Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cybersecurity > Week 3 > Flashcards

Week 3 Flashcards

1
Q

What is the assumption behind SOIM?

A

The assumption is that we can’t, or won’t, fully protect our cyber environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the MAPE-K model for cybersecurity?

A

Monitor, Analyse, Plan, Execute - Knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What could be described as an architecture for adaptive systems?

A

MAPE-K
It is like an event-driven loop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three workflows of SOIM?

A

-IDPS
-SIEM
-SOAR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is CTI?

A

Cyber Threat Intelligence: Detailed knowledge of threats against an organisation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is ISAC?

A

Information Sharing and Analysis Centers: Organisations that gather data on security threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why is it so crucial to maintain an internal knowledge base?

A

To be able to cross-reference events with known intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is an example of an open, commercial database of cybersecurity intelligence?

A

Mitre ATT&CK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Why are honeypots important to SOIM?

A

We can learn both about hacker techniques as well as who they are

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are examples of CTI that should be shared?

A

Signatures for different platforms, snort rule sets, YARA signature exchange, Indicators of Compromise (IoC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What official European body can help increase our situational awareness of current cyber threats?

A

ENISA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Incident response is roughly divided into two tasks:

A

-Establishing capabilities
-Incident handling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Who should be part of a Computer Security Incident Response Team (CSIRT)?

A

Technical staff, legal, public relations, HR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which five things should be part of the incident response plan?

A

-Incident classification
-Response list
-Resources available
-Communication plan (who to talk to and when)
-Contingency plan (prioritisation)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What types of resources need to be easily available during an incident response?

A

-Backup internet connection
-Backup recovery plan
-Empty removable storage
-Backup power
-Backup laptops with correct tools
-Evidence gathering gear

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is investigated during the analysis part of MAPE-K?

A

The nature of the incident and the damage caused

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are examples of tasks that can be done to mitigate damage?

A

-Cutting the network
-Applying security patches
-Reinstalling machines
-Shutting down services

18
Q

Why is communication an important part of incident response?

A

Legal and compliance reasons as well as maintaining trust

19
Q

What is an important activity to do after an incident?

A

Measure the performance of the incident handling to learn from it

20
Q

Where might we source the data from the monitoring phase of MAPE-K?

A

IDPS, Firewalls, Clients, Servers, other network equipment

21
Q

What is a rule-based system often used during the monitoring phase of MAPE-K?

A

Snort

22
Q

What are the four modes of Snort?

A

-Sniffer
-Packet logger
-IDPS
-PCAP Investigation

22
Q

What is an example of a system that aggregates log data from different sources during the monitoring phase?

A

SIEM (Security Information and Event Management)

23
Q

What is a tool that can be used during the analysing phase to make sense of the data that has been gathered?

A

ELK

24
Q

What are the two broad methods for data analysis?

A

-Misuse detection
-Anomaly detection

25
Q

What is misuse detection dependent on?

A

DEFINITIONS of harmful code/behaviour/traffic

26
Q

What are the benefits and drawbacks of misuse detection?

A

Cheap and easy to implement but it has difficulty identifying new events

27
Q

What does anomaly detection rely on?

A

MODELS, often statistical, that define normal behaviour

28
Q

Which method of data analysis gives events a score that reflects how normal they are?

A

Anomaly detection - it then comes with a threshold that when reached sends off an alarm

29
Q

What is a false positive alarm?

A

Alert is raised for a benign event

30
Q

What is a true negative alarm?

A

Alert is not raised for a benign event

31
Q

Which phase in addition to the analysing phase is covered by the SIEM?

A

The planning phase

32
Q

What is logstack?

A

A log aggregator that collects logs from various sources

33
Q

Which tool is a combination of four technologies?

A

ELK: Elasticsearch, Kibana, Beats

34
Q

What is Elasticsearch?

A

A search engine

35
Q

What is the name of the visualisation layer for elasticsearch which makes it possible to create dashboards?

A

Kibana

36
Q

What is beats?

A

Agents that can collect data from hosts and forward to elasticsearch

37
Q

What is an alternative tool to ELK?

A

SPLUNK

38
Q

What are examples of automating the execution phase of MAPE-K?

A

-IDPS block rules
-Firewall filters
-Malware quarantine

39
Q

What are playbooks used for?

A

To help manage incidents efficiently

40
Q

What is developed to provide a guide for how to manage a certain type of incident?

A

A playbook

41
Q

What are some types of information that should be included in a playbook?

A

-Roles to be involved
-Tools to use
-Steps to take

Cybersecurity (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions