Week 4

Question 1

What are two frameworks for playbooks?

Answer 1

-NIST
-IACD

Question 2

What is an important non-IT aspect to explain in a playbook?

Answer 2

The impact on wider operations outside of the IT department - helps to get both understanding and funds from management

Question 3

What is one way to reduce the amount of false positive alarms?

Answer 3

Buy proprietary tools, however these can hide the reason for the alarm

Question 4

What is a problem with using ML for classification in a SOC?

Answer 4

It is good at seeing correlations but not so good at understanding causalities

Question 5

What does computer forensics deal with?

Answer 5

Digital evidence that is present in any top of crime - they do not necessarily work on cybercrimes

Question 6

What is the foundation of digital forensics?

Answer 6

The practice of collecting, analysing and reporting on digital data

Question 7

What is important to remember regarding the state of the evidence during digital forensics?

Answer 7

It must not be changed in order to be valid in court