Security Operations (OPS) Flashcards
Acoustical Detection
Microphones, vibrations sensors
Admissible Evidence
Relevant, sufficient, reliable, does not have to be tangible
Alarm filtering
The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks
Alert/Alarm
A signal suggesting a system has been or is being attacked.
Analysis
Systematic assessment of threats and vulnerabilities that provides a basis for effective management of risk.
Automatic Recovery
When resolving a single failure (though system administrators are needed to resolve additional failures
Automatic Recovery Without Undo Loss
Higher level of recovery defining prevention against the undue loss of protected objects
Auxiliary Station Systems
Alarm to local fire or police
Backup Storage Media
Tape: sequential, slow read, fast write 200GB an hour, historically
cheaper than disk (now changing), robotic libraries
Disk: fast read/write, less robust than tape
Optical drive: CD/DVD. Inexpensive
Solid state: USB drive, security issues, protected by AES
Best Evidence
Primary: used at the trial because it is the most reliable.
Original documents are used to document things such as contracts
Bind Variables
Placeholders for literal values in SQL query being sent to the database on a server; Used to enhance performance of a database
Business Attacks
Focus on illegally obtaining an organization’s confidential information. The use of the information gathered usually causes more damage than the initial event itself.
Central Stations
Less than 10mins travel time for e.g. an private security firm
Chain of Custody
Collection, analysis and preservation of data
Forensics uses bit-level copy of the disk
Change Control
Maintaining full control over requests, implementation, traceability, and proper documentation of changes.
Cipher Lock
Electrical
Circumstantial Evidence
Used to help assume another fact
Cannot stand on its own to directly prove a fact
Civil Law
Europe, South America
Classification
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification.
Classification Scheme
organization way of classifying data by factors such as criticality, sensitivity and ownership.
Clearing
Overwriting media to be reused
Combination Lock
3 digits with wheels
Common Law
USA, UK Australia Canada (judges)
Computer Crime Laws
3 types of harm:
unauthorized intrusion
unauthorized alteration or destruction
malicious code
Conclusive Evidence
Irrefutable, cannot be contradicted
Requires no other corraboration
Confidence value
A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack
Configuration
Collection of component CI’s that make another CI
Configuration item (CI)
Component whose state is recorded
Containment
Mitigate damage by isolating compromised systems from the network.
Corroborative Evidence
Supports or substantiates other evidence presented in a case
Darknet
Unused network space that may detect unauthorized activity
Data Custodian
Individuals and departments responsible for the storage and safeguarding of computerized data.
Data Dictionary
A database that contains the name, type, range of values, source and authorization for access for each data element
Data Haven
Is a country or location that has no laws or poorly enforced laws
Data Integrity
The property that data meet with a priority expectation of quality and that the data can be relied upon.
Data Leakage
Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes.
Data Loss Prevention (DLP)
Systems attempt to detect and block exfiltration attempts. These systems have the capability of scanning for keywords and patterns.
Data Owner
Individuals, normally managers or directors, who have responsibility for the integrity, accurate reporting and use of computerized data.
Database Shadowing
Real-time data backup ( Data Mirroring)
Debriefing / Feedback
External communications
Degauss
Protection of stored or displayed information by removal/reduction of the magnetic field (demagnetization).
Detection
Identification and notification of an unauthorized and/or undesired action
Device Lock
Bolt down hardware
Differential backup
Only modified files, doesn’t clear archive bit. Advantage: full and only last one needed, Intermediate time between.
Direct Evidence
Can prove fact by itself and does not need any type of backup.
Testimony from a witness; one of their 5 senses.
Oral: case can’t stand on it alone
Oral: does not need other evidence to substantiate
Electromechanical Detection
Senses a break or change in a circuit magnets pulled lose, wires door, pressure pads
Electronic Vaulting
Periodic, automatic and transparent backup of data in bulk.
Emergency Restart Failure
Occurs after a failure happens in an uncontrolled manner. E.g. when a low privileged user tries to access restricted memory segments
Endpoint-based DLP
Can scan files stored on a system as well as files sent to external devices, such as printers. For example, an organization endpoint-based DLP can prevent users from copying sensitive data to USB flash drives or sending sensitive data to a printer.
