Domain 7, Security Operations Flashcards
1
Q
BCP
A
Business continuity Plan. Long term plan to ensure the continuity of business ops.
2
Q
Collusion
A
agreement between 2+ individuals to subvert sec system.
3
Q
Continuity of Operations Plan - COOP
A
Plan to maintain ops during a disaster.
4
Q
Disaster
A
Disruptive event that interrupts normal system operations
5
Q
Disaster recovery plan DRP
A
Short term plan to recover from a disruptive event.
6
Q
MTBF
A
Mean time between failures
7
Q
MTTR
A
Mean time to repair/recover
8
Q
Mirroring
A
RAID - Duplication of data to another disk
9
Q
RAID
A
Redundant array of inexpensive disks
10
Q
Striping
A
Spread data across multiple disks.
11
Q
Slack space
A
Unused space that is leftover when a File of X-1 size was given space of X
12
Q
Bad Blocks/Clusters
A
Unusable sectors
13
Q
Live forensics
A
Seeing what’s in live memory
14
Q
Meterpreter
A
Power metasploit payload
15
Q
Network forensics
A
study of data in motion.
16
Q
Forensic software analysis
A
deconstruct malware and software. Use a VM to detonate Malware
17
Q
EMbedded Device Forensics
A
IoT and Other Handheld devices
18
Q
Electronic Discovery
A
Help lawyers with discovery process via Electronic Discovery tools
19
Q
CSIRT
A
Computer Security Incident Response Team
20
Q
800-61r2
A
NIST Incident Handling Guide
4 step lifecycle
21
Q
800-61r2 lifecycle Step 1
A
Prep
22
Q
800-61r2 lifecycle Step 2
A
Detection and Analysis
23
Q
800-61r2 lifecycle Step 3
A
Containment, Eradication, and recovery
24
Q
800-61r2 Step 4
A
Post-incident Activity
25
IR MGMT Step 1
Prep
| Training, policies, procedures, checklist
26
IR MGMT Step 2
Detection, AKA identification
Events---> Incident
27
IR MGMT Step 3
Response
28
IR MGMT Step 4
Mitigation, aka Eradication
Root Cause Analysis
Get rid of the bad things
29
IR MGMT Step 5
Reporting
Not really a step, this happens throughout the process
30
IR MGMT Step 6
Recovery
Restore systems and ops
Increase monitoring
31
IR MGMT Step 7
remediation - long term strategic activity designed to eradicate root cause for identified incidient.
32
IR MGMT Step 8
Lessons Learned. Shoudl be documented in a formal process, and assigned as action items with accountability
33
Intrusion Detection System
Detects intrusions
34
IDS True Positive
alerts on an actual issue
35
IDS True Negative
doesn't alarm on something that it doesn't need to alarm on.
36
IDS False positive
Trips on something that it shouldn't on.
37
IDS False Negative
Doesn't trip on something it should trip on.
38
NIDS NIPS
Network intrusion detection,
Network intrusion prevention system
39
HIDS HIPS
Host Intrusion detection
Host intrusion prevention
40
Knowledge-based IDS/IPS
AKA Signature based, AKA Pattern-matching
-compares events to static signatures of known attacks.
41
Behavior-based IDS/IPS
Creates a baseline for what activities/events are considered normal. Once baseline is determined, it can now detect 'abnormal' activities
42
Anomaly detection
Finds a baseline of normal traffic, then anomaly detection IDS ignores normal traffic.
Will alert when it sees odd traffic.
43
Continuous monitoring
ASsessing and reassessing as an ongoing process
44
DLP
data loss prevention.
class of solutions used to detect and prevent data from leaving the org
45
Application Whitelisting
Only run what is permitted
46
Sandboxing
Separate running programs, in an effort to mitigate system failures from spreading.
Test untested or untrusted programs.
Detonate malware in a VM.
47
Asset/Configuration management
Hardened baselines and configs.
Establishes the baseline of an information technology environment that includes a secure baseline
48
Baselining
Capture a snapshot of the current system security config. Establishes an easy means for capturing the current system config.
49
Vulnerability management
scan in a way to discover poor configs and missing patches in an environment, with an emphasis on managing those vulnerabilities.
50
Zero day vulnerability
no identified patch or workaround.
51
Zero day exploit
Exploit methods is/are available for a vulnerability which has yet to be patched.
52
Change management
Track and audit changes to configuration files. Assess risks of changes.
53
SLA
Service level agreement
Stipulate all expectations regarding behavior of the department or organizations.
Orgs must negotiate all secure terms of service lvl agreement
54
Full Backup
Complete copy. Duplicates every file regardless of the archive bit. Once complete, archive bit on every file is reset, turned off, or set to 0.
