Unit 6 - Module 1 - Incident Response Flashcards
What do you call an observable occurrence on a network, system, or device?
An Event
What is a form of documentation used in incident response?
Incident Handler’s Journal
What incident responce process is cyclical?
NIST Incident Responce
What do you call a specialized group of security professionals that are trained in incident management and responce?
Computer Security Incident Response Teams ( CSIRT )
What framework are these 4 phases?
Preparation
Detection and Analysis
Containment, Eradication, and Recovery
Post-Incident Activity
NIST Framework
What are the 3 Important thing incident responce teams need?
3 C’s
Command
Control
Communication
What security responce teams usually have these 3 roles?
Security Analyst
Technical Lead
Incident Coordinator
CSIRT ( Computer Security Incident Responce Team )
What do you call a document that outlines the procedures to take in each step of incident response?
Incident Responce Plan
What is any form of recorded content that is used for a specific purpose?
Documentation
What is a manual that provides details about any operational action?
Playbook
What is an application that monitors system and network activity and produces alerts on possible intrusions?
Intrusion detection system (IDS)
What is an application that monitors system activity for intrusions and take action to stop the activity?
Intrusion prevention system (IPS)
What do you call an alert that correctly detects the presence of an attack?
A True Positive
What do you call a state where there is no detection of malicious activity. This is when malicious activity exists and no alert is triggered.
A True Negative
What is an alert that incorrectly detects that presence of a threat? This is when an IDS identifies an activity as malicious, but it isn’t. False positives are an inconvenience for security teams because they spend time and resources investigating an illegitimate alert.
A False Positive
What is a state where the presence of a threat is not detected? This is when malicious activity happens but IDS fails to detect it. False negatives are dangerous because security teams are left unaware of legitimate attacks that they can vulnerable to.
A False Negative
What is an application that monitors an endpoint for malicious activity? A tool that monitors, records, and analyzes endpoint system activity to identify, alert, and respond to suspicious activity.
End point Detection and Responce (EDR)
What is an application that collects and analyzes log data to monitor critical activities in an organization?
Security Information and Event Management (SIEM)
What tool uses these 4 steps?
Collect, Aggregate data, Normalize Data, and Analyze Data
SIEM Tool
What is a collection of applications, tools, and workflows that uses automation to respond to security events?
Security Orchestration, Automation, and Response (SOAR)
