document any changes with the primary goal of being able to understand, control,
and avoid direct or indirect negative impact that the changes might impose.

Question 9

The general flow of the change management process includes:

Answer 9

• Identifying a change
• Proposing a change
• Assessing the risk associated with the change
• Testing the change
• Scheduling the change
• Notifying impacted parties of the change
• Implementing the change
• Reporting results of the change implementation

Question 10

Fail-safe systems

Answer 10

provide the ability to automatically terminate the processes in response to a failure.

An example would be an automated locking system that defaults to unlock in case of power failure.

Question 11

Fail-secure state

Answer 11

refers to the ability of a system to maintain and preserve implies that a system should be able to protect itself and its information assets if critical processes are terminated and if a system becomes unusable.

An example would be an automated locking system that defaults to lock in case of power failure.

Question 12

active-active HA cluster

Answer 12

a load balancing - actively processes data in advance of a failure.

Question 13

active-passive

Answer 13

hot standby, configuration in which the backup systems only begin processing when a failure is detected.

Question 14

SANs

Answer 14

o Consists of dedicated block level storage on a dedicated network.
o Made of numerous storage devices such as tape libraries, optical drives and disk arrays.
o They utilize protocols like iSCSI to appear to operating systems as locally attached devices.
o Can provide warm or hot spares.
o Provide additional drive capacity.
o Commonly used in data centers and can occur over long distance.

Question 15

NASs

Answer 15

o Used to serve and store files.

o Common used as FTP servers.

Question 16

NIST Special Publication 800-61 outlines the incident response life cycle - step 1 & 2

Answer 16

1) Preparation: training, tools, policies,HW/SF
2) Detection and analysis (identification): analyze events to is determined whether an incident is actually occurring or has occurred.

6) Lesson learned: final report and feedback It is important to remember that the final step feeds back into the first step.

Question 17

NIST Special Publication 800-61 outlines the incident response life cycle - Step 3 containment

Answer 17

3) Containment: Keep further damage from occurring as a result of the incident but the threat still there, perform a binary (bit by bit) forensic backup, Capture volatile data,

Question 18

NIST Special Publication 800-61 outlines the incident response life cycle - step 4 Eradication

Answer 18

4) Eradication (Remediation and review):
1. removing any malicious software from a compromised system
2. Understanding the root cause of the incident.
3. Restore the system to a good state and should not be vulnerable to further impact. The restore involves either rebuilding the system from scratch or restoring from a known good backup.
4. Strengthening the defenses of the system

Question 19

NIST Special Publication 800-61 outlines the incident response life cycle - step 5 Recovery

Answer 19

5) Recovery: involves cautiously restoring the system or systems to operational status.
It ensures that the system is validated, properly restored to operation status, and monitored for potential further compromise.

Question 20

NIST Special Publication 800-61 outlines the incident response life cycle - Step 6 Lesson Learned

Answer 20

6) Lesson learned: final report and feedback It is important to remember that the final step feeds back into the first step.