55
Incremental backup
archives files that have changes since last full or incremental backup. Only files that have the archive bit turned on (set to 1) are duplicated. Once complete, archive bit on every file is reset, turned off, or set to 0.
56
Differential Backup
archives files that have changes since last full (but NOT INCREMENTAL) backup. Only files that have the archive bit turned on (set to 1) are duplicated. DOES NOT CHANGE ARCHIVE BIT once done.
57
RAID 0
Stripes two or more disks to improve performance, but NOT fault tolerance.
58
RAID 1
Mirrors, uses two disks both with the same exact data. Provides fault tolerance. Lower write speeds, but potentially higher read speeds.
59
RAID 3
NOT IN CBK. Byte level striping with dedicated parity
60
RAID 4
NOT IN CBK. Block lvl striping with dedicated parity
61
RAID 5
Striping with parity. Uses three or more disks, with one disk holding parity information. Parity allows reconstruction to occur after disk failure via mathematical calculations.
62
RAID 6
Same as RAID 5, but with two parity disks.
63
Mirroring
Writes same data to multiple hard disks.
Writes are slower read is faster. Costly
64
Striping
Spread data across multiple hard disks.
Reads and writes can be performed in parallel acros multiple disks
Performance increase on reads and writes
65
RAID 10
Nested RAID. Configuration is a striped set of mirrors. Uses at least 4 disks, but can support more as long as an even number of disks are added.
Can tolerate multiple disk failures, as long as one drive in each mirror continues to operate.
66
BCP
business continuity plan. Long term plan to ensure continuity of business ops
67
BCP
business continuity plan. Long term plan to ensure continuity of business ops
Business level scope
68
DRP
Disaster recovery plan
| Short term plan to recover from a disruptive event.
69
DRP
Disaster recovery plan
Short term plan to recover from a disruptive event.
IT oriented scope
70
MTTR
Mean time to repair.
71
MTTR
Mean time to repair.
72
Natural disaster
Weather, earthquake
73
Human
Malware, assault, large portions of workforce leaving.
74
Environmental
HVAC fails, power outage
75
DRP Process - respond
Begin processing the damage
| Initial assessment
76
DRP Process - Acticate team
Activate team
77
DRP Process - Communicate
comms must be out of band. Ensuretimely updates. Org should be prepared for external comms
78
DRP Process - Assess
More detailed and thorough assessment
Assess damage
Team could recommend ultimate restoration/reconstitution at different site
79
DRP Process -Reconstitution
Recover business ops at primary or secondary site.
Salvage team activated at primary facility
80
Develop a BCP/DRP
```
Project initiation
scope the project
business impact analysis
identify preventive controls
Recovery strategy
Plan design, and develpment
implementation, training, and testing
BCP/DRP
```
81
NIST 800-34
NIST contigency planning guide.
82
BCP/DRP Planning Project Initiation Milestones
7
1. Develop contigency plan
2. Conduct business impact ianalysis
3. Identify preventive controls
4. develop recovery strategies
5. Develop IT contigency plan
6. Plan testing, training, excercises
7. Plan maintenance of documents
83
Continuity planning project team
Team set up to determine responsibilities and objectives of continuity plan.
84
RTO
Recovery time objective. How quickly something a system can be brought back on line, but not integrity hasn't been verified yet.
85
WRT
Work recovery time. After system is online, time to verify integrity of system.
86
Executive mgmt - Scoping the project
need exec support for
- initiating the scoping process,
- and also need to sign off on final approval.
- need to excercise due diligence and due care
87
assess teh critical state
process to determine which iniformation systems are critical. difficult to do because how important something is depends soley on who uses it.
when compilinng the critical state and asset list, the Project manager should not how assets impact the org
88
business impiact analysis BIA
correlate IT systems to critical services they support. Aims to quantify the consequence of disruption
89
BIA Steps
Business impact analysis
1. Identify critical assets
2. Conduct DRP/BCP focused risk assessment
90
MTD = ?
Max tolerable downtime = Recovery time objective + Work recovery time
MTD = RTO +WRT
91
RPO =
recovery point objective, how much data you can afford to lose
92
MOR =
Minimum operating requirements
usually applies to environmentals.
93
Redundant site
exact replica, very expensive.
no data loss in event of disaster at primary site
94
Hot site
Less than one hour of downtime.
Has all infrastructure for resuming normal business operations.
95
warm site
Most aspects of a hot site, but relies on backups to get systems up and running.
MTD of 1-3 days
96
Cold site
not equipment, no backup data. Typically just physical building.
1-3 weeks of MTD
97
Mutual Aid Agreement
Two businesses promise to cover each others' business needs in event of disaster.
98
mobile site
data center on wheels.
99
COOP
Continutity of operastions plan. Focuses exclusively on operations.
100
BRP
Business recovery plan/ business resumption plan
details plan to resume normal operations AFTER recovering from disaster/disruptive event.
picks up after COOP is complete.
