Domain 4: Incident Management

Question 1

Security Incidents

Answer 1

Many IT professionals use the terms security event and security incident casually and interchangeably, but this is not correct. Members of a cybersecurity incident response team should use these terms carefully and according to their precise definitions within the organization. The National Institute for Standards and Technology (NIST) offers the following standard definitions for use throughout the U.S. government, and many private organizations choose to adopt them as well:

Question 2

Event vs security incident vs adverse event

Answer 2

An event is any observable occurrence in a system or network. A security event includes any observable occurrence that relates to a security function. For example, a user accessing a file stored on a server, an administrator changing permissions on a shared folder, and an attacker conducting a port scan are all examples of security events.
An adverse event is any event that has negative consequences. Examples of adverse events include a malware infection on a system, a server crash, and a user accessing a file that they are not authorized to view.
A security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. Examples of security incidents include the accidental loss of sensitive information, an intrusion into a computer system by an attacker, the use of a keylogger on an executive’s system to steal passwords, and the launch of a denial-of-service attack against a website.

Question 3

Computer security incident response teams (CSIRTs)

Answer 3

Computer security incident response teams (CSIRTs) are responsible for responding to computer security incidents that occur within an organization by following standardized response procedures and incorporating their subject matter expertise and professional judgment.

Question 4

Phases of Incident Response

Answer 4

Question 5

CSIRT Preparation

Answer 5

CSIRTs do not spring up out of thin air. As much as managers may wish it were so, they cannot simply will a CSIRT into existence by creating a policy document and assigning staff members to the CSIRT. Instead, the CSIRT requires careful preparation to ensure that the CSIRT has the proper policy foundation, has operating procedures that will be effective in the organization’s computing environment, receives appropriate training, and is prepared to respond to an incident.

The preparation phase also includes building strong cybersecurity defenses to reduce the likelihood and impact of future incidents. This process of building a defense-in-depth approach to cybersecurity often includes personnel who might not be part of the CSIRT.
During the preparation process, incident response teams should also define their standard notification and escalation procedures. Remember that anyone in the organization may be the first to identify a potential security incident. Procedures should clearly define how first responders report a potential incident to the CSIRT, the process for notifying the team members of an activation, and the criteria for escalating incident reports to management, as warranted.

Question 6

The CSIRT detection and analysis phase includes?

Answer 6

The detection and analysis phase of incident response is one of the trickiest to commit to a routine process. Although cybersecurity analysts have many tools at their disposal that may assist in identifying that a security incident is taking place, many incidents are only detected because of the trained eye of an experienced analyst.

NIST 800-61 describes four major categories of security event indicators:

Alerts that originate from intrusion detection and prevention systems, security information and event management systems, antivirus software, file integrity–checking software, and/or third-party monitoring services
Logs generated by operating systems, services, applications, network devices, and network flows
Publicly available information about new vulnerabilities and exploits detected “in the wild” or in a controlled laboratory environment
People from inside the organization or external sources who report suspicious activity that may indicate a security incident is in progress
When any of these information sources indicate that a security incident may be occurring, cybersecurity analysts should shift into the initial validation mode, where they attempt to determine whether an incident is taking place that merits further activation of the incident response process. This analysis is often more art than science and is very difficult work.

Question 7

NIST recommends the following actions to improve the timeliness and effectiveness of incident analysis:

Answer 7

Profile networks and systems to measure the characteristics of expected activity. This will improve the organization’s ability to identify abnormal activity during the detection and analysis process.
Understand normal behavior of users, systems, networks, and applications. This behavior will vary between organizations, at different times of the day, week, and year and with changes in the business cycle. A solid understanding of normal behavior is critical to recognizing deviations from those patterns.
Create a logging policy that specifies the information that must be logged by systems, applications, and network devices. The policy should also specify where those log records should be stored (preferably in a centralized log management system) and the retention period for logs.
Perform event correlation to combine information from multiple sources. This function is typically performed by a security information and event management (SIEM) system.
Synchronize clocks across servers, workstations, and network devices. This is done to facilitate the correlation of log entries from different systems. Organizations may easily achieve this objective by operating a Network Time Protocol (NTP) server.
Maintain an organization-wide knowledge base that contains critical information about systems and applications. This knowledge base should include information about system profiles, usage patterns, and other information that may be useful to responders who are not familiar with the inner workings of a system.
Capture network traffic as soon as an incident is suspected. If the organization does not routinely capture network traffic, responders should immediately begin packet captures during the detection and analysis phase. This information may provide critical details about an attacker’s intentions and activity.
Filter information to reduce clutter. Incident investigations generate massive amounts of information, and it is basically impossible to interpret it all without both inclusion and exclusion filters. Incident response teams may wish to create some predefined filters during the preparation phase to assist with future analysis efforts.
Seek assistance from external resources. Responders should know the parameters for involving outside sources in their response efforts. This may be as simple as conducting a Google search for a strange error message, or it may involve full-fledged coordination with other response teams.

Question 8

Containment is the first activity that takes place during the detection and analysis phase, and it should begin as quickly as possible after analysts determine that an incident is underway.
What activities are conducted during containment?

Answer 8

Containment is the first activity that takes place during this phase, and it should begin as quickly as possible after analysts determine that an incident is underway. Containment activities are designed to isolate the incident and prevent it from spreading further. If that phrase sounds somewhat vague, that’s because containment means very different things in the context of different types of security incidents. For example, if the organization is experiencing active exfiltration of data from a credit card processing system, incident responders might contain the damage by disconnecting that system from the network, preventing the attackers from continuing to exfiltrate information. On the other hand, if the organization is experiencing a denial-of-service attack against its website, disconnecting the network connection would simply help the attacker achieve its objective. In that case, containment might include placing filters on an upstream Internet connection that blocks all inbound traffic from networks involved in the attack or blocking web requests that bear a certain signature.

Question 9

Who may need to get involve with decisions in the containment phase?

Answer 9

Containment activities typically aren’t perfect and often cause some collateral damage that disrupts normal business activity.

Consider the two examples described in the previous paragraph. Disconnecting a credit card processing system from the network may bring transactions to a halt, potentially causing significant business losses.
Similarly, blocking large swaths of inbound web traffic may render the site inaccessible to some legitimate users. Incident responders undertaking containment strategies must understand the potential side effects of their actions while weighing them against the greater benefit to the organization. Decisions such as these are one of the reasons that senior management may want to have input into the organization’s incident response strategies and tactics.

Question 10

CONTAINMENT STRATEGY CRITERIA
In the Computer Security Incident Handling Guide, NIST recommends using the following criteria to develop an appropriate containment strategy and weigh it against business interests:

Note:
Selecting appropriate containment strategies is one of the most difficult tasks facing incident responders. Containment approaches that are too drastic may have an unacceptable impact on business operations. On the other hand, responders who select weak containment approaches may find that the incident escalates to cause even more damage.

Answer 10

Potential damage to and theft of resources
Need for evidence preservation
Service availability (for example, network connectivity and services provided to external parties)
Time and resources needed to implement the strategy
Effectiveness of the strategy (for example, partial containment and full containment)
Duration of the solution (for example, emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, or permanent solution)
Unfortunately, there’s no formula or decision tree that guarantees responders will make the “right” decision while responding to an incident. Incident responders should understand these criteria, the intent of management, and their technical and business operating environment. Armed with this information, responders will be well-positioned to follow their best judgment and select an appropriate containment strategy.

Question 11

What segmentation strategy for CSIRT is useful?

Answer 11

Network Segmentation
Cybersecurity analysts often use network segmentation as a proactive strategy to prevent the spread of future security incidents. For example, the network shown in Figure 8.2 is designed to segment different types of users from each other and from critical systems. An attacker who can gain access to the guest network would not be able to interact with systems belonging to employees or in the data center without traversing the network firewall.
In addition to being used as a proactive control, network segmentation may play a crucial role in incident response. During the early stages of an incident, responders may realize that a portion of systems are compromised but wish to continue to observe the activity on those systems while they determine other appropriate responses. However, they certainly want to protect other systems on the network from those potentially compromised systems.

Question 12

Why choose isolation over segmentation as a containment strategy?

Answer 12

Isolation vs segmentation
Although segmentation does limit the access that attackers have to the remainder of the network, it sometimes doesn’t go far enough to meet containment objectives. Cybersecurity analysts may instead decide that it is necessary to use stronger isolation practices to cut off an attack. Two primary isolation techniques may be used during a cybersecurity incident response effort: isolating affected systems and isolating the attacker.

