4.2 policies, processes, and procedures for incident response

Question 1

MITRE ATT&CK framework

Answer 1

HOW ATTACKERS OPERATE

a knowledge base that models the tactics and techniques used by cyber adversaries. It’s designed to help organizations understand how attackers operate, what their objectives are, and how to defend against them.

Question 2

The Diamond Model of
Intrusion Analysis

Answer 2

a model that describes cyber attacks. It has four parts:
- Adversary: Where the attackers are from
- Infrastructure: The capabilities used
- Capability: The infrastructure used
- Target: The victim

Question 3

Cyber Kill Chain

Answer 3

military concept developed by lockheed martin
a model that breaks down the phases of a cyberattack.
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and control
- Actions on objectives

Question 4

COOP

Answer 4

continuity of operations planning

Question 5

incident response process

Answer 5

• Preparation
• Identification
• Containment
• Eradication
• Recovery
• Lessons learned