section 4.2 Flashcards
What is the incident response cycle
Preparation,
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity
What are some ways to prepare for a security incident
- Communication methods
- Incident handling hardware & software
- Incident analysis resources
- Incident mitigation software
- Policies needed for incident handling
What are some challenges of detection?
Attackers are incoming all the time
Incidents are always complex
What are some Incident precursors
Web server log: - vulnerability scanner Exploit announcement: - Adobe Flash update Direct threats: - A hacking group does not like you
What is an incident indicator?
An attack is underway
Name some incident indicators
Buffer overflow attempt
Anti-virus software identifies malware
What is a sandbox? What can you do in the sandbox?
An isolated operating system
Run malware and analyze the results
What is the goal of recovery after an incident?
Get things back to normal
Remove the bad, keep the good
During the Recovery process, name some things you would eradicate. Name some things that you want to recover
Eradicate - bug - disable breached user account Recover - the system - restore from backups - rebuild from scratch
What are some exercises to practice in response to an incident?
Tabletop exercises
Walk through
Simulation
What are some differences between Communication plan and a Disaster Recovery plan
Communication plan is based on getting a contact list together. A recovery plan is based on creating a comprehensive plan that should include a communication plan
What should you implement if the disaster recovery plan does not go as planned
Continuity of operations planning
This team will determine if an event deserves a response by receiving reviewing, and then determining a response
Incident response team
What does a retention policy determine
Determines how much and where data should be stored. Even go as far as storing copies, versions of copies
This is an attack framework that determines the actions of an attacker. What is the name of this framework and what does it do
MITRE ATT&CK framework
- Identify point of intrusion
- Understand methods used to move around
- Identify potential security techniques to block future attacks