Segmentation and isolation strategies carry with them significant risks to the organization. First, the attacker retains access to the compromised system, creating the potential for further expansion of the security incident. Second, the compromised system may be used to attack other systems on the Internet. In the best case scenario, an attack launched from the organization’s network against a third party may lead to some difficult conversations with cybersecurity colleagues at other firms. In the worst case scenario, the courts may hold the organization liable for knowingly allowing the use of their network in an attack. Cybersecurity analysts considering a segmentation or isolation approach to containment should consult with both management and legal counsel.

In the segmentation approach, the network is connected to the firewall and may have some limited access to other networked systems.
In the isolation approach, the quarantine network connects directly to the Internet and has no access to other systems. In reality, this approach may be implemented by simply altering firewall rules rather than bypassing the firewall entirely. The objective is to allow the attacker to continue accessing the isolated systems but restrict their ability to access other systems and cause further damage.

Question 13

What variation on the isoltation approach but requires a sandbox system to monitor activity?
WHat are the benefits?

Answer 13

ISOLATING THE ATTACKER

Isolating the attacker is an interesting variation on the isolation strategy and depends on the use of sandbox systems that are set up purely to monitor attacker activity and that do not contain any information or resources of value to the attacker. Placing attackers in a sandboxed environment allows continued observation in a fairly safe, contained environment. Some organizations use honeypot systems for this purpose.

Question 14

What is the strongest containment technique available?

Answer 14

Removal
Removal of compromised systems from the network is the strongest containment technique in the cybersecurity analyst’s incident response toolkit. As shown in Figure 8.5, removal differs from segmentation and isolation in that the affected systems are completely disconnected from other networks, although they may still be allowed to communicate with other compromised systems within the quarantine VLAN. In some cases, each suspect system may be physically disconnected from the network so that they are prevented from communicating even with each other. The exact details of removal will depend on the circumstances of the incident and the professional judgment of incident responders.

Question 15

How could an attacker detect isolation?

Answer 15

Removing a system from the network is a common containment step designed to prevent further damage from taking place, but NIST points out in their Computer Security Incident Handling Guide that it isn’t foolproof. The guide presents a hypothetical example of an attacker using a simple ping as a sort of “dead man’s switch” for a compromised system, designed to identify when the adversary detects the response and removes the system from the network.

In this scenario, the attacker simply sets up a periodic ping request to a known external host, such as the Google public DNS server located at 8.8.8.8. This server is almost always accessible from any network and the attacker can verify this connectivity after initially compromising a system.

The attacker can then write a simple script that monitors the results of those ping requests and, after detecting several consecutive failures, assumes that the attack was detected and the system was removed from the network. The script can then wipe out evidence of the attack or encrypt important information stored on the server.

The moral of the story is that although removal is a strong weapon in the containment toolkit, it isn’t foolproof!

Question 16

If incident handlers suspect that evidence gathered during an investigation may be used in court, they should take special care to preserve and document evidence during their investigation. NIST recommends that investigators maintain a detailed evidence log that includes the following:

Note:
The primary objective during the containment phase of incident response is to limit the damage to the organization and its resources. That objective may take precedence over other goals, but responders may still be interested in gathering evidence during the containment process. This evidence may be crucial in the continuing analysis of the incident for internal purposes, or it may be used during legal proceedings against the attacker.

Answer 16

Evidence Gathering and Handling

Identifying information (for example, the location, serial number, model number, hostname, MAC addresses, and IP addresses of a computer)
Name, title, and phone number of each individual who collected or handled the evidence during the investigation
Time and date (including time zone) of each occurrence of evidence handling
Locations where the evidence was stored
Failure to maintain accurate logs will bring the evidence chain of custody into question and may cause the evidence to be inadmissible in court.

Question 17

What are the issues in trying to identifying attackers of an attack?

Answer 17

Identifying Attackers
Identifying the perpetrators of a cybersecurity incident is a complex task that often leads investigators down a winding path of redirected hosts that crosses international borders. Although you might find IP address records stored in your logs, it is incredibly unlikely that they correspond to the actual IP address of the attacker. Any attacker other than the most rank amateurs will relay communications through a series of compromised systems, making it very difficult to trace their actual origin.

Before heading down this path of investigating an attack’s origin, it’s very important to ask yourself why you are pursuing it. Is there really business value in uncovering who attacked you, or would your time be better spent on containment, eradication, and recovery activities? The NIST Computer Security Incident Handling Guide addresses this issue head-on, giving the opinion that “[i]dentifying an attacking host can be a time-consuming and futile process that can prevent a team from achieving its primary goal—minimizing the business impact.”

Law enforcement officials may approach this situation with objectives that differ from those of the attacked organization’s cybersecurity analysts. After all, one of the core responsibilities of law enforcement organizations is to identify criminals, arrest them, and bring them to trial. That responsibility may conflict with the core cybersecurity objectives of containment, eradication, and recovery. Cybersecurity and business leaders should take this conflict into consideration when deciding whether to involve law enforcement agencies in an incident investigation and the degree of cooperation they will provide to an investigation that is already underway.

Question 18

Once the cybersecurity team successfully contains an incident, it is time to move on to the eradication phase of the response. What happens during Incident Eradication and Recovery?

Answer 18

The primary purpose of eradication is to remove any of the artifacts of the incident that may remain on the organization’s network. This could include the removal of any malicious code from the network, the sanitization of compromised media, and the securing of compromised user accounts.

The recovery phase of incident response focuses on restoring normal capabilities and services. It includes reconstituting resources and correcting security control deficiencies that may have led to the attack. This could include rebuilding and patching systems, reconfiguring firewalls, updating malware signatures, and similar activities. The goal of recovery is not just to rebuild the organization’s network but to do so in a manner that reduces the likelihood of a successful future attack.

During the eradication and recovery effort, cybersecurity analysts should develop a clear understanding of the incident’s root cause. This is critical to implementing a secure recovery that corrects control deficiencies that led to the original attack. After all, if you don’t understand how an attacker breached your security controls in the first place, it will be hard to correct those controls so the attack doesn’t reoccur. Understanding the root cause of an attack is a completely different activity than identifying the attacker. Root cause assessment is a critical component of incident recovery while, as mentioned earlier, identifying the attacker can be a costly distraction.

Question 19

What type of Reconstruction and Reimaging during incident needs to occur?

Answer 19

During an incident, attackers may compromise one or more systems through the use of malware, web application attacks, or other exploits. Once an attacker gains control of a system, security professionals should consider it completely compromised and untrustworthy. It is not safe to simply correct the security issue and move on because the attacker may still have an undetected foothold on the compromised system. Instead, the system should be rebuilt, either from scratch or by using an image or backup of the system from a known secure state.

Rebuilding and/or restoring systems should always be done with the incident root cause analysis in mind. If the system was compromised because it contained a security vulnerability, as opposed to through the use of a compromised user account, backups and images of that system likely have that same vulnerability. Even rebuilding the system from scratch may reintroduce the earlier vulnerability, rendering the system susceptible to the same attack. During the recovery phase, administrators should ensure that rebuilt or restored systems are remediated to address known security issues.

Question 20

What patching strategy should analysts use?

Answer 20

Patching Systems and Applications
During the incident recovery effort, cybersecurity analysts will patch operating systems and applications involved in the attack. This is also a good time to review the security patch status of all systems in the enterprise, addressing other security issues that may lurk behind the scenes.

Cybersecurity analysts should first focus their efforts on systems that were directly involved in the compromise and then work their way outward, addressing systems that were indirectly related to the compromise before touching systems that were not involved at all. Figure 8.6 shows the phased approach that cybersecurity analysts should take to patching systems and applications during the recovery phase.

Question 21

Sanitization and Secure Disposal

Answer 21

Sanitization and Secure Disposal
During the recovery effort, cybersecurity analysts may need to dispose of or repurpose media from systems that were compromised during the incident. In those cases, special care should be taken to ensure that sensitive information that was stored on that media is not compromised. Responders don’t want the recovery effort from one incident to lead to a second incident!

Generally speaking, there are three options available for the secure disposition of media containing sensitive information: clear, purge, and destroy. NIST defines these three activities in NIST SP 800-88: Guidelines for Media Sanitization:

Clear applies logical techniques to sanitize data in all user-addressable storage locations for protection against simple non-invasive data recovery techniques; this is typically applied through the standard Read and Write commands to the storage device, such as by rewriting with a new value or using a menu option to reset the device to the factory state (where rewriting is not supported).
Purge applies physical or logical techniques that render target data recovery infeasible using state-of-the-art laboratory techniques. Examples of purging activities include overwriting, block erase, and cryptographic erase activities when performed through the use of dedicated, standardized device commands. Degaussing is another form of purging that uses extremely strong magnetic fields to disrupt the data stored on a device.
Destroy renders target data recovery infeasible using state-of-the-art laboratory techniques and results in the subsequent inability to use the media for storage of data. Destruction techniques include disintegration, pulverization, melting, and incinerating.

