Writing Assignment: Module 06

Question 1

From the perspective of incident response, what is an event?

Answer 1

Any observable system or network occurrence.

Question 2

What is an incident candidate?

Answer 2

A potential incident or ambiguously identified attack that could be an actual attack.

Question 3

What is the cyber kill chain?

Answer 3

1.Reconnaissance
2.Intrusion
3.Exploitation
4.Privilege Escalation
5.Lateral Movement
6.Obfuscation / Anti-forensics
7.Denial of Service
8.Exfiltration

Question 4

In the TCP/IP protocol, what is a port?

Answer 4

A port is a number used to uniquely identify a transaction over a network by specifying both the host and the service.

Port numbers range from 0 to 65535.
Well known ports are 0-1023,
Registered ports are 1024-49151
Dynamic ports or Private ports are from 49152-65535

Question 5

What are the three broad categories of incident indicators?

Answer 5

Possible, probable and definite.

Question 6

What are the four categories of events that are considered possible indicators of actual incidents?

Answer 6

1. Presence of unfamiliar files
   Unfamiliar or unexplained files in illogical locations
2. Presence or execution of unknown programs or processes
   Unfamiliar programs running, or processes executing
3. Unusual consumption of computing resources
   Memory or hard disk consumption spikes and falls
4. Unusual system crashes
   System crashing, hanging, rebooting, or freezing more frequently than usual

Question 7

What are the four types of events that are considered probable indicators of actual incidents?

Answer 7

1. Activities at unexpected times
   Network traffic levels exceed baseline levels
2. Presence of unexpected new accounts
   Periodic review indicates unfamiliar accounts
   Unlogged new account with root or special privileges
3. Reported attacks
   Verify user technical sophistication
4. Notification from IDPS
   Must determine if notification real or a false positive

Question 8

What are the five types of events that are considered definite indicators of actual incidents?

Answer 8

1. Use of dormant accounts
2. Changes to logs
3. Presence of hacker tools
4. Notifications by partner or peer
5. Notification by hacker

Question 9

The occurrences of what general types of events indicate that an actual incident is occurring?

Answer 9

-loss of availability
-loss of integrity
-loss of confidentiality
-violation of policy
-violation of law

Question 10

What is a false positive?

Answer 10

a test result which incorrectly indicates that a particular condition or attribute is present.

Question 11

What is noise? Is noise different from a false positive event?

Answer 11

Noise: legitimate activities wrongly reported
-Activate feedback process to prevent flagging
-Inherent in the nature of best-tuned systems

Question 12

What are the general causes of noise?

Answer 12

Sensor placement; policy; lack of awareness

Question 13

What is tuning?

Answer 13

Tuning is a combination of reducing false positives, working with alerts, and correlating events and trends to ensure greater accuracy. Each of these helps the analyst by refining alerts being looked into.

Question 14

What is a false negative?

Answer 14

normal user detected as a new user

Question 15

What is a computer process?

Answer 15

is a set of instructions, A set of memory, A list of allocated, A list of attributes, and A table that identifies the current context of the various parts.

Question 16

What is a computer service?

Answer 16

Computer processes are often performed at the same time that the computer system.

Question 17

What is the most effective way to stop phishing attacks?

Answer 17

the SETA program

Question 18

What is business e-mail compromise (BEC)?

Answer 18

In a BEC scam, criminals send an email message that appears to come from a known source making a legitimate request

Question 19

What is data exfiltration?

Answer 19

data exfiltration is a form of a security breach that occurs when an individual’s or company’s data is copied, transferred,

Question 20

What general approach is recommended to distinguish real incidents from false positive events?

Answer 20

The general approach to narrowing the list of incident candidates and thereby detect incidents includes these steps: collect incident candidates using well-documented procedures, investigate the candidates using systems and methods at your disposal, and if a candidate is determined to be other than an authorized activity, immediately initiate your intrusion response procedures.

Question 21

What activities go into a complete log management approach?

Answer 21

To be effective, logs must first be enabled. Then, you protect the logs by the hardening the servers that create and store logs. Finally, you manage the logs.