Part-4 Flashcards
BPA
Business partner agreement
What exactly is expected of each entity in terms of services, finances, and security
MOU
memorandum of understanding
Usually not legally binding; less formal; they’re typically in acted as a way to expressed a desire for all parties to achieve the same goal in the agreed-upon manner; mutually beneficial
I SA
Interconnection security agreement
This type of agreement is geared toward the information systems a partner Entities to ensure that the use of inter-organizational technology needs a certain security standards; legally binding
RAID
Redundant array of independent disks
This is a set of vendor independent specifications that support redundancy and fault tolerance for configurations on multiple devices storage systems.
RAID 0
Data is written across multiple storage devices a.k.a. stripping, increasing performance. There is no redundancy of data , so a failure of one device affects the entire array.
RAID 1
Data is simultaneously replicated from one storage device to another I get a mirroring, decreasing performance. This provides redundancy, as data and I feel device may still be present on the mirrored device.
RAID 5
Data is stripped across three or more disks with one extra block a redundancy called a parity block. this provides increased performance and ensures that data on one failed storage device can be reconstructed from the parity block and the other functional devices.
RAID 6
This is the same as raid five except it uses one or more block of parity. This provides increased redundancy, as data onto field devices can be a reconstructed from the two parity blocks and the other functional devices.
Non-persistence
Is the property by which a computing environment, typically a virtual one, is discarded once it has finished its assigned tasks.
How do you enable persistence?
You can’t enable nonpersistence through the use of snapshots also known as checkpoints.
Live boot
The operating system is not installed on the system storage device rather runs directly and ram
High availability
The property that expresses how closely systems approach the goal of providing data availability 100% of the time while maintaining a high level of system performance.
An uptime rating of 99.9% or three nines is a very high level of availability, resulting in less than nine hours of downtime for a year. 49’s, or 99.99% uptime results in less than an hour of downtime for year but comes with an associate a proportional increase in cost.
DAS
Direct attached storage
NAS
Network attached storage
SAN
Storage area network
PGP
Pretty good privacy
MIME
Multipurpose Internet mail X tensions
GPG
GNU privacy guard
Data sensitivity
Public, private, restricted, confidential
Physical security controls
Deterrent Preventative Detective corrective compensating technical administrative
Man trap door
The system is also referred to as a dead man door, it is a system with the door at each end of a secure chamber.
Data exfiltration
This is the process by which and I talk or text data that is stored inside of a private network and music to an extra no network, therefore the victim no longer has complete control over the data.
Anomalies in event logs
Multiple consecutive authentication failures.
Unscheduled changes to the systems configuration.
Excessive or unexplained critical system failures or application crashes.
Excessive consumption of band with recorded in network device logs
Sequencing errors are gaps in the event log. And attacked and we tried to cover their tracks by deleting portions of the log or modifying the log.
Forensic response procedure
Capture forensic image and memory Examine network traffic and logs Capture video Take hashes Take screenshots
The order of volatility
Volatile to least volatile
- CPU registers , CPU cache, and RAM
- network caches and virtual memory
- Hard drives and flash drives
- CD-ROMs, DVD-ROMS and printouts
COOP
Continuity of operations also known as business continuity. This is a collection of processes that enable an organization to maintain normal business operations in the face of some adverse event
Disaster recovery process
Notify stakeholders begin emergency operations assess to damage Assess the facility Begin recovery process
Order of restoration
This dictates what types of systems your prior choice in your recovery efforts. Not all systems are equal in the eyes of the organization.
Recovery sites
hotsite
warm site
cold site
Hot site
This is a fully configured alternate network that can be online quickly after disaster.
Warm site
A location that is dormant or performs non-critical functions under normal conditions, but can be rapidly converted to a key operations site if needed.
Cold site
This is a predetermined alternate location where network can be rebuilt after disaster.
What are the different types of back ups?
Full back up
differential back up -all selected files that have changed since the last full backup are backed up
incremental back up-all files that have changed since the last full or incremental backup(which ever is the most recent)
Data sovereignty
This describes the social political outlook of a nation concert in computing technology and information
BCP
Business continuity plans
A policy that describes in ratifies the organizations overall business continuity strategy. It should identification of critical systems and components to ensure that such assets are protected. It should address infrastructure issues such as maintaining utility services, utilizing high-availability or fault tolerance systems that can withstand failure, and creating and maintaining data back ups.
DRP
Disaster recovery plan. This is the Policy that describes in ratifies the organizations recovery strategy.
IT contingency plan
This is a component of the BCP that specifies alternate IT procedures that you can switch over to you when you are faced with an attack or disruption of service leaving to a disaster for the organization.
Back out contingency plan
This is it documented plan that includes specific procedures and processes that are applied in the event that a change or modification me to a system must be undone
Succession plan
This ensures that all key business person I’ll have one or more designated back ups who can perform critical functions when needed.
Fail over
This is a technique that ensures ever done a component, device, or application quickly and efficiently take over the functionality of an asset that has failed.
Testing exercises
Walk-throughs, workshops, orientation seminars, tabletop exercises, functional exercises, full-scale exercises
AAR/LLR
After action report, lessons learned report
This includes an analysis of events that can provide insight into how you may improve your response processes in the future.
