Week 9 Flashcards
What are the two approaches to security discussed?
Reactive and Proactive approaches
What is the primary objective of threat hunting?
To intercept potential attacks before damage is done, or to mitigate damage of an attack in progress
What symptom indicates organizations are in Reactive Mode?
Security response teams wait for an alert to drive the next steps
What should organizations do to get ahead of attackers?
Think proactively and execute focused activities
What is the definition of Threat Hunting?
Cyber defense activity that seeks out evidence of malicious activities
- human-led
What are the two key goals of threat hunting?
- Identify previously unknown threats within environment
- Gain a deeper understanding of the organization’s technical landscape
What does a hypothesis-based investigation is centered around what 2 things?
Adversaries’ behaviors and TTPs
What are Indicators of Compromise (IoC)?
Indicates that the security of the network or system has been breached
What are Indicators of Attack (IoA)?
Indicators of the activities associated with the attack while the attack is happening
What is the purpose of building an attack story during threat hunting? By finding what?
To support the attack hypothesis by finding related resources/tools
What is the role of threat actors in threat modeling?
Knowing the Threat Actor’s resources and expertise
What does the acronym STRIDE stand for?
- Spoofing
- Tampering
- Repudiation
- Information Disclosure
- Denial of Service
- Elevation of Privilege
Fill in the blank: Threat modeling methodologies include STRIDE, DREAD, and _______.
PASTA
What is the first step in the Threat Modeling process?
Identify Assets
What are the desired properties associated with STRIDE?
- Authenticity
- Integrity
- Non-repudiation
- Confidentiality
- Availability
- Authorization
True or False: Threat hunting is primarily a reactive approach.
False
What is necessary for effective threat hunting?
Cybersecurity professionals who understand attacker tactics and vulnerabilities
What should be established to guide the threat hunting process?
A hypothesis around threat vectors/surface
What is an attack vector?
Specific paths threat actors use to gain unauthorized access
What does the threat modeling manifesto ask?
- What are we working on?
- What can go wrong?
- What are we going to do about it?
- Did we do a good enough job?