Question 22

What steps are required to validate the Recovery Effort of an incident?

Answer 22

Validating the Recovery Effort
Before concluding the recovery effort, incident responders should take time to verify that the recovery measures put in place were successful. The exact nature of this verification will depend on the technical circumstances of the incident and the organization’s infrastructure. Four activities that should always be included in these validation efforts follow:

Validate that only authorized user accounts exist on every system and application in the organization. In many cases, organizations already undertake periodic account reviews that verify the authorization for every account. This process should be used during the recovery validation effort.
Verify the proper restoration of permissions assigned to each account. During the account review, responders should also verify that accounts do not have extraneous permissions that violate the principle of least privilege. This is true for normal user accounts, administrator accounts, and service accounts.
Verify that all systems are logging properly. Every system and application should be configured to log security-related information to a level that is consistent with the organization’s logging policy. Those log records should be sent to a centralized log repository that preserves them for archival use. The validation phase should include verification that these logs are properly configured and received by the repository.
Conduct vulnerability scans on all systems. Vulnerability scans play an important role in verifying that systems are safeguarded against future attacks. Analysts should run thorough scans against systems and initiate remediation workflows where necessary.

Question 23

What are the two things that are part of the Post-Incident Activity?

Answer 23

CSIRT enters the post-incident activity phase of incident response. During this phase, team members conduct a lessons-learned review and ensure that they meet internal and external evidence retention requirements.

Question 24

How does the lessons learned review work?

Answer 24

The lessons-learned review should be facilitated by an independent facilitator who was not involved in the incident response and who is perceived by everyone involved as an objective outsider. This allows the facilitator to productively guide the discussion without participants feeling that they are advancing a hidden agenda. NIST recommends that lessons-learned processes answer the following questions:

Exactly what happened and at what times?
What was the root cause of the incident?
How well did staff and management perform in responding to the incident?
Were the documented procedures followed? Were they adequate?
What information was needed sooner?
Were any steps or actions taken that might have inhibited the recovery?
What would the staff and management do differently the next time a similar incident occurs?
How could information sharing with other organizations have been improved?
What corrective actions can prevent similar incidents in the future?
What precursors or indicators should be watched for in the future to detect similar incidents?
What additional tools or resources are needed to detect, analyze, and mitigate future incidents?

Question 25

What happens during the Evidence Retention portion of the incident?

Answer 25

At the conclusion of an incident, the CSIRT has often gathered a large amount of evidence. The team leader should work with staff to identify both internal and external evidence retention requirements. If the incident may result in civil litigation or criminal prosecution, the team should consult attorneys prior to discarding any evidence. If there is no likelihood that the evidence will be used in court, the team should follow any retention policies that the organization has in place.

Question 26

What is in the Developing a Final Report part of an incident?

Answer 26

Every incident that activates the CSIRT should conclude with a formal written report that documents the incident for posterity. This serves several important purposes. First, it creates an institutional memory of the incident that is useful when developing new security controls and training new security team members. Second, it may serve as an important record of the incident if there is ever legal action that results from the incident. Finally, the act of creating the written report can help identify previously undetected deficiencies in the incident response process that may feed back through the lessons-learned process.

Question 27

What are the components of Building the Incident Response Plan?

Answer 27

One of the major responsibilities that organizations have during the preparation phase of incident response is building a solid incident response plan that will guide the program. This creates the policies, procedures, and other documentation required to support the program's ongoing efforts and ensure that response efforts are effective and timely.

Question 28

What are the considerations in order to build the incident response policy that will serve as the cornerstone of an organization's incident response program.

Answer 28

Policy The incident response policy serves as the cornerstone of an organization's incident response program. This policy should be written to guide efforts at a high level and provide the authority for incident response. The policy should be approved at the highest level possible within the organization, preferably by the chief executive officer. For this reason, policy authors should attempt to write the policy in a manner that makes it relatively timeless. This means that the policy should contain statements that provide authority for incident response, assign responsibility to the CSIRT, and describe the role of individual users and state organizational priorities. The policy is not the place to describe specific technologies, response procedures, or evidence-gathering techniques. Those details may change frequently and should be covered in more easily changeable procedure documents. NIST recommends that incident response policies contain these key elements: Statement of management commitment Purpose and objectives of the policy Scope of the policy (to whom it applies and under what circumstances) Definition of cybersecurity incidents and related terms Organizational structure and definition of roles, responsibilities, and level of authority Prioritization or severity rating scheme for incidents Performance measures for the CSIRT Reporting and contact forms

Question 29

What should incident response procedures should be in place?

Answer 29

Procedures provide the detailed, tactical information that CSIRT members need when responding to an incident. They represent the collective wisdom of team members and subject matter experts collected during periods of calm and ready to be applied in the event of an actual incident. CSIRTs often develop playbooks that describe the specific procedures that they will follow in the event of a specific type of cybersecurity incident. For example, a financial institution CSIRT might develop playbooks that cover: Breach of personal financial information Web server defacement Phishing attack targeted at customers Loss of a laptop General security incident not covered by another playbook This is clearly not an exhaustive list, and each organization will develop playbooks that describe their response to both high severity and frequently occurring incident categories. The idea behind the playbook is that the team should be able to pick it up and find an operational plan for responding to the security incident that they may follow. Playbooks are especially important in the early hours of incident response to ensure that the team has a planned, measured response to the first reports of a potential incident.

Question 30

Who is responsible for Creating an Incident Response Team?

Answer 30

There are many different roles that should be represented in a CSIRT. Depending on the organization and its technical needs, some of these roles may be core team members who are always activated, whereas others may be called in as needed on an incident-by-incident basis. For example, a database administrator might be crucial when investigating the aftermath of a SQL injection attack but would probably not be very helpful when responding to a stolen laptop. The core incident response team normally consists of cybersecurity professionals with specific expertise in incident response. In larger organizations, these may be full-time employees dedicated to incident response, whereas smaller organizations may call on cybersecurity experts who fill other roles for their “day jobs” to step into CSIRT roles in the aftermath of an incident.

Question 31

THE ROLE OF MANAGEMENT in incident response is?

Answer 31

Management should have an active role in incident response efforts. The primary responsibility of IT managers and senior leadership is to provide the authority, resources, and time required to respond appropriately to a security incident. This includes ensuring that the CSIRT has the budget and staff required to plan for security incidents and access to subject matter experts during a response.

Question 32

Why would your org outside the incident response functions?

Answer 32

Incident Response Providers In addition to including internal team members on the CSIRT, the organization may decide to outsource some or all of their actions to an incident response provider. Retaining an incident response provider gives the organization access to expertise that might not otherwise exist inside the firm. This may come at a significant expense, so the organizations should decide what types of incidents may be handled internally and which justify the use of an outside provider. Additionally, the organization should understand the provider's guaranteed response time and ensure that it has a plan in place to respond to the early stages of an incident before the provider assumes control.

Question 33

the Electronic Discovery Reference Model (EDRM) describes a standard process for conducting eDiscovery with nine aspects:

Answer 33

Information Governance ensures that information is well organized for future eDiscovery efforts. Identification locates the information that may be responsive to a discovery request when the organization believes that litigation is likely. Preservation ensures that potentially discoverable information is protected against alteration or deletion. Collection gathers the relevant information centrally for use in the eDiscovery process. Processing screens the collected information to perform a “rough cut” of irrelevant information, reducing the amount of information requiring detailed screening. Review examines the remaining information to determine what information is relevant to the request and removing any information protected by attorney-client privilege. Analysis performs a deeper inspection of the content and context of the remaining information. Production places the information into a format that may be shared with others and delivers it to other parties, such as opposing counsel. Presentation displays the information to witnesses, the court, and other parties.

Question 34

Many different types of evidence can be used in a court of law. Depending on the reference you consult, these may be grouped in many different ways.

Answer 34

Many different types of evidence can be used in a court of law. Depending on the reference you consult, these may be grouped in many different ways. However, there are four major categories with which you should be familiar: real evidence, documentary evidence, testimonial evidence, and demonstrative evidence. Each has slightly different additional requirements for admissibility. Real Evidence Real evidence (also known as object evidence) consists of things that may actually be brought into a court of law. In common criminal proceedings, this may include items such as a murder weapon, clothing, or other physical objects. In a computer crime case, real evidence might include seized computer equipment, such as a keyboard with fingerprints on it or a hard drive from a hacker's computer system. Depending on the circumstances, real evidence may also be conclusive evidence, such as deoxyribonucleic acid (DNA), that is incontrovertible. Documentary Evidence Documentary evidence includes any written items brought into court to prove a fact at hand. This type of evidence must also be authenticated. For example, if an attorney wants to introduce a computer log as evidence, they have testimony from a witness (for example, the system administrator) confirming that the log was collected as a routine business practice and is indeed the actual log that the system collected.

Question 35

When evidence is labeled to preserve the chain of custody, the label should include the following types of information regarding the collection:

Answer 35

General description of the evidence Time and date the evidence was collected Exact location the evidence was collected from Name of the person collecting the evidence Relevant circumstances surrounding the collection Each person who handles the evidence must sign the chain-of-custody log indicating the time they took direct responsibility for the evidence and the time they handed it off to the next person in the chain of custody. The chain must provide an unbroken sequence of events accounting for the evidence from the time it was collected until the time of the trial.

Question 36

Demonstrative Evidence

Answer 36

Demonstrative evidence is evidence used to support testimonial evidence. It consists of items that may or may not be admitted into evidence themselves but are used to help a witness explain a concept or clarify an issue. For example, demonstrative evidence might include a diagram explaining the contents of a network packet or showing the process used to conduct a distributed denial-of-service attack. The admissibility of demonstrative evidence is a matter left to the trial court, with the general principle that demonstrative evidence must assist the jury in understanding a case.

Question 37

Security events are ?

Answer 37

Security events are occurrences that may escalate into a security incident. An event is any observable occurrence in a system or network. A security event includes any observable occurrence that relates to a security function. A security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices. Every incident consists of one or more events, but every event is not an incident.

Question 38

The cybersecurity incident response process has four phases.

Answer 38

The cybersecurity incident response process has four phases. The four phases of incident response are preparation; detection and analysis; containment, eradication, and recovery; and post-incident activities. The process is not a simple progression of steps from start to finish. Instead, it includes loops that allow responders to return to prior phases as needed during the response.

Question 39

Security event indicators include?

Answer 39

Security event indicators include alerts, logs, publicly available information, and people. Alerts originate from intrusion detection and prevention systems, security information and event management systems, antivirus software, file integrity checking software, and third-party monitoring services. Logs are generated by operating systems, services, applications, network devices, and network flows. Publicly available information exists about new vulnerabilities and exploits detected “in the wild” or in a controlled laboratory environment. People from inside the organization or external sources report suspicious activity that may indicate that a security incident is in progress.

Question 40

What guide incident response efforts.

Answer 40

Policies, procedures, and playbooks guide incident response efforts. The incident response policy serves as the cornerstone of an organization's incident response program. This policy should be written to guide efforts at a high level and provide the authority for incident response. Procedures provide the detailed, tactical information that CSIRT members need when responding to an incident. CSIRTs often develop playbooks that describe the specific procedures that they will follow in the event of a specific type of cybersecurity incident.

Question 41

Incident response teams should represent who?

Answer 41

Incident response teams should represent diverse stakeholders. The core incident response team normally consists of cybersecurity professionals with specific expertise in incident response. In addition to the core team members, the CSIRT may include representation from technical subject matter experts, IT support staff, legal counsel, human resources staff, and public relations and marketing teams.

Question 42

Incidents may be classified by?

Answer 42

Incidents may be classified according to the attack vector where they originate. Common attack vectors for security incidents include external/removable media, attrition, the web, email, impersonation, improper usage, loss or theft of equipment, and other/unknown sources.

Question 43

Response teams classify the severity of an incident by?

Answer 43

Response teams classify the severity of an incident. The functional impact of an incident is the degree of impairment that it causes to the organization. The economic impact is the amount of financial loss that the organization incurs. In addition to measuring the functional and economic impact of a security incident, organizations should measure the time that services will be unavailable and the recoverability effort. Finally, the nature of the data involved in an incident also contributes to the severity of the information impact.

Question 44

The four steps of the business continuity planning process?

Answer 44

Business continuity planning involves four distinct phases: project scope and planning, business impact analysis, continuity planning, and approval and implementation. Each task contributes to the overall goal of ensuring that business operations continue uninterrupted in the face of an emergency.

Question 45

Describe how to perform the business organization analysis. 

Answer 45

  In the business organization analysis, the individuals responsible for leading the BCP process determine which departments and individuals have a stake in the business continuity plan. This analysis serves as the foundation for BCP team selection and, after validation by the BCP team, is used to guide the next stages of BCP development.

Question 46

List the necessary members of the business continuity planning team.

Answer 46

The BCP team should contain, at a minimum, representatives from each of the operational and support departments; technical experts from the IT department; physical and IT security personnel with BCP skills; legal representatives familiar with corporate legal, regulatory, and contractual responsibilities; and representatives from senior management. Additional team members depend on the structure and nature of the organization.

Question 47

Know the legal and regulatory requirements that face business continuity planners.

Answer 47

Business leaders must exercise due diligence to ensure that shareholders' interests are protected in the event disaster strikes. Some industries are also subject to federal, state, and local regulations that mandate specific BCP procedures. Many businesses also have contractual obligations to their clients that they must meet before, during, and after a disaster.

Question 48

Explain the steps of the business impact analysis process.

Answer 48

Explain the steps of the business impact analysis process. The five stages of the business impact analysis process are the identification of priorities, risk identification, likelihood assessment, impact analysis, and resource prioritization.

Question 49

Describe the process used to develop a continuity strategy.

Answer 49

During the strategy development phase, the BCP team determines which risks they will mitigate. In the provisions and processes phase, the team designs mechanisms and procedures that will mitigate identified risks. The plan must then be approved by senior management and implemented. Personnel must also receive training on their roles in the BCP process.

Question 50

Explain the importance of comprehensively documenting an organization's business continuity and disaster recovery plans.

Answer 50

Committing the plan to writing provides the organization with a written record of the procedures to follow when disaster strikes. It prevents the “it's in my head” syndrome and ensures the orderly progress of events in an emergency.

Question 51

Be familiar with the common types of recovery facilities.

Answer 51

The common types of recovery facilities are cold sites, warm sites, hot sites, mobile sites, and multiple sites. Be sure you understand the benefits and drawbacks for each such facility.

Question 52

Understand the technologies that may assist with database backup.

Answer 52

Databases benefit from three backup technologies. Electronic vaulting is used to transfer database backups to a remote site as part of a bulk transfer. In remote journaling, data transfers occur on a more frequent basis. With remote mirroring technology, database transactions are mirrored at the backup site in real time.

Question 53

Explain the common processes used in disaster recovery programs.

Answer 53

These programs should take a comprehensive approach to planning and include considerations related to the initial response effort, personnel involved, communication among the team and with internal and external entities, assessment of response efforts, and restoration of services. DR programs should also include training and awareness efforts to ensure personnel understand their responsibilities and lessons learned sessions to continuously improve the program.

Question 54

Know the five types of disaster recovery plan tests and the impact each has on normal business operations.

Answer 54

   The five types of disaster recovery plan tests are: * Checklist tests * read-through tests, * structured walk-throughs, * simulation tests, * parallel tests * full-interruption tests. Checklist tests are purely paperwork exercises, whereas structured walk-throughs involve a project team meeting. Neither has an impact on business operations. Simulation tests may shut down noncritical business units. Parallel tests involve relocating personnel but do not affect day-to-day operations. Full-interruption tests involve shutting down primary systems and shifting responsibility to the recovery facility.

Question 55

What is different between DRP and BCP?

Answer 55

Resilient organizations have plans and procedures in place to help mitigate the effects a disaster has on their continuing operations and to speed the return to normal operations. Business continuity planning (BCP) helps your organization assess priorities and design resilient processes that will allow continued operations in the event of a disaster. Disaster recovery planning (DRP) is the technical complement to the business-focused BCP exercise. It includes the technical controls that prevent disruptions and facilitate the restoration of service as quickly as possible after a disruption occurs. BUSINESS CONTINUITY PLANNING VS. DISASTER RECOVERY PLANNING CISM candidates often become confused about the difference between business continuity planning (BCP) and disaster recovery planning (DRP). They might try to sequence them in a particular order or draw firm lines between the two activities. The reality of the situation is that these lines are blurry in real life and don't lend themselves to neat and clean categorization. The distinction between the two is one of perspective. Both activities help prepare an organization for a disaster. They intend to keep operations running continuously, when possible, and recover functions as quickly as possible if a disruption occurs. The perspective difference is that business continuity activities are typically strategically focused and center themselves on business processes and operations. Disaster recovery plans tend to be more tactical and describe technical activities such as recovery sites, backups, and fault tolerance. In any event, don't get hung up on the difference between the two. We've yet to see an exam question force anyone to draw a solid line between the two activities. It's much more important that you understand the processes and technologies involved in these two related disciplines.

