Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Cyber Defense & Countermeasures > Focused ECIHv2 Study Guide > Flashcards

Focused ECIHv2 Study Guide Flashcards

(159 cards)

Start Studying
1
Q

What is the Risk equation?

A

Risk = Threat X Vulnerabilty

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

In Order, What is the Risk Assessment Process?

A
  1. System Characterization
  2. Threat Identification
  3. Vulnerability Identification
  4. Control Analysis
  5. Likelihood Analysis
  6. Impact Analysis
  7. Risk Determination
  8. Control Recommendation
  9. Risk Assessment Report
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is PILAR?

A

Risk Analysis and Management Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the purpose of Incident Response Orchestration - Automation?

A

To automatically notify a person when there’s an incident.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

ISO/IEC 27000

A

Overview and introduction of the information security management systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

ISO/IEC 27001

A

The Information Security Management System (ISMS) requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

ISO/IEC 27002

A

Code of practice for information security controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ISO/IEC 27003

A

Information Security Management System implementation guidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ISO/IEC 27004

A

Information Security Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

ISO/IEC 27005

A

Information Security Risk Management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ISO/IEC 27006

A

Requirements for bodies providing audit and certification of Information Security Management Systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

ISO/IEC 27007

A

Guidelines for Information Security Management Systems auditing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ISO/IEC TR 27008

A

Guidance for auditors on ISMS controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ISO/IEC 27009

A

Guidelines for those producing sector or industry-specific ISO27k standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ISO/IEC 27010

A

Information Security Management for inter-sector and inter-organizational communications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NIST 800-86

A

Incident Response Approach

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

NIST 800-61 Rev.2

A

Incident handling guide

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

RFC 2196

A

RFC 2196 builds on RFC 1244 and is a guide to setting computer security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

COBIT IT

A

Governance framework that emphasizes compliance and helps increase the value of ID

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

NIST 800-61

A

Step-by-step instructions for new and established incident response teams

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Graham-Leach-Bliley Act (GLBA)

A

Deals with financial institutions, specifically PII

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Sarbanes-Oxley (SOX)

A

Fair and accurate corporate reporting. Deals with corporate fraud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

General Data Protection Regulations (GDPR)

A

Article 32: Speaks to the CIA triad and the ability to restore PII on time

Article 33: Must notify if data is breached within 72 hours, if possible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

