Chapter 17- Preventing and Responding to Incidents Flashcards
- What is the primary goal of incident response
? to minimise the impact on organisation.
- What is an incident?
An Incident is an unplanned interruption to an IT service or a reduction in the quality of an IT service.
• An Incident is any event that has a negative effect on the confidentiality, Integrity or availability of an organisation’s asset.
- What is Security Incident?
A security incident is an event that may indicate that an organization’s systems or data have been compromised or that measures put in place to protect them have been bypassed
- List the methods of detecting incidents:
Intrusion detection and prevention systems
• Anti-malware software
• Automated tools scanning audit logs
• End user detect unusual activities
- What are designated incident response teams called:
Computer Incident Response Team (CIRT) or Computer Security Incident Response Team (CSIRT).
- Describe Mitigation steps for incidence response:
Mitigation steps attempt to contain an incident. In some cases, responders take steps to mitigate the incident, but without letting the attacker know that the attack has been detected. This allows security personnel to monitor the attacker’s activities and determine the scope of the attack.
- Describe Incident Reporting:
Incident Reporting refers to reporting an incident within the organisation and organisations and individuals outside the organisation
- What is Recovery in Incidence Response steps?
After investigators collect all appropriate evidence from a system, the next step is to recover the system, or return it to a fully functioning state. The most secure method of restoring a system after an incident is to completely rebuild the system from scratch.
- What is Remediation in Incident Response?
In the remediation stage, personnel look at the incident and attempt to identify what allowed it to happen and implement methods to prevent it from happening again e.g., root cause analysis.
- What is root cause analysis?
Root Cause Analysis is used in incident response and it examines the incident to determine what allowed it to happen.
- What are lessons learned?
personnel examine the incident response and look for areas where response can be improved. Based on the findings, the team may recommend changes to procedures, the addition of security controls, or even changes to policies.
- List some preventive measures:
keep systems and applications up to date
• remove or disable unneeded services and protocols
• keep systems and applications up to date
• use intrusion detection and prevention systems
• use up to date anti-malware software
• Use firewalls
• Implement Configuration and system management processes.
- Computers in a botnet are referred to as:
bots or zombies
- What is Bot Herder?
Bot Herder is typically a criminal who controls all the computers in the botnet via one or more command-and-control servers.
- What are zombies?
Zombie is a malicious program that is installed on a device that transforms it into a zombie that attacks systems. Zombies can be programmed to contact the server periodically or remain dormant until a specific programmed date and time, or in response to an event, such as when a specific traffic is detected.
- List methods of protecting the system from botnets:
use defence-in-depth strategy, implementing multiple layers of security. • up to date malware protection • up to date patches. • keep browsers and plugins up to date • use sandboxing on browsers
- What is a Distributed Reflective Denial-of-Service (DRDoS)?
)? Distibuted Reflective Denial of Service manipulates traffic or network service so that the attacks are reflected back to the victim from other sources e.g. Domain Name Systems (DNS) poisoning attacks and smurf attacks.
- What is SYN Flood Attack?
SYN Flood attack occurs when attackers send multiple SYN packets but never complete the connection with ACK.
• the attack can consume available memory and processing power, resulting in the victim slowing to a crawl or actually crashing.
- List ways of stopping SYN Flood attacks:
Using SYN cookies, firewalls, IDS and IPS
- What are smurf and fraggle attacks?
they are DoS attacks.
• It is a spoofed broadcast ping request using the IP address of the victim as the source IP address.
• Smurf attack is another type of flood attack but it floods the victim with Internet Control Message Protocol (ICMP) echo packets instead of with TCP SYN packets.
- What are fraggle attacks?
The fraggle attack will broadcast a UDP packet using the spoofed IP address of the victim. All systems on the network will then send traffic to the victim, just as with a smurf attack.
• Fraggle attacks are similar to smurf attacks but instead of using ICMP, fraggle attacks use UDP ports 7 and 19
- What is Ping of Death (PoD) attack?
Ping of Death (PoD) attack is a Denial of Service attack (DoS) attack in which the attacker aims to disrupt a targeted machine by sending a packet larger than the maximum allowable size, causing the target machine to freeze or crash.
- What is teardrop attack?
An attacker fragments traffic in such a way that a system is unable to put data packets back together
- What is a land attack?
Land Attack occurs when an attacker sends spoofed SYN packets to a victim’s address both as the source and destination IP Address.
