Domain 7 - Security Operations Flashcards
1
Q
User and entity behavior analytics (UEBA)
A
- entity behavior is collected and input to a threat model, model establishes baseline of normal based on historical data, enables analysis to uncover anomalies
2
Q
Threat intel feeds
A
- feed containing malicious entities ingested by cyber tools, educational tools for threat landscape changes, single feed may contain many sources including OSINT, entity = IP, website, actor, hashes
3
Q
Role of AI and ML (SecOps)
A
- automate analysis, automated investigation feature, quickly analyze millions of events and identify many different types of threats, profiles are built on users/ assets/ networks/ devices allowing AI to detect and respond to deviations from established norms, factor in anti-malware, SIEM, IDS/IPS, IDaaS
4
Q
Collusion
A
- agreement among multiple persons to perform unauthorized action
5
Q
Separation of duties
A
- ensure 1 person doesn’t control all elements of a critical function
6
Q
Job rotation
A
- employees rotated into different jobs or tasks, flush out fraud
7
Q
Monitoring privileged operations
A
- monitor all assignment of privileges and the use of privileged operations, can detect many attacks because attackers commonly use special privileges
8
Q
Information lifecycle
A
- Creation (file creation by user or system logs) > classification (to ensure its handled properly) > storage (protect data with adequate controls based on classification) > usage (anytime data is in use or in transit) > archive (sometimes needed to comply with laws or regulations) > destruction (destroyed in a way so it is not readable)
9
Q
Service level agreements
A
-performance expectations like max downtimes/ availability numbers, can include penalties, usually applies to vendors
10
Q
Secure provisioning
A
- ensures that resources are deployed in a secure manner and maintained in a secure manner throughout lifecycle, ie PC deployed from secure image
11
Q
Virtual assets
A
- VMs, VDIs, SDN, SAN, hypervisors are primary component that manage virtual assets but also provide attackers with an additional target, KEEP IT PATCHED!!
12
Q
Configuration management
A
ensures that systems are configured in a similar manner, configs are KNOWN and DOCUMENTED
13
Q
Baselining
A
- ensures systems are deployed with a common baseline ie imaging, policy based config (GPOs), can then be TAILORED as needed
14
Q
Change management
A
- helps reduce outages/ weakened sec from unauthorized changes, make sure all changes are documented/ discussed/ authorized, changes are tested approved and documented
15
Q
Versioning
A
- uses labeling/ numbering to track changes in software, helpful in change management process
16
Q
Patch management
A
- ensures systems are kept up to date with current sec patches, evaluate/ test/ approve/ deploy patches, system audits verify the deployment of approved patches to system, vuln scanner can identify missing patches
17
Q
Vuln scanners
A
- detect vulns, weaknesses, absence of patches, weak passwords ie tenable, qualys
18
Q
Vuln assessments
A
- includes review and audits to detects vulns in addition to a scan
19
Q
Detection (IR)
A
- monitoring tools, IPS, firewalls, notifying management
20
Q
Response (IR)
A
- triage (is it really an incident?), decision to declare, LIMIT DAMAGE
21
Q
Mitigation (IR)
A
- first containment effort or step, create team, CONTAINMENT IS HERE
22
Q
Reporting (IR)
A
- to relevent stakeholders (customers, vendors, law enforcement), MANAGEMENT DECISION
23
Q
Recovery (IR)
A
- returning to normal ops, MANAGEMENT DECISION
24
Q
Remediation (IR)
A
- root cause is addressed, ROOT CAUSE ANALYSIS
25
Q
Lessons learned (IR)
A
- prevent recurrence, improve IR process
26
Q
Denial of Service attacks (DoS)
A
- prevent a system from responding to legit requests for service, blocks resources
27
Q
SYN flood attack
A
- disrupts TCP 3 way handshake
28
Q
Smurf attack
A
- amplification network (systems under control of bad actor) to send many response packets to victim
29
Q
Botnet
A
-collection of compromised computing devices (often called bots or zombies)
30
Q
Bot herder
A
- attacker who remotely controls botnet via a C2 server, often use them to launch attacks or send phishing emails
31
Q
Honeypot
A
- has pseudo flaws and fake data to lure/ distract intruders, cant entrap someone to commit an actual crime, as long as attackers are in the honeypot they are not in the live network and admins can observe, some IDS can transfer attackers to padded cell after detection (hardened honeypot)
32
Q
Anti-malware software
A
- up to date definitions, installed on each system/ boundary device/ email servers/ etc, also has behavioral analysis now
33
Q
Policies (blocking malicious code)
A
- enforce basic sec principles ie least privilege, no local admin, etc
34
Q
Education (blocking malicious code)
A
- teaching users about risks and methods attackers use to spread viruses
35
Q
Penetration tests
A
- discover vulns then mimic an attack to identify what can be exploited, not without consent and knowledge from management, can result in damage so should be done on isolated systems whenever possible, schedule at time of minimal activity
36
Q
Black box pentesting
A
- no knowledge of environment
37
Q
White box pentesting
A
- full knowledge of environment, open book test
38
Q
Gray box pentesting
A
- partial knowledge of environment
39
Q
IDS
A
- can respond by passively logging and notifying OR actively by changing the environment, reactive
§ HIDS - monitor activity on single system only, attackers can discover and disable
§ NIDS - monitor activity on a network, not as visible to attackers
40
Q
IPS
A
- placed inline with traffic, can block malicious traffic before it reaches target, proactive
41
Q
Espionage
A
- external threat, competitor tries to steal info
42
Q
Sabotage
A
- insider threat, malicious insiders can become disgruntled, ie mass deletion/ server shutdowns, data theft
43
Q
Zero-day exploits
A
- attack that uses a vulnerability that is either unknown to anyone but the attacker or a limited # of people, basic sec practices can often prevent these from being fully utilized
44
Q
Common log files
A
- security logs, system logs, application logs, firewall logs, proxy logs, protected by centrally storing them and restricting access so they can’t be modified, read only!
