Security Operations 4.8

Question 1

Preparing for an incident

Answer 1

Communication methods. Phones and contact information.

Incident handling hardware and software

Incident analysis and resources.

Incident mitigation software. Clean OS and application images.

Question 2

Incident Planning.

Answer 2

Testing, Limited amount of time. Evaluate response.

Table top exercises. Performing a full-scale disaster drill takes times and has an opportunity cost.

Everyone sitting around a table and working through discussing what would be done in a IR.

See where there might be room for improvement in a IR situation.

Question 3

Simulation

Answer 3

Phishing simulation. Creating a phishing email attack. Send to your user community.
Test the phishing get the filter.

Question 4

Root cause analysis

Answer 4

Determine the ultimate cause of an incident, find the root cause.

Question 5

Threat hunting

Answer 5

Finding the attacker before they find you.

Question 6

Digital forensics