Detection and Response

Question 1

Incident

Answer 1

An occurrence that actually or imminently jeopardizes, without lawful authority, confidentiality, integrity or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Question 2

Event

Answer 2

An observable occurrence on a network, system to device.

Question 3

The 5 W’s of an incident ?

Answer 3

1. Who triggered the incident?
2. What happened ?
3. When the incident took place?
4. Where the incident took place?
   5.Why the incident occured?

Question 4

Incident handlers journal?

Answer 4

A form of documentation used during an incident response.

Question 5

Computer security incident response teams (CSIRT)

Answer 5

A specialized group of security professionals that are trained in incident management and response

Question 6

Roles in CSIRT

Answer 6

1.Security analyst
2. Technical lead
3. Incident Cordinator