101
CSP
continuity of support plan.
Helpdesk/IT oriented continuity plan.
102
CIRP
Cyber Incident Response Plan
103
OEP
Occupant emergency plan
104
CMP
Crisis Management Plan
Details actions required of management in a disaster.
105
CCP
crisis communications plan - Plan for communicating to staff in event of a disaster.
Component of CMP
106
Call trees
each employee is responsible for calling a small number of other employees in event of a disaster.
107
EOC
emerency ops center
108
Vital records
vital documentation needed for normal operations. Licenses, checkbooks, contracts
109
forensic media analysis
analysis of binary disk images
110
root-cause analysis root cause
attempts to determine the underlying weakness or vulnerability.
111
executive succession plan
determines line of succession in event an executive is unable to lead.
112
executive succession plan
determines line of succession in event an executive is unable to lead.
113
Tape rotation
method to ensure you have long backup windows, but don't require too much tape.
114
Electronic vaulting
batch process of electronically transmitting data that is backed up on a routine. Offsite facility
115
Remote journaling
log of all database transactions.
116
Database Shadowing
Updates a backup DB automatically when live DB is changes. Two or more backup DBs
117
Software Escrow
source code is held by an impartial 3rd party in case software vendor goes out of business.
118
Hardcopy data
on paper data. In hurricane prone areas, businesses often develop a paper-only DRP
119
DRP Testing
Plan is only as effective as the last time it was updated and tested.
Should be performed at least yearly.
120
DRP Testing - Read-Through AKA Checklist testing
Review the plan, read the whole thing.
AKA consistency testing. Lists all necessary components. Ensures they're readily available in event of disaster.
121
DRP Test, partial and complete business integration
Intentional outage. Can actually cause a real disaster. More common in fully redundant, load balanced operation.
122
DRP training
DRP specific training to bring employees up to speed.
123
DRP training
DRP specific training to bring employees up to speed.
124
BCP/DRP Maintenance
must be kept up to date. Must keep pace with all critical IT/Business changes.
Change management
125
NIST SP 800-34
BCP/DRP Framework from NIST
126
ISO/IEC 27031
BCP Framework from ISO
127
ISO/IEC 27031
BCP Framework from ISO
128
ICT
ISO Acronym, Information and Comms Technology
129
ISMS
ISO Acronym, Information security mgmt system.
130
ISO/IEC 24762:2008
ISO guide for disaster recovery DRP
131
BS 25999
Part 1, code of practice
| Part 2, Specifications for business continuity
132
BCI
Business continuity institute
133
Security Operations
concerned with threats to a production operating environment.
134
Least Privilege AKA Minimum Necessary Access
Persons should have no more access than is necessary for the performance of their duties.
135
Need to Know
Even if you have access, if you do not need to know, then you should not access the data. Example, in a MAC environment, even if you have the clearance - if the information isn't relevant to you then you aren't 'need to know' and shouldn't have access.
136
Separation of Dties
Multiple people are required to complete critical or sensitive transactions. Idea is to require multiple people acting un-ethically for something bad to happen. i.e. the payroll administrator can't also audit accounting logs. Idea
137
Rotation of Duties/Job Rotation
Ensures there's more depth to the organizational skillset. Simply requires that no one person perform critical functions for too long.
138
Mandatory Leave/Forced Vacation
Prevents an operator from having exclusive use of a system. If they're doing anything shady - then it will potentially/probably be discovered while they're out.
139
NDA
Nondisclosure Agreement.
Legally binds a user to confidentiality.
140
Background Checks
Helps ensures quality of candidate.
141
Forensic - Allocated space
portions of disk partition marked as containing active data
142
Forensics - unallocated space
portions of disk that do not contain active date.
Could have never had data - or simply been marked as unallocated but still contains old information.
143
Forensics - Slack Space
When the minimum sized block of information isn't fully used by a piece of information - the remaining space that isn't usable is called slack space.
Slack space may contain old/unused information, or might be used by attackers.
144
Forensics - bad blocks/clusters/sectors
Physically unusable space. Attacker might mark space as 'bad' in order to use for themselves.
145
Removable Media controls
Put controls on PCs/routers to bar un-known peripherals (USB drives, keyboards, mice, monitors etc)
146
DRP Testing - walkthrough/tabletop
virtual/tabletop simulation of DRP to conceptually run through the whole process. Goal to find any gaps or redundancies, erroneous assumptions, etc.
147
DRP Testing - Simulation test, physical walkthrough drill
Simulate a disaster and have all teams go through the physical motions of response.
148
DRP Test - Parallel processing
Test recovery at another facility and restore data from a backup. Regular systems are not impacted
149
DRP Test- partial business interruption AKA Cutover test
Stop activities at main location, start at backup location