Question 56

The BCP process has four main steps:

Answer 56

overall goal of BCP is to provide a quick, calm, and efficient response in the event of an emergency and to enhance a company's ability to recover from a disruptive event promptly. Project scope and planning Business impact analysis Continuity planning Plan approval and implementation

Question 57

The BCP has what for Project Scope and Planning

Answer 57

As with any formalized business process, the development of a resilient business continuity plan requires the use of a proven methodology. Organizations should approach the planning process with several goals in mind: Perform a structured review of the business's organization from a crisis planning point of view. Create a BCP team with the approval of senior management. Assess the resources available to participate in business continuity activities. Analyze the legal and regulatory landscape that governs an organization's response to a catastrophic event.

Question 58

Organizational Review in the BCP does what purpose?

Answer 58

One of the first tasks of the team responsible for business continuity planning is to perform an analysis of the business organization to identify all departments and individuals who have a stake in the BCP process. Here are some areas to consider: Operational departments that are responsible for the core services the business provides to its clients Critical support services, such as the IT department, facilities and maintenance personnel, and other groups responsible for the upkeep of systems that support the operational departments Security teams responsible for physical security, since they are many times the first responders to an incident and are also responsible for the physical safeguarding of the primary facility and alternate processing facility Senior executives and other key individuals essential for the ongoing viability of the organization

Question 59

What members should you select for the BCP team?

Answer 59

The team should include, at a minimum, the following individuals: Representatives from each of the organization's departments responsible for the core services performed by the business Business unit team members from the functional areas identified by the organizational analysis IT subject-matter experts with technical expertise in areas covered by the BCP Cybersecurity team members with knowledge of the BCP process Physical security and facility management teams responsible for the physical plant Attorneys familiar with corporate legal, regulatory, and contractual responsibilities Human resources team members who can address staffing issues and the impact on individual employees Public relations team members who need to conduct similar planning for how they will communicate with stakeholders and the public in the event of a disruption Senior management representatives with the ability to set the vision, define priorities, and allocate resources

Question 60

After the team validates the organizational review, it should turn to an assessment of the resources required by the BCP effort. This assessment involves the resources needed by three distinct BCP phases:

Answer 60

Resource Requirements After the team validates the organizational review, it should turn to an assessment of the resources required by the BCP effort. This assessment involves the resources needed by three distinct BCP phases: BCP Development The BCP team will require some resources to perform the four elements of the BCP process (project scope and planning, business impact analysis, continuity planning, and approval and implementation). It's more than likely that the major resource consumed by this BCP phase will be the effort expended by members of the BCP team and the support staff they call on to assist in the development of the plan. BCP Testing, Training, and Maintenance The testing, training, and maintenance phases of BCP will require some hardware and software commitments. Still, once again, the major commitment in this phase will be the effort of the employees involved in those activities. BCP Implementation When a disaster strikes and the BCP team deems it necessary to conduct a full-scale implementation of the business continuity plan, the implementation will require significant resources. Those resources include a large amount of effort (BCP will likely become the focus of a large part, if not all, of the organization) as well as direct financial expenses. For this reason, the team must use its BCP implementation powers judiciously yet decisively.

Question 61

What are the four stages of the BIA?

Answer 61

Once your BCP team completes the four stages of preparing to create a business continuity plan, it's time to dive into the heart of the work—the business impact analysis (BIA). The BIA identifies the business processes and tasks that are critical to an organization's ongoing viability and the threats posed to those resources. It also assesses the likelihood that each threat will occur and the impact those occurrences will have on the business. The results of the BIA provide you with quantitative measures that can help you prioritize the commitment of business continuity resources to the various local, regional, and global risk exposures facing your organization.

Question 62

two different types of analyses that business planners use when facing a decision:

Answer 62

It's important to realize that there are two different types of analyses that business planners use when facing a decision: Quantitative Impact Assessment Involves the use of numbers and formulas to reach a decision. This type of data often expresses options in terms of the dollar value to the business. Qualitative Impact Assessment Takes non-numerical factors, such as reputation, investor/customer confidence, workforce stability, and other concerns, into account. This type of data often results in categories of prioritization (such as high, medium, and low). The BIA process described in this chapter approaches the problem from both quantitative and qualitative points of view. However, it's tempting for a BCP team to “go with the numbers” and perform a quantitative assessment while neglecting the somewhat more subjective qualitative assessment. The BCP team should perform a qualitative analysis of the factors affecting your BCP process. For example, if your business is highly dependent on a few important clients, your management team is probably willing to suffer a significant short-term financial loss to retain those clients in the long term. The BCP team must sit down and discuss (preferably with the involvement of senior management) qualitative concerns to develop a comprehensive approach that satisfies all stakeholders.

Question 63

What is a Likelihood Assessment?

Answer 63

The preceding step consisted of the BCP team's drawing up a comprehensive list of the events that can be a threat to an organization. You probably recognized that some events are much more likely to happen than others. For example, an earthquake is a much more plausible risk than a tropical storm for a business located in Southern California. A company based in Florida might have the exact opposite likelihood that each risk would occur. To account for these differences, the next phase of the business impact analysis identifies the likelihood that each risk will occur. We describe this likelihood using the same process used for the risk assessment in Chapter 3. First, we determine the annualized rate of occurrence (ARO) that reflects the number of times a business expects to experience a given disaster each year. This annualization process simplifies comparing the magnitude of very different risks.

Question 64

What is the Vital Records Program?

Answer 64

The BCP documentation should also outline a vital records program for the organization. This document states where critical business records will be stored and the procedures for making and storing backup copies of those records. One of the biggest challenges in implementing a vital records program is often identifying the essential records in the first place. As many organizations transitioned from paper-based to digital workflows, they often lost the rigor that existed around creating and maintaining formal file structures. Vital records may now be distributed among a wide variety of IT systems and cloud services. Some may be stored on central servers accessible to groups, whereas others may be located in digital repositories assigned to an individual employee.

Question 65

What are the Emergency-Response Guidelines

Answer 65

The emergency-response guidelines outline the organizational and individual responsibilities for an immediate response to an emergency. This document provides the first employees to detect an emergency with the steps they should take to activate the provisions of the BCP that do not start automatically. These guidelines should include the following: Immediate response procedures (security and safety procedures, fire suppression procedures, notification of appropriate emergency-response agencies, and so on) A list of the individuals to notify of the incident (executives, BCP team members, and so on) Secondary response procedures that first responders should take while waiting for the BCP team to assemble

Question 66

Fault tolerance is the ability of a system to suffer ?

Answer 66

Fault tolerance is the ability of a system to suffer a fault but continue to operate. Fault tolerance is achieved by adding redundant components such as additional disks within a properly configured redundant array of inexpensive disks (RAID) array or additional servers within a failover clustered configuration.

Question 67

What are the different types of Alternate Processing Sites

Answer 67

One of the most important elements of the disaster recovery plan is the selection of alternate processing sites to be used when the primary sites are unavailable. Many options are available when considering recovery facilities, limited only by the creative minds of disaster recovery planners and available resources. In the following sections, we cover several types of sites commonly used in disaster recovery planning: cold sites, warm sites, hot sites, mobile sites, and cloud computing.

Question 68

Cold Sites

Answer 68

Cold sites are standby facilities large enough to handle the processing load of an organization and equipped with appropriate electrical and environmental support systems. They may be large warehouses, empty office buildings, or other similar structures. However, a cold site has no computing facilities (hardware or software) preinstalled and also has no active broadband communications links. Many cold sites do have at least a few copper telephone lines, and some sites may have standby links that can be activated with minimal notification.

Question 69

What are the different types of Hot Sites

Answer 69

A hot site is the exact opposite of the cold site. In this configuration, a backup facility is maintained in constant working order, with a full complement of servers, workstations, and communications links ready to assume primary operations responsibilities. The servers and workstations are all preconfigured and loaded with appropriate operating system and application software. The data on the primary site servers is periodically or continuously replicated to corresponding servers at the hot site, ensuring that the hot site has up-to-date data. Depending on the bandwidth available between the sites, hot site data may be replicated instantaneously. If that is the case, operators could move operations to the hot site at a moment's notice. If that’s not the case, disaster recovery managers have three options to activate the hot site:

Question 70

Warm Sites

Answer 70

Warm sites occupy the middle ground between hot and cold sites for disaster recovery specialists. They always contain the equipment and data circuits necessary to rapidly establish operations. As with hot sites, this equipment is usually preconfigured and ready to run appropriate applications to support an organization's operations. Unlike hot sites, however, warm sites do not typically contain copies of the client's data. The main requirement in bringing a warm site to full operational status is the transportation of appropriate backup media to the site and restoration of critical data on the standby servers.