NIST: Incident Handling Criteria and Reporting Timeframe

A 
Cat 0 Exercise/Network Defense Testing
Cat 1 Unauthorized Access – 1 hour
Cat 2 DOS – 2 hours
Cat 3 Malicious code – 1 hour
Cat 4 Inappropriate usage - Weekly
Cat 5 Scan/Probe/Attempting access – Monthly
Cat 6 Investigation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
buck-security
Linux tools which identify the security status of a system
26
Kiwi Syslog Server
Centrally manages Syslog messages
27
Splunk
Collects, monitors and analyzes log files
28
Microsoft Baseline Security Analyzer
Gets the security posture of a Windows system, indicates whether a system is missing security patches.
29
Magic Tree
Reporting tool using a tree structure
30
KeepNote
Multi-platform notetaking software.
31
Forensic Readiness Planning
1. Identify potential evidence 2. Determine source 3. Define a policy that determines the pathway 4. Establish a handling and storing policy 5. Does it require a full or formal investigation? 6. Train staff 7. Special process for documenting 8. Legal advisory board
32
rc.local
The script /etc/rc. local is for use by the system administrator. It is traditionally executed after all the normal system services are started, at the end of the process of switching to a multiuser runlevel. You might use it to start a custom service, for example a server that's installed in /usr/local.
33
Common Imaging Software
FTK Imager and R-Drive Image
34
Order of Volatility
1. Registers and Cache 2. Routing table, process table, kernel stats, memory 3. Temp files 4. Disk or storage media 5. Remote logging 6. Physical config and network topology 7. Archival media
35
Data Collection Commands
Systeminfo.exe – Windows PsInfo – Windows Cat – Linux Uname – Linux
36
Uptime Commands
* PsUptime – Windows * Date /t – Windows (show date and time) * Net Statistics – Windows * Uptime and W – Linux
37
Process Commands
• Netsat – ab (Windows) All executable files • ListDLLs (Windows) shows all DLLs • Pslist.exe (Window) shows running processes and uptime • Pmdump (Windows) tries to help find rogue processes • Top (Linux) system info summary as well as processes and threads • W (Linux) current processes per user • Ps root’s processes • Pstree shows processes in a tree form
38
Network Commands
* Nbstat -c contents (cache name and ip) * Netstat -ano (all connections and even ports) * Netstat -r (routing table and frequent routes)
39
Cyber Triage
Simplified collection and analysis of endpoint data
40
Process Explorer
DLLs of processes – Can show you malware hits on Virus Total
41
Forensic Explorer
Undelete and slack space
42
Forensic toolkit (FTK)
decryption and password cracking
43
Event Log Explorer
Event logs in Windows
44
OSForensics
Discover relevant forensic data through searching and indexing as well as undelete, also cheap
45
Helix3
Gives visibility across your entire network revealing internet abuse, data sharing and harassment
46
Autopsy
view file system, restore deleted data and timeline analysis
47
EnCase
Does pretty much everything, very expensive
48
Foremost
Linux recovers files based on headers, footers and internal data structures
49
Golden Ticket
Stolen Kerberos ticket
50
Syscall Proxying
Remote commands
51
Userland Execve Technique
Unix process load and execute ELF binary image
52
ADS (Alternate data stream)
Hide files in NTFS
53
Trail Obfuscation
Trying to mislead investigators
54
Preparing Malware Testbed Steps
Step 1: Allocate a physical system for the analysis lab Step 2: Install virtual machine on the system Step 3: Install guest OS on the virtual machine Step 4: isolate the system for the network by ensuring that the NIC card is in "host only" mode Step 5: Simulate internet services using tools such as iNetSim Step 6: Disable the "shared folders" and the "guest isolation" Step 7: Install malware analysis tools Step 8: Generate hash value of each OS and tool Step 9: Copy the malware over to the guest OS
55
Live System/Dynamic Analysis
A malware detection technique for live systems that are operational
56
Intrusion Analysis
A malware detection technique that utilizes logs and alerts of IDS, SIEMS, etc...
57
TCPView
GUI TCP viewer
58
Process Monitor
GUI that allows filtering of real time monitoring, you can use it to drill down clear to driver stack information and see individual commands sent over the network to the machine. You can also right click on the process and search it online.
59
Registry Monitoring Tools
``` Regshot Reg Organizer Registry Viewer RegScanner Registrar Registry Manager ```
60
Autoruns
Monitors autoruns, you can verify signatures and jump to reg key or file location
61
SIGVERIF
Checks file and folder integrity by verifying hash values
62
HashMyFiles
Hashes files
63
IDA Pro
Multi-platform disassembler and debugger through instruction tracing, functions tracing, read/write/execute tracing
64
Memory Dump Analysis Using Volatility Framework
``` connections - connscan - psscan - pstree - malfind - apihooks - printkey - idt - threads - modscan - getsids - filescan - sockets - mutantscan - ```
65
SSDT View and ReKall
Identify SSDT patching by rootkits
66
RogueKiller
Identifies kernal-mode rootkits
67
CapLoad and Wireshark
Detect malicious beaconing traffic
68
PRTG Network Monitor and GFI Languard
Identify unwanted traffic to malicious and unknown external entities
69
Mail Bombing
DOS attack by overloading an email box
70
Mail Storming
DOS by reply all to large distribution lists
71
Spear Phishing
Targeted at a specific person or group
72
Whaling
Targeting high profile people, like executives
73
Pharming
Redirecting traffic using DNS poisoning or host file modification
74
Spimming
Spam on Instant Messanger
75
Puddle Phishing
Targeting small organizations
76
CEO Scam
Impersonating a CEO to get employees to do something for you (Like the Google Play card scams that are super common)
77
Netcraft
Neighborhood watch scheme to help defend community against phishing – also includes a toolbar that gives a website a risk rating
