Practice Test 1 Flashcards
- What is Lockheed Martin Kill?
Is a model developed by the Locked Martin to describe the stages of a cyber attack.
- What are the 7 stages of the Lockheed Martin Cyber Kill Chain?
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and Control (C2)
- Actions & Objectives
Stage 1. What is Reconnaissance ?
To gather Information about the target. Attackers perform research to identify potential vulnerability , employees or systems they can exploit.
For example: Scanning for open ports or looking for weak points in organisation’s Infrastructure.
Stage 2. Weaponization
Pairing a vulnerability with a malware payload. Attackerks prepare malicious tools (like malware) that can exploit identified vulnerabilities.
For example: Creating a malicious document or an infected websites that targets a specific vulnerability in the software.
Stage 3 . Delivery
Transmitting the malicious code to the target. The attacker sends the weaponized payload to the target. This is the stage where phishing emails. USP drops, or compromised websites are used.
For example: Sending an email attachment with malware to an unsuspecting victim.
Stage 4. Exploitation
Execute code on the victim’s system. The payload is executed on the victim’s system by exploiting the vulnerability.
For example: Opening an infected document that runs a malicious macro, or exploiting an unpatched system.
Stage 5. Installation
Install malware on the compromised system. The attacker installs additional tools ( such as backdoors or rootkits) to maintain access to the victim’s system .
For example: Installing malware like ransomware or a trojan to establish persistence on the victim’s machine.
Stage 6. Command and Control (C2)
Maintain communication with a compromised system. The attacker establishes a channel to remotely control the compromised system. This often involves communication with a remote server.
For example: A compromised computer “phoning home” to a command - and - control server to receive further instructions or exfiltrate data.
Stage 7. Action on Objectives
Achieve the attacker’s final objectives. At this stage, the attacker carries out the intended actions, which could range from data exfiltration , destruction of data, or further lateral movement within the network.
For example: Stealing sensitive data, deploying ransomware, or destroying files.
- What’s the purpose of Cyber Kill Chain model?
The Cyber Kill Chain model is a proactive approach used by security teams to : Detect threats at different stages.
Respond effectively to an attack in progress. Disrupt the attacker’s workflow at an stages to prevent them from completing their objective.
By understanding this chain, organisation can deploy security measures at each step to mitigate attacks and reduce their success rate.
- What is Brute force attack?
A brute force attack focuses on trying multiple passwords for a single user.
- What is Password spraying?
Password spraying focuses on attempting only one two passwords per user.
- What technique are commonly used by port and vulnerability scanners to identify the service running on a target system?
Banner grabbing and comparing response fingerprints. This method is common because both banner grabbing and response fingerprinting provide strong clues about the services on a system.
This questions is asking about techniques used by network scanning tools identify the services running on a system. It focuses on method that are commonly used by port and vulnerability scanners like Nmap to determine which services (Like HTTP, SSH,FTP ,etc) are active on a target system.
7.What is Data Exfiltration ?
Data exfiltration is data theft, the intentional , unauthorised transfer of data from a system or network. Various agents target data exfiltration - attackers, insiders and malware designed for data theft.
- What is buffer overflow?
A buffer overflow is a type of vulnerability that occurs when a program writes more data to a buffer (a temporary data storage area in a memory) than it can hold.
This can lead to unexpected behaviour , crashes or even allow attackers to execute malicious code on the system.
9.What is The Security Intelligence Cycle?
The Security Intelligence Cycle is a structured process used to collect, analyze, and disseminate information related to security threats, risks, and vulnerabilities.
It helps organizations to make informed decisions and take appropriate actions to mitigate security risks.
- What are the 6 phases of The Security Intelligence Cycle?
- Direction
- Collection
- Processing
- Analysis
- Dissemination
- Feedback
Phase 1. Direction
Purpose: Define the goals and objectives of the intelligence effort.
Activities: Identify the types of intelligence needed, prioritize security issues, and set specific tasks.
This stage often involves collaboration among stakeholders to understand their requirements.
Phase 2. Collection
Purpose: Gather relevant information and data.
Activities: Utilize various methods and sources to collect information, which can include open-source intelligence (OSINT), human intelligence (HUMINT), signals intelligence (SIGINT), and other forms. Data may be collected from internal systems, external threats, or public sources.
Phase 3. Processing
Purpose: Organize and prepare the collected data for analysis.
Activities: Filter, categorize, and format the information to make it usable. This may involve converting raw data into a structured format or enriching the data with additional context.
Phase 4. Analysis
Purpose: Assess the processed information to identify patterns, trends, and insights.
Activities: Apply analytical techniques to evaluate the significance of the information, determine potential threats, and develop actionable intelligence. Analysts may use various methodologies, such as statistical analysis, threat modeling, and scenario analysis.
Phase 5. Dissemination
Purpose: Share the analysed intelligence with stakeholders.
Activities: Distribute intelligence reports, briefings, or alerts to relevant personnel. The format and frequency of dissemination depend on the audience and the urgency of the information.