Question 71

Mobile Sites

Answer 71

Mobile sites are non-mainstream alternatives to traditional recovery sites. They typically consist of self-contained trailers or other easily relocated units. These sites include all the environmental control systems necessary to maintain a safe computing environment. Larger corporations sometimes maintain these sites on a “fly-away” basis, ready to deploy them to any operating location around the world via air, rail, sea, or surface transportation. Smaller firms might contract with a mobile site vendor in their local area to provide these services on an as-needed basis.

Question 72

What should you consider when developing a recovery plan?

Answer 72

Recovery Plan Development Once you've established your business unit priorities and have a good idea of the appropriate alternative recovery sites for your organization, it's time to put pen to paper and begin drafting a true disaster recovery plan. Don't expect to sit down and write the full plan in one sitting. It's likely that the DRP team will go through many draft documents before reaching a final written document that satisfies the operational needs of critical business units and falls within the resource, time, and expense constraints of the disaster recovery budget and available personnel. In the following sections, we explore some important items to include in your disaster recovery plan. Depending on the size of your organization and the number of people involved in the DRP effort, it may be a good idea to maintain multiple types of plan documents, intended for different audiences. The following list includes various types of documents worth considering: Executive summary providing a high-level overview of the plan Department-specific plans Technical guides for IT personnel responsible for implementing and maintaining critical backup systems Checklists for individuals on the disaster recovery team Full copies of the plan for critical disaster recovery team members

Question 73

What are the various tests for recovery plannning?

Answer 73

Testing and Maintenance Every disaster recovery plan must be tested on a periodic basis to ensure that the plan's provisions are viable and that it meets an organization's changing needs. The types of tests that you conduct will depend on the types of recovery facilities available to you, the culture of your organization, and the availability of disaster recovery team members. The five main test types—checklist tests, structured walk-throughs, simulation tests, parallel tests, and full-interruption tests—are discussed in the remaining sections of this chapter. Note Icon For more information on this topic, consult NIST Special Publication 800-84, “Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities Recommendations”, available at https://csrc.nist.gov/publications/detail/sp/800-84/final.

Question 74

Read-Through Test

Answer 74

The read-through test is one of the simplest tests to conduct, but it's also one of the most critical ones. In this test, you distribute copies of disaster recovery plans to the members of the disaster recovery team for review. This lets you accomplish three goals simultaneously: It ensures that key personnel are aware of their responsibilities and have that knowledge refreshed periodically. It provides individuals with an opportunity to review the plans for obsolete information and update any items that require modification because of changes within the organization. In large organizations, it helps identify situations in which key personnel have left the company and nobody bothered to reassign their disaster recovery responsibilities. This is also a good reason why disaster recovery responsibilities should be included in job descriptions.

Question 75

Structured Walk-Through

Answer 75

A structured walk-through takes testing one step further. In this type of test, often referred to as a table-top exercise, members of the disaster recovery team gather in a large conference room and role-play a disaster scenario. Usually, the exact scenario is known only to the test moderator, who presents the details to the team at the meeting. The team members then refer to their copies of the disaster recovery plan and discuss the appropriate responses to that particular type of disaster. Walk-throughs may vary in their scope and intent. Some exercises may include taking physical actions or at least considering their impact on the exercise. For example, a walk-through might require that everyone leave the building and return home to participate in the exercise.

Question 76

Simulation Test

Answer 76

Simulation tests are similar to the structured walk-throughs. In simulation tests, disaster recovery team members are presented with a scenario and asked to develop an appropriate response. Unlike with the tests previously discussed, some of these response measures are then tested. This may involve the interruption of noncritical business activities and the use of some operational personnel.

Question 77

Parallel Test

Answer 77

Parallel tests represent the next level in testing and involve relocating personnel to the alternate recovery site and implementing site activation procedures. The employees relocated to the site perform their disaster recovery responsibilities just as they would for an actual disaster. The only difference is that operations at the main facility are not interrupted. That site retains full responsibility for conducting the day-to-day business of the organization.

Question 78

Full-Interruption Test

Answer 78

Full-interruption tests operate like parallel tests, but they involve actually shutting down operations at the primary site and shifting them to the recovery site. These tests involve a significant risk, as they require the operational shutdown of the primary site and transfer to the recovery site, followed by the reverse process to restore operations at the primary site. For this reason, full-interruption tests are extremely difficult to arrange, and you often encounter resistance from management.

Question 79

How do you conduct a DRP Lessons Learned?

Answer 79

At the conclusion of any disaster recovery operation or other security incident, the organization should conduct a lessons learned session. The lessons learned process is designed to provide everyone involved with the incident response effort an opportunity to reflect on their individual role in the incident and the team's response overall. It is an opportunity to improve the processes and technologies used in incident response to better respond to future security crises. The most common way to conduct lessons learned is to gather everyone in the same room, or connect them via videoconference or telephone, and ask a trained facilitator to lead a lessons learned session. Ideally, this facilitator should have played no role in the incident response, leaving them with no preconceived notions about the response. The facilitator should be a neutral party who simply helps guide the conversation. Time is of the essence with the lessons learned session because, as time passes, details quickly become fuzzy and memories are lost. The more quickly you conduct a lessons learned session, the more likely it is that you will receive valuable feedback that can help guide future responses.

Question 80

segmentation

Answer 80

Cybersecurity analysts often use network segmentation as a proactive strategy to prevent the spread of future security incidents. For example, the network shown in Figure 8.2 is designed to segment different types of users from each other and from critical systems. An attacker who can gain access to the guest network would not be able to interact with systems belonging to employees or in the data center without traversing the network firewall.

Question 81

Isolation Although segmentation does limit the access that attackers have to the remainder of the network, it sometimes doesn't go far enough to meet containment objectives. Cybersecurity analysts may instead decide that it is necessary to use stronger isolation practices to cut off an attack.

Answer 81

Two primary isolation techniques may be used during a cybersecurity incident response effort: isolating affected systems and isolating the attacker.

Question 82

Scope of Impact

Answer 82

The scope of an incident's impact depends on the degree of impairment that it causes the organization as well as the effort required to recover from the incident.

Question 83

Functional Impact

Answer 83

The functional impact of an incident is the degree of impairment that it causes to the organization. This may vary based on the criticality of the data, the system(s) or process(es) affected by the incident, and the organization's ability to continue providing services to users as an incident unfolds and in its aftermath.

Question 84

NIST recommends using four categories to describe the functional impact of an incident,

Answer 84

Category Definition None No effect on the organization's ability to provide all services to all users. Low Minimal effect; the organization can still provide all critical services to all users but has lost efficiency. Medium Organization has lost the ability to provide a critical service to a subset of system users. High Organization is no longer able to provide some critical services to any users.

Question 85

Investigation Types

Answer 85

Security practitioners may find themselves conducting investigations for a wide variety of reasons. Some of these investigations involve law enforcement and must follow rigorous standards designed to produce evidence that will be admissible in court.

Question 86

Administrative Investigations

Answer 86

Administrative investigations are internal investigations that examine either operational issues or a violation of the organization's policies. They may be conducted as part of a technical troubleshooting effort or in support of other administrative processes, such as HR disciplinary procedures.

Question 87

Criminal Investigations

Answer 87

Criminal investigations, typically conducted by law enforcement personnel, investigate the alleged violation of criminal law. Criminal investigations may result in charging suspects with a crime and the prosecution of those charges in criminal court.

Question 88

Civil Investigations

Answer 88

Civil investigations typically do not involve law enforcement but rather involve internal employees and outside consultants working on behalf of a legal team. They prepare the evidence necessary to present a case in civil court, resolving a dispute between two parties.

Question 89

Regulatory Investigations

Answer 89

Government agencies may conduct regulatory investigations when they believe that an individual or corporation has violated administrative law. Regulators typically conduct these investigations with a standard of proof commensurate with the venue where they expect to try their case. Regulatory investigations vary widely in scope and procedure and are often conducted by government agents.

Question 90

Response teams classify the severity of an incident.

Answer 90

The functional impact of an incident is the degree of impairment that it causes to the organization. The economic impact is the amount of financial loss that the organization incurs. In addition to measuring the functional and economic impact of a security incident, organizations should measure the time that services will be unavailable and the recoverability effort. Finally, the nature of the data involved in an incident also contributes to the severity of the information impact.