78
PhishTank
Open API for developers and researchers to integrate anti-phishing data into their applications
79
MxToolbox
Makes email headers human readable by parsing them according to RFC 822
80
Email Dossier, Email Address Verifier, emailvalidator, Email Checker, and G-Lock Software Email Verifier
All email validity checkers
81
eMailTrackerPro
Analyzes email header and reveals sender’s geographical location and IP address
82
EventLog Analyzer
Used to analyze email logs at server level
83
Recover My eMail
Uses Outlook PST or DBX files to recover deleted emails
84
Gophish
Used to create phishing simulations to test your organizations exposure to phasing – usually used to schedule people for additional security awareness training
85
SPAMfighter
An automatic SPAM filter
86
Gpg4win
Email encryption and digital signatures
87
Suricata
IDS/IPS/Network Security Monitoring (NSM)/offline pcap processing
88
Ntopng
Web-based network traffic monitoring released under GPLv3
89
Wireshark - Detect ICMP Ping Sweep Attempts
Icmp.type==8 or icmp.type==0
90
Wireshark - Detect TCP ping sweep
Tcp.dstport==7
91
Wireshark - Detect UDP ping sweep
Udp.dstport==7
92
Wireshark - It is used to see if a port is open, RST response if port is closed
SYN+ACK
93
Wireshark - Used if there is a large amount of RST or ICMP type 3 packets
Stealth Scan
94
Wireshark - Used if the TCP session is less than 4 packets it can be a sign of a TCP port scan
Stealth Scan Detection – Statistics>Conversations>TCP
95
Wireshark - A full three-way handshake to find open ports
A full connect scan
96
Wireshark - Same detection method as stealth scan
TCP full connect scan detection
97
Wireshark - Checks for SYN, SYN+ACK, RST+ACK or ICMP Type 3 packets
Full scan detection
98
Wireshark - Null Scans
TCP packets without a setting flag RST = Port closed, no response = open or filtered Detect using TCP.flags==0x000
99
Wireshark - Xmas Scans
Attacker uses FIN, PSH, and URG TCP flags and waits for a response RST = Port closed, no response = open or filtered Detect using tcp.flags==0x029
100
Wireshark - ARP poisoning detection
* Duplicate IP address configured messages * Arp.duplicate-address-detected * Xarp is another tool that can be used to do this besides Wireshark
101
PromqryUI
Detect network interfaces running in promiscuous mode
102
NMAP
Detect network interfaces running in promiscuous mode using nmap –script=sniffer-detect (target ip address/range of ip addresses)
103
ZENMAP
GUI version of NMAP
104
DoS/DDoS - Volumetric Attacks
``` o Measured in bits-per-second o UDP Flood o ICMP Flood o Ping of death o Smurf ```
105
DoS/DDoS - Protocol Attacks
``` o Measured in packets-per-second o SYN flood o Fragmentation o ACK flood o TCP state exhaustion ```
106
DoS/DDoS - Application Layer Attacks
o Measured in requests-per-second o HTTP GET/POST o Sloworis
107
DoS/DDoS - Permanent Attack
Plashing – Bricks the system (Bad firmware updates)
108
DoS/DDoS - Distributed Reflection Attack
Reflects transmissions of third parties before the target to amplify attack
109
DoS/DDoS Tools
o Low Orbit Ion Cannon – Flood target with UDP, TCP or HTTP packets or requests o High Orbit Ion Cannon – DDOS version, just select IP/Port/Protocol o Additional Tools – HULK, Black Hat Hacking Tools, DAVOSET, Tsunami, R-U-Dead-Yet
110
KFSensor
Honeypot software to attract and detect hackers
111
RFC 3704 Filtering
Limits impact by denying spoofed addresses
112
CISCO IPS Source IP Reputation Filtering
Uses Cisco database to check reputation of connection source
113
Black Hole Filtering
Discarding packets at the routing level
114
Anti DDOS Guardian & D-Guard Anti-DDOS Firewall
Anti-DDOS software
115
Incapsula
Mitigates any size attack without impacting legitimate traffic and latency
116
Shell Injection
System (), StartProcess (), java.lang.runtime.exec (), System.Diagnostics.Process.Start ()
117
Cross-Site Request Forgery
Spoofed requests on behalf of the logged in user
118
\’
Single-quote character
119
|
or
120
\%27
Single-quote character
121
\-\-
Double-dash
122
#
Hash
123
\%23
Hex version of #
124
What does the 'i' mean at the end of a regular expression?
Case insensitive
125
What does the 'x' mean at the end of a regular expression?
Ignore white spaces
126
\%3d
=
127
\%3b
;
128
\%6f
o
129
\%4f
O
130
\%72
r
131
\%52
R
132
\%2e
.
133
\%2f
/
134
\%5c
\
135
16 bit Unicode
Replaces unusual Unicode with %u
136
UTF-8
% followed by the hexcode (%c2 for example)
137
Base64
Represents binary data in printable ASCII characters
138
Hex Encoding
HTML encoding scheme that uses hex values of every character
139
%0a
new line
140
%20
space
141
&amp
&
142
&lt
143
&gt
>
144
Who is the Cloud Consumer?
The User
145
Who is the Cloud Carrier?
Intermediary between user and provider (Transport services)
146
Who is the Cloud Auditor?
Makes independent assessments of cloud service controls
147
Who is the Cloud Broker?
Manages the cloud service and maintains relationship between provider and consumer (the reseller)
148
AICPA SAS 70 Type II
Cloud Security best practice
149
CloudPassage Halo
All security functions needed to deploy servers securely in public and hybrid clouds
150
Pod Slurping
Stealing information using small devices like iPods/iPads/phones/MP3 players/etc
151
Where to find USB Connected History
Windows - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB (Windows) Mac - System Information->Hardware->USB Linux - usb-devices
152
ObserveIT
Threat Management solution that monitors user behavior with “eyes on the endpoint”
153
DataRobot
Automated machine learning platform to detect insider threats
154
Ekran System
Helps monitor/detect/analyze user-based insider threats
155
NERC 1300
North America Electric Reliability Corporation
156
Mirekusoft
Uninstaller
157
SysAnalyzer
Malcode analyzer
158
OWASP
Top 10 Web Application Security Risks
159
Cross-site Forgery
Also known as one-click attacks

Cyber Defense & Countermeasures (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions