Test Study 8 Flashcards
What type of embedded OS is becoming more pervasive and has large public safety implications?
Vehicles
What is a reference template?
The sample of bio-metric data used for comparison in authentication.
What is the sample of bio-metric data used for comparison in authentication called?
Reference template
What authentication server transmits authorization information in clear text?
Radius
An employee is not performing per the standards of the company. Another employee has spent person time investigating this and proving it. What is the issue?
The other employee has not received authorization for an investigation.
What items require:
Reasonable suspicion?
Probabl cause?
Reasonable suspicion - stopping someone
Probable cause - warrant, grand jury
Which type of vendor fix is for a critical security issue?
Hot fix
Which type of vendor fix is a solution for a single issue?
Patch
Which type of vendor hot fix is a collection of fixes?
Service Pack
What is poly-instantiation a defense against?
Inference attacks
What is a defense against inference attacks?
Poly-instantiation
What are system operating rings also known as?
Privilege domains
What are the steps of PICERF?
Prepare Identify Contain Eradicate Recovery Follow Up
What are the steps for the CISSP incident response?
Detect Respond Mitigate Report Recover Remediate Lessons Learned
In PICERF, what happens in the prepare phase?
Properly train employees
Incident response drills and scenarios
Have approval and funding
In DRMRRRL, what happens in the detect phase?
Discover an incident, notify the security office.
In PICERF, what happens in the Identify phase?
Determine whether you have been breached, how it was done, what the scope was, has root cause been found?
In DRMRRRL, what happens in the response phase?
Determine the validity of detection, rule out false positives, determine if it still ongoing or over.
Formally declare an incident.
In PICERF, what happens in the contain phase?
Contain the breach so it does not spread
Update and patch systems
Change passwords
Help restore from backup
in DRMRRRL, what happens in the mitigate phase?
Immediate action upon declaration of the incident, dependent upon time, risk, and impact.
Stop the incident, take down servers, fix the damage.
In PICERF, what happens in the eradication phase?
Eliminate the root cause
Patch systems
Re-image if necessary
In DRMRRRL, what happens in the report phase?
Report to relevant stakeholders, management, regulators, and law enforcement about the incident
In PICERF, what happens in the recovery phase?
Restore systems to production
Enable file integrity monitoring
In DRMRRRL, what happens in the recovery phase?
Return the environment to normal operations