Question 91

BCP Development

Answer 91

The BCP team will require some resources to perform the four elements of the BCP process (project scope and planning, business impact analysis, continuity planning, and approval and implementation). It's more than likely that the major resource consumed by this BCP phase will be the effort expended by members of the BCP team and the support staff they call on to assist in the development of the plan.

Question 92

Legal and Regulatory Requirements

Answer 92

Many industries may find themselves bound by federal, state, and local laws or regulations that require them to implement various degrees of BCP.

Question 93

business impact analysis (BIA

Answer 93

Once your BCP team completes the four stages of preparing to create a business continuity plan, it's time to dive into the heart of the work—the). The BIA identifies the business processes and tasks that are critical to an organization's ongoing viability and the threats posed to those resources. I

Question 94

Statement of Priorities

Answer 94

s” phase of the business impact analysis. It simply involves listing the functions considered critical to continued business operations in a prioritized order. When listing these priorities, you should also include a statement that they were developed as part of the BCP process and reflect the importance of the functions to continued business operations in the event of an emergency and nothing more.

Question 95

electronic vaulting scenario

Answer 95

In an electronic vaulting scenario, database backups are moved to a remote site using bulk transfers. The remote location may be a dedicated alternative recovery site (such as a hot site) or simply an offsite location managed within the company or by a contractor for the purpose of maintaining backup data. When a disaster is declared, technicians retrieve the appropriate transaction logs and apply them to the production database, bringing the database up to the current production state.

Question 96

Remote journaling

Answer 96

, data transfers are performed in a more expeditious manner. Data transfers still occur in a bulk transfer mode, b

Question 97

Remote Mirroring

Answer 97

Remote mirroring is the most advanced database backup solution. Not surprisingly, it's also the most expensive! Remote mirroring goes beyond the technology used by remote journaling and electronic vaulting; with remote mirroring, a live database server is maintained at the backup site. The remote server receives

Question 98

Understand the four steps of the business continuity planning process.

Answer 98

Business continuity planning involves four distinct phases: project scope and planning, business impact analysis, continuity planning, and approval and implementation. Each task contributes to the overall goal of ensuring that business operations continue uninterrupted in the face of an emergency.

Question 99

Describe how to perform the business organization analysis.

Answer 99

In the business organization analysis, the individuals responsible for leading the BCP process determine which departments and individuals have a stake in the business continuity plan. This analysis serves as the foundation for BCP team selection and, after validation by the BCP team, is used to guide the next stages of BCP development.

Question 100

List the necessary members of the business continuity planning team.

Answer 100

The BCP team should contain, at a minimum, representatives from each of the operational and support departments; technical experts from the IT department; physical and IT security personnel with BCP skills; legal representatives familiar with corporate legal, regulatory, and contractual responsibilities; and representatives from senior management. Additional team members depend on the structure and nature of the organization.

Question 101

Know the legal and regulatory requirements that face business continuity planners.

Answer 101

Business leaders must exercise due diligence to ensure that shareholders' interests are protected in the event disaster strikes. Some industries are also subject to federal, state, and local regulations that mandate specific BCP procedures. Many businesses also have contractual obligations to their clients that they must meet before, during, and after a disaster.

Question 102

Describe the process used to develop a continuity strategy.

Answer 102

During the strategy development phase, the BCP team determines which risks they will mitigate. In the provisions and processes phase, the team designs mechanisms and procedures that will mitigate identified risks. The plan must then be approved by senior management and implemented. Personnel must also receive training on their roles in the BCP process.

Question 103

Know the five types of disaster recovery plan tests and the impact each has on normal business operations.

Answer 103

The five types of disaster recovery plan tests are: read-through tests, structured walk-throughs, simulation tests, parallel tests, and full-interruption tests. Checklist tests are purely paperwork exercises, whereas structured walk-throughs involve a project team meeting. Neither has an impact on business operations. Simulation tests may shut down noncritical business units. Parallel tests involve relocating personnel but do not affect day-to-day operations. Full-interruption tests involve shutting down primary systems and shifting responsibility to the recovery facility.

Question 104

what is the role of a manager in incident response?

Answer 104

Manager provides interference: The role of a manager in incident response is to coordinate and direct all facets of the incident response effort. The manager is responsible for ensuring that the incident is resolved as quickly and efficiently as possible, while minimizing the impact on the organization. The specific responsibilities of a manager in incident response will vary depending on the size and complexity of the organization, as well as the nature of the incident. However, some common responsibilities include: Assembling and leading the incident response team: The manager is responsible for assembling a team of qualified individuals to respond to the incident. This team may include representatives from IT, security, legal, and other departments. The manager is also responsible for leading the team and ensuring that everyone is working together effectively. Assessing the situation: The manager must quickly assess the situation to determine the nature of the incident, its impact on the organization, and the best course of action. Developing and implementing a response plan: The manager must develop and implement a response plan to resolve the incident. This plan should include specific steps to be taken, timelines, and resource requirements. Communicating with stakeholders: The manager must keep stakeholders informed of the incident and the response effort. This includes communicating with senior management, customers, and the public (if necessary). Evaluating the response: Once the incident has been resolved, the manager must evaluate the response effort to identify areas for improvement. The role of a manager in incident response is critical to the success of the response effort. An effective manager will be able to quickly assess the situation, develop a response plan, and lead the team to a successful resolution. Here are some key tips for managers in incident response: Be prepared: Develop an incident response plan before an incident occurs. This plan should identify the key roles and responsibilities, communication protocols, and escalation procedures. Be decisive: Don't be afraid to make decisions, even if you don't have all the information. It is better to make a decision and move forward than to be paralyzed by indecision. Be communicative: Keep stakeholders informed of the incident and the response effort. This will help to reduce anxiety and uncertainty. Be flexible: Things don't always go according to plan, so be prepared to adjust your response as needed. Learn from your mistakes: After the incident, take the time to evaluate the response effort and identify areas for improvement. By following these tips, managers can play a vital role in ensuring the success of the incident response effort.

Question 105

How should we build an incident response team??

Answer 105

To build an incident response team, you should follow these steps: Identify the key roles and responsibilities. What skills and experience do you need on your team? What are the roles and responsibilities of each team member? Recruit qualified individuals. Once you have identified the key roles and responsibilities, you need to recruit qualified individuals to fill those roles. You may be able to find qualified individuals within your organization, or you may need to hire externally. Provide training and support. Once you have assembled your team, you need to provide them with the training and support they need to be successful. This includes training on the organization's incident response plan, as well as training on the latest incident response tools and techniques. Test your team. Once your team is trained, you should test them regularly to ensure that they are prepared to respond to an incident. This can be done through tabletop exercises, simulations, and other training exercises. Maintain your team. The needs of your organization may change over time, so it is important to regularly review your incident response team and make adjustments as needed. Here are some additional tips for building an effective incident response team: Include a variety of perspectives. Your incident response team should include individuals from a variety of departments, including IT, security, legal, and communications. This will help to ensure that all aspects of the incident are considered when developing a response plan. Empower your team. Give your team the authority to make decisions and take action. This will help to ensure that the incident is resolved quickly and efficiently. Foster communication and collaboration. Encourage team members to communicate and collaborate with each other. This will help to ensure that everyone is on the same page and that the response is coordinated. Learn from your experiences. After each incident, take the time to evaluate the response effort and identify areas for improvement. This will help to make your incident response team even more effective in the future. By following these tips, you can build an incident response team that is prepared to respond to any incident.

Question 106

what's the difference between a security incident and a security event and an adverse event

Answer 106

A security event is any occurrence in an information system or the environment in which it operates that has the potential to adversely affect the system's security. Security events can be caused by a variety of factors, including human error, technical failures, and malicious attacks. A security incident is a security event that has resulted in a negative impact on an organization's security. Security incidents can result in a variety of consequences, including data breaches, financial losses, and reputational damage. An adverse event is any occurrence that has a negative impact on an organization. Adverse events can be caused by a variety of factors, including security incidents, natural disasters, and business disruptions. The key difference between a security event and a security incident is that a security incident has resulted in a negative impact on the organization's security. An adverse event, on the other hand, can be caused by a variety of factors, including security incidents, but does not necessarily have to involve security. Here are some examples of security events, security incidents, and adverse events: Security event: A hacker attempts to log into the organization's network using a stolen password. Security incident: A hacker successfully logs into the organization's network and steals sensitive data. Adverse event: The organization experiences a power outage that disrupts its operations. The organization in the first example experienced a security event, but it did not result in a security incident because the hacker was not able to log into the network. In the second example, the organization experienced a security incident because the hacker was able to log into the network and steal sensitive data. In the third example, the organization experienced an adverse event because the power outage disrupted its operations, but it was not a security incident because it was not caused by a malicious attack. It is important to note that the distinction between a security event and a security incident can be subjective. For example, some organizations may consider a failed login attempt to be a security incident, while others may not. Organizations should have a process in place for identifying and responding to security events and incidents. This process should include steps for investigating security events, assessing the risk, and taking action to mitigate the risk.