Enticement
The legal action of luring an intruder, like in a honeypot
Entitlement
Refers to the amount of privileges granted to users, typically when first provisioning an account. A user audit can detect when employees have excessive privileges
Entrapment
The illegal act of inducing a crime; the individual had no intent of committing the crime at first
Espionage
Malicious act of gathering proprietary, secret, private, sensitive, or confidential information about an organization. Often with the intent of disclosing or selling the information to a competitor or other interested organization (such as a foreign government). Attackers can be dissatisfied employees, and in some cases, employees who are being blackmailed from someone outside the organization. Countermeasures are to strictly control access to all nonpublic data, thoroughly screen new employee candidates, and efficiently track all employee activities.
Evidence
Must be preserved and identifiable
Sufficient –persuasive enough to convince one of its validity
Reliable –consistent with fact, evidence has not been tampered with or modified
Relevant –relationship to the findings must be reasonable and sensible, Proof of crime, documentation of events, proof of acts and methods used, motive proof, identification of acts
Permissible – lawful obtaining of evidence, avoid: unlawful search and seizure, secret recording, privacy violations, forced confessions, unlawful obtaining of evidence
Preserved and identifiable – collection, reconstruction
Identification labeling, recording serial number etc.
Evidence must be preserved and identifiable
Evidence Lifecycle
1. Discovery
2. Protection
3. Recording
4. Collection and identification
5. Analysis
6. Storage, preservation, transportation
7. Present in court
8. Return to owner
Exigent Circumstances
Allows officials to seize evidence before it’s destroyed (police team fall in)
Fail Closed/Secure
Most conservative from a security perspective
Fail safe system
Program execution is terminated and system protected from hardware or software compromise occurs DOORS usually
Fail soft
Or resilient system: reboot, selected, non-critical processing is terminated
Failover
Switches to hot backup
Failure Preparation
Backup critical information thus enabling data recovery
False attack stimulus
The event signaling an IDS to produce an alarm when no attack has taken place
False negative
A failure of an IDS to detect an actual attack
False positive
An alert or alarm that is triggered when no actual attack has taken place
Fault tolerance
Mitigation of system or component loss or interruption through use of backup capability.
Financial Attacks
Carried out to unlawfully obtain money or services.
Full Backup
All files, archive bit and modify bit are cleared. Advantage: only previous day needed for full restore, disadvantage: time consuming
Function Recovery
System can restore functional processes automatically
Grudge Attacks
Carried out to damage an organization or a person. The damage could be in the loss of information or information processing capabilities or harm to the organization or a person’s reputation.
Hackers and Crackers
Want to verify their skills as intruders
Hacktivists
Often combine political motivations with the thrill of hacking.
Hardware/ Embedded Device Analysis
Review the contents. This may include a review of Personal computers & Smartphones
Hearsay
Second-hand data not admissible in court
Hearsay Evidence
Something a witness hears another one say.
Business records and all that’s printed or displayed. Exception: audit trails and business records when the documents are created in the normal course of business.
Highly Confidential
Information that, if made public or even shared around the organization, could seriously impede the organization’s operations
Host-based IDS (HIDS)
Monitors activity on a single computer, including process calls and information recorded in firewall logs. Often examines events in more detail than NIDS, can pinpoint specific files compromised in an attack. Can track processes employed by the attacker. A benefit over NIDSs is that it can detect anomalies on the host system.
Hot Spares
Redundant component that provides failover capability in the event of failure or interruption of a primary component.
Hypervisor
Software component that manages the virtual components. Adds an additional attack surface, so it’s important to ensure it is deployed in a secure state and kept up-to-date with patches, controls access to physical resources
Incident
Event or series of events that adversely impact the ability of an organization to do business; suspected attack
Incident handling
A documented battle plan for coordinating response to incidents.
Incident response process
Detect
Respond
Report
Recover
Remediate
Review
Incremental Backup
Only modified files, archive bit cleared, Advantage: least time and space, Disadvantage: first restore full then all incremental backups, thus less reliable because it depends on more components
Internal Use only
loss would inconvenience the organization but disclosure is unlikely to result in financial loss or serious damage to credibility.
Interrogation
Evidence retrieval method, ultimately obtain a confession
Interviewing
Gather facts and determine the substance of the case.
Intrusion
Occurs when an attacker is able to bypass or thwart security mechanisms and gain access to an organization’s resources.
Intrusion Detection System (IDS)
Monitors recorded information and real-time events to detect abnormal activity indicating a potential incident. Automates the inspection of logs and real-time events to find attempts and failures. An effective method of detecting many DoS and DDoS attacks. Can recognize attacks that come from external connections, such as from the Internet, and attacks that spread internally such as a malicious worm. Responds by sending alerts or raising alarms. In some cases can modify the environment to stop an attack.
A primary goal is to provide a means for a timely and accurate response to attacks. Intended as part of a defense-in-depth security plan. It will work with and compliment other security mechanisms but does not replace them.
Intrusion Prevention System (IPS)
Includes all the capabilities of an IDS but can also take additional steps to stop or prevent intrusions. If desired, administrators can disable these extra features, essentially causing it to function as an IDS.
Islamite and other Religious Laws
ME, Africa, Indonesia
JBOD
Most basic type of storage
Lighting Continuous
Evenly distributed
Lighting Controlled
No bleeding over no blinding
Lighting Glare Protection
Against blinding
Lighting Responsive Areas Illumination
IDS detects activities and turns on lightning
Lighting Standby
Timers
Line Supervision Check
If no tampering is done with the alarm wires
Local Alarms
Audible at least 4000 feet
Locard’s principle
every time you make contact with another it results in an exchange of materials for both physical and digital evidence.
Log
Record of system activity, which provides for monitoring and detection.
Manual Recovery
System administrator intervention is required to return the system to a secure state
Media Analysis
A branch of computer forensic analysis. Involves the identification and extraction of information from storage. This may include the following: Magnetic (e.g., hard disks, tapes) Optical (e.g., CDs, DVDs, Blu-ray discs) Memory (e.g., RAM, solid state storage)
Techniques used may include the recovery of deleted files from unallocated sectors of the physical disk, the live connection to a computer system (especially useful when examining encrypted), and the static examination of forensic images of storage.
Military or Intelligence Attack
Designed to extract secret information.
MOM
Means, Opportunity and Motive
Used in determining suspects
Monitor
Continuous surveillance, to provide for detection and response of any failure in preventive controls.
Motion Detector
wave pattern movement sensors
MTBF
Mean Time Between Failures (Useful Life) = MTTF + MTTR
Network Analysis
Often depends on either prior knowledge that an incident is underway or the use of preexisting security controls that log activity. These include: Intrusion detection and prevention system logs, data captured by a flow monitoring system, Packet captures deliberately collected during an incident. Logs from firewalls and other security devices. Collect and correlate information from these disparate sources and produce as comprehensive a picture of activity as possible.
Network Attached Storage (NAS)
Server optimized for providing file-based data storage to the network. Unlike a File Server, a NAS unit has no input or output devices, and the OS is dedicated for providing storage services.
Network-based DLP
Scans all outgoing looking for specific variables. If a user sends out a restricted file, the system will detect it and prevent it from leaving the organization. Sends an alert, such as an email to an administrator.
Network-based IDS (NIDS)
Monitors and evaluates network activity to detect attacks or event anomalies. Cannot monitor content of encrypted traffic but can monitor other packet details. Just one can monitor a large network by using remote sensors to collect data at key network locations that send data to a central management console.
Noise
Data or interference that can trigger a false positive
Notebook
Most preferred in the legal investigation; pages are attached to a binding.
Notification
Communication of a security incident to stakeholders and data owners.
Object Reuse
Utilization after initial use
Opinion Rule
Requires witnesses to testify only about the facts of the case; cannot be used as evidence in the case.
Parallel Tests
Involve relocating personnel to the alternate site and commencing operations there. Critical systems are run at an alternate site, main site open also
Passive Infrared Detection
Through sensing changes in temperature
Photoelectric Detector
Light beams interrupted (as in an store entrance)
Prefabricated Building
A very cold site.
Preset Lock
Comes with door
Prevention
Controls deployed to avert unauthorized and/or undesired actions.
Programmable Lock
Combination or electrical lock
Proprietary
Define the way in which the organization operates.
Proprietary Systems
Owned and operated by the customer.
System provides many of the features in-house
Prototyping
Customer view taken into account
Proximity or Capacitance Detector
Magnetic field shows presence around an object
Pseudo Flaw
False vulnerability in a system that may attract an attacker
Purging
Degaussing or overwriting to be removed
RAID Levels
RAID 0 Striped, one large disk out of several. Improved performance but no fault tolerance
RAID 1 Mirrored drives: fault tolerance from disk errors and single disk failure, expensive; redundancy only, not speed
RAID 2 not used commercially. Hammering Code Parity/error
RAID 3 Striped on byte level with extra parity drive. Improved performance and fault tolerance, but parity drive is a single point of failure and write intensive. 3 or more drives
RAID 4 Same as Raid 3 but striped on block level; 3 or more drives
RAID 5 Striped on block level, parity distributed over all drives. Requires all drives but one to be present to operate hot. Swappable. Interleave parity, recovery control; 3 or more drives
RAID 6 Dual Parity; parity distributed over all drives. Requires all drives but two to be present to operate hot. Swappable.
RAID 7 Same as raid 5 but all drives act as one single virtual disk
Raking
Circumvent a pin tumbler lock
Recovery
Measures followed to restore critical functions following a security incident.
Redundant Array of Independent Drives (RAID)
A group of hard drives working as one storage unit for the purpose of speed and fault tolerance
Redundant Servers
Use of a backup server(s) to protect information and essential processes in the event of a primary system failure.
Remanence
Potentially retrievable data residue that remains following intended erasure of data.
Remote Journaling
Real-time, automatic and transparent backup of data.
Response Capability
Policy, procedures, a team
Sabotage
Criminal act of destruction or disruption committed against an organization by an employee. It can become a risk if an employee is knowledgeable enough about the assets of an organization, has sufficient access to manipulate critical aspects of the environment, and has become disgruntled.
Salvage Team
Goes back to the primary site to normal processing environmental conditions. Clean, repair, save what can be saved. Can declare when primary site is available again
Script Kiddies
Attackers who lack the ability to devise their own attacks will often download programs that do their work for them. The main motivation behind these attacks is the “high” of successfully breaking into a system. Service interruption. An attacker may destroy data, the main motivation is to compromise a system and perhaps use it to launch an attack against another victim. Website defacements common
Secondary Evidence
Copies of documents. Not as strong as best. A copy is not permitted if the original (Best) is available. Oral like Witness testimony
Server Clustering
Group of independent servers which are managed as a single system. All servers are online and take part in processing service requests.
All share the same OS and application software vs. grid devices that can have different OSs while still working on same problem.
Site policy
Guidelines within an organization that control the rules and configurations of an IDS
Site policy awareness
The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity
Software Analysis
Conduct forensic reviews of applications or the activity that takes place within a running application. In some cases, conduct a review of software code, looking for back doors, logic bombs, or other security vulnerabilities. In other cases, review and interpret the log files from application or database servers, seeking other signs of malicious activity, such as SQL injection attacks, privilege escalations, or other application attacks.
Software Library
Controlled area only accessible for approved users
Storage Area Network (SAN)
A subnetwork with storage devices servicing all servers on the attached network.
Subscription Services
Third party, commercial services provide alternate backups and processing facilities. Most common of implementations!
System Cold Start Failure
When an unexpected kernel or media failure happens and the regular recovery procedure
System Reboot Failure
System shuts itself down in a controlled manner after detecting inconsistent data structures or runs out of resources
System Recovery
1. Rebooting system in single user mode or recovery console, so no user access is enabled
2. Recovering all file systems that were active during failure
3. Restoring missing or damaged files
4. Recovering the required security characteristic, such as file security labels
5. Checking
Terrorist Attacks
Purpose of a terrorist attack is to disrupt normal life and instill fear
Thrill Attacks
Launched only for the fun of it. Pride, bragging rights
Top Secret
Highly sensitive internal documents that could seriously damage the organization if such information were lost or made public
True attack stimulus
An event that triggers an IDS to produce an alarm and react as though a real attack were in progress
Trusted Recovery
Ensures that the security is not breached when a system crash or failure occurs. Only required for a B3 and A1 level systems.
Tumbler Lock
Cylinder slot
Types of Investigation
- Operational
- Criminal
- Civil
- eDiscovery
US Law: 3 Branches
Legislative: writes (statutory laws)
Executive: enforces (administrative laws)
Juridical: interprets laws (makes common laws out of court decisions)
US Law: 3 Categories
Criminal: individuals in violation; punishment mostly imprisonment
Civil: wrongs against individual or organization that result in a damage or loss. Punishment can include financial penalties. AKA tort (I’ll Sue You!) Jury decides liability
Administrative/Regulatory: – how industries, organizations and officers have to act. Wrongs can be penalized with imprisonment or financial penalties
Victimology
Why certain people fall prey to crime and how lifestyle affects their chances
Warded Lock
Hanging, with a key
Raid 6
Does not require a hot spare drive or disk
warez
piracy act of copying software from top notch brands and distributing over the Internet
colocation cloud
Colocation cloud combines the benefits of colocation and cloud computing to provide a comprehensive solution that addresses the limitations of traditional data management approaches.
blue team
defends from attacks
red team
attacks
white team
handles security incidents