Question 106

how do you determine the incident severity

Answer 106

To determine the incident severity, you can use the following factors: Impact: What is the impact of the incident on the organization? This could include the impact on business operations, customers, or reputation. Urgency: How quickly does the incident need to be resolved? This could be based on the impact of the incident, the potential for further damage, or regulatory requirements. Complexity: How difficult is the incident to resolve? This could be based on the nature of the incident, the skills and resources required, and the availability of a fix. Once you have considered these factors, you can assign a severity level to the incident. Common severity levels include: Critical: The incident has a severe impact on business operations, customers, or reputation, and it needs to be resolved immediately. Major: The incident has a significant impact on business operations, customers, or reputation, and it needs to be resolved quickly. Minor: The incident has a minor impact on business operations, customers, or reputation, and it can be resolved within a reasonable timeframe. Low: The incident has a negligible impact on business operations, customers, or reputation, and it can be resolved at your convenience. It is important to note that the severity of an incident can change over time. For example, a minor incident may become a major incident if it is not resolved quickly. Organizations should have a process in place for determining the severity of incidents. This process should be documented and communicated to all employees. Here are some additional tips for determining the incident severity: Consider the stakeholders. Who is impacted by the incident? What are their needs and expectations? Consider the business impact. How is the incident impacting the organization's ability to do business? Consider the potential for further damage. Could the incident lead to more serious consequences if it is not resolved quickly? Consider regulatory requirements. Are there any regulatory requirements that apply to the incident? By considering all of these factors, you can make an informed decision about the severity of the incident. This will help you to prioritize the incident and to allocate resources accordingly.

Question 107

how does nist classify incident severity?

Answer 107

The National Institute of Standards and Technology (NIST) classifies incident severity using a four-level scale: Severity 1: A critical incident with very high impact. This type of incident may cause significant disruption to business operations, financial losses, or damage to reputation. Severity 2: A major incident with significant impact. This type of incident may cause moderate disruption to business operations, financial losses, or damage to reputation. Severity 3: A minor incident with low impact. This type of incident may cause minor disruption to business operations, but is unlikely to cause financial losses or damage to reputation. Severity 4: A negligible incident with very low impact. This type of incident is unlikely to cause any disruption to business operations, financial losses, or damage to reputation. NIST also provides a number of factors to consider when determining the severity of an incident, including: Impact: The impact of the incident on the organization, including its business operations, customers, and reputation. Urgency: The urgency with which the incident needs to be resolved. Complexity: The difficulty of resolving the incident. Scope: The number of people or systems affected by the incident. Organizations can use the NIST classification system to develop their own incident severity levels. This can help organizations to prioritize incidents and to allocate resources accordingly. Here are some examples of incidents that might be classified as Severity 1: A data breach that exposes sensitive customer information A ransomware attack that encrypts critical business systems A denial-of-service attack that makes the organization's website or online services unavailable Here are some examples of incidents that might be classified as Severity 2: A malware infection that disrupts a critical business process A security vulnerability that could be exploited by attackers A system outage that impacts a significant number of users Here are some examples of incidents that might be classified as Severity 3: A phishing attack that results in a few users having their accounts compromised A minor security misconfiguration that is easily fixed A system outage that impacts a small number of users Here are some examples of incidents that might be classified as Severity 4: A failed login attempt A minor software bug that does not cause any disruption A system outage that impacts a single user It is important to note that the severity of an incident can change over time. For example, a Severity 3 incident may become a Severity 1 incident if it is not resolved quickly or if it has a greater impact than originally anticipated. Organizations should develop a process for classifying incidents based on their severity. This process should be documented and communicated to all employees.

Question 108

Real evidence is any physical object that is presented to a court of law to prove a fact. Real evidence can be anything from a murder weapon to a bloodstained shirt to a piece of DNA. Real evidence is often the most powerful type of evidence because it is difficult to refute.

Answer 108

Documentary evidence is any written or recorded information that is presented to a court of law to prove a fact. Documentary evidence can include contracts, leases, receipts, emails, and photographs. Documentary evidence is often used to corroborate real evidence or to provide additional context for the case. The key difference between real evidence and documentary evidence is that real evidence is physical, while documentary evidence is not. Real evidence can be seen, touched, and smelled, while documentary evidence can only be read or heard. Here are some examples of real evidence: A murder weapon A bloodstained shirt A piece of DNA A fingerprint A tire track A video recording of a crime Here are some examples of documentary evidence: A contract A lease A receipt An email A photograph A medical record A business record Both real evidence and documentary evidence can be used to prove facts in a court of law. However, real evidence is often more persuasive because it is difficult to refute. Documentary evidence can be fabricated or altered, but it is much more difficult to do the same with real evidence. In some cases, real evidence and documentary evidence may be used together to prove a fact. For example, a prosecutor might introduce a murder weapon as real evidence and a witness's testimony as documentary evidence to prove that the defendant committed murder. The admissibility of both real evidence and documentary evidence is subject to the rules of evidence. These rules vary from jurisdiction to jurisdiction, but they generally require that the evidence be relevant and reliable.

Question 109

What type of technology prevents a forensic examiner from accidentally corrupting evidence while creating an image of a disk?

Answer 109

A write blocker is a technology that prevents a forensic examiner from accidentally corrupting evidence while creating an image of a disk. It is a device that is inserted between the disk drive and the computer being used to create the image. The write blocker prevents the computer from writing any data to the disk, which helps to ensure that the original evidence is preserved. Write blockers are typically used in conjunction with forensic imaging software to create a bit-by-bit copy of the disk. The forensic imaging software will read all of the data on the disk and create a file that contains the data. The write blocker will prevent the computer from writing any data to the disk while the image is being created. Write blockers are an important tool for forensic examiners because they help to ensure that the original evidence is preserved. Without a write blocker, it is possible to accidentally corrupt the evidence while creating an image. This could happen if the computer writes data to the disk while the image is being created. Here are some of the benefits of using a write blocker: Preserves the original evidence: A write blocker prevents the computer from writing any data to the disk while the image is being created. This helps to ensure that the original evidence is preserved. Reduces the risk of errors: A write blocker can help to reduce the risk of errors during the imaging process. If an error does occur, the write blocker can help to prevent the error from corrupting the image. Increases the reliability of the evidence: A write blocker can help to increase the reliability of the evidence by ensuring that the image is an accurate copy of the original disk. If you are involved in a forensic investigation, it is important to use a write blocker to create an image of the disk. This will help to ensure that the original evidence is preserved and that the image is an accurate copy of the original disk.

Question 110

During what phase of ediscovery does an organization share information with the other side? View other drafts

Answer 110

During the production phase of eDiscovery, organizations share information with the other side. This is the phase where the electronically stored information (ESI) that has been collected and processed is exchanged between the parties involved in the litigation. The production phase can be a complex and time-consuming process, depending on the volume and complexity of the ESI involved. It is important to have a plan in place for producing ESI in a timely and efficient manner, and to comply with all applicable laws and regulations. Here are some of the key steps involved in the production phase of eDiscovery: Identify the ESI to be produced: The first step is to identify the ESI that is relevant to the litigation and that is required to be produced under the applicable laws and regulations. This may involve reviewing the discovery requests from the other side, as well as the organization's own policies and procedures. Collect and process the ESI: Once the ESI to be produced has been identified, it needs to be collected and processed. This may involve extracting the ESI from various sources, such as email servers, file shares, and mobile devices. The ESI may also need to be converted to a standard format, such as PDF or TIFF. Review the ESI: Before producing the ESI, it is important to review it to ensure that it is relevant and that it does not contain any privileged or confidential information. The ESI may need to be redacted to remove any privileged or confidential information. Produce the ESI: Once the ESI has been reviewed and redacted, it can be produced to the other side. The ESI may be produced on physical media, such as CDs or DVDs, or it may be produced electronically, such as through a secure file sharing service. It is important to note that the production phase of eDiscovery is not the end of the eDiscovery process. After the ESI has been produced, the parties may engage in additional discovery activities, such as depositions and expert witness discovery. The parties may also file motions with the court to address any disputes that arise during the eDiscovery process. By unders