General NBT Flashcards by Pat Jones

What is the purpose of Navy Blue Team?

Assess and evaluate the security posture of Navy networks.

How well did you know this?

Not at all

Perfectly

What is Directive 527-1?

Guidance on INFOCON levels

How well did you know this?

Not at all

Perfectly

What is Appendix 12 to Appendix C OPORD 05-01?

DOD INFOCON execution procedures

How well did you know this?

Not at all

Perfectly

What is DOD 8530-1?

Establishes CND certification and accreditation

How well did you know this?

Not at all

Perfectly

What is SURFORREDMAN (COMNAVSURF PAC INST 3502.3)?

Dictates NBT assesments and CND guide for afloat units

How well did you know this?

Not at all

Perfectly

What can be found on HTTS://SAILOR.NMCI.NAVY.MIL?

IAVA downloads, CND-OSE downloads, software patches, and baseline configs for ISNS/ADNS

How well did you know this?

Not at all

Perfectly

What can be found on WWW.NCDOC.NAVY.SMIL.MIL?

Incident reports, FAMS, CTO’s, and DNS black hole list

How well did you know this?

Not at all

Perfectly

What can be found on INFOSEC.NAVY.MIL?

SIPRNET antivirus updates and VRAM link

How well did you know this?

Not at all

Perfectly

What can be found on WWW.CYBERCOM.SMIL.MIL?

INFOCON guidance and directives, CTO’s and CYBERCOM info

How well did you know this?

Not at all

Perfectly

What is an IAVA?

Information Assurance Vulnerability Alert

How well did you know this?

Not at all

Perfectly

What is an IAVB?

Information Assurance Vulnerability Bulletin

How well did you know this?

Not at all

Perfectly

What is an IAVT?

Information Assurance Vulnerability Technical Advisory

How well did you know this?

Not at all

Perfectly

What is a CTO?

Computer Tasking Order- Implements changes and dictates what can and cannot be done on networks

How well did you know this?

Not at all

Perfectly

What is the function of VRAM?

Assess and upload scans from scans from VRAM

How well did you know this?

Not at all

Perfectly

What is INFOCON?

The level of protection for information systems based on perceived or actual threats. Levels 1 (greatest) thru 5 (least).

How well did you know this?

Not at all

Perfectly

NNWC

Naval Network Warfare Command. NETWARCOM Operations.

How well did you know this?

Not at all

Perfectly

USCYBERCOM

Overall boss for anything cyber related. Phase 3 assessments.

How well did you know this?

Not at all

Perfectly

USSTRATCOM

strategic operations. may impact cyber readiness.

How well did you know this?

Not at all

Perfectly

NSA

all SIGINT operations. NSA/CSS threat operations center.

How well did you know this?

Not at all

Perfectly

NCDOC

ISP and CND provider for the Navy

How well did you know this?

Not at all

Perfectly

ACERT

Army Cyber Emergency Readiness Team

How well did you know this?

Not at all

Perfectly

AFCERT

Air Force Cyber Emergency Readiness Team

How well did you know this?

Not at all

Perfectly

NCIS

Investigates cybercrimes for the Navy

How well did you know this?

Not at all

Perfectly

MCNOSC

Marine Corp NCDOC

How well did you know this?

Not at all

Perfectly

USCYBERFOR

Tenant Command of 10th Fleet. Phase 2 Assessments.

10th Fleet

Navy Element of CYBERCOM. Does inspections.

Who is authorized to make changes to NON_POR equipment?

Ship's IT's

Who is authorized to modify POR equipment?

Only the programmer

What is the difference between Stage II and Stage III?

Stage II is completed by CYBERFOR. There is an assist and train report after assessment. Stage III is completed by CYBERCOM and is the final score.

Why do assessment laptops require their own OU in ADUC? What happens if this is not done correctly?

Blocks inheritance and prevents Compose from pushing data to the laptop

What is DNS traffic logging and why is it important during data analysis?

Shows possible beaconing to where and how often

What is port security? How does this affect Blue Team assessments?

Where a switch port is assigned to a specific MAC address or computer. If port security is on, the Blue Team laptop will not be able to connect to the ships domain.

Explain the relationship between the UNIX virtual machine and the windows host:

VM runs from Windows OS and allows for NMAP and Darkether scans. All collected data is held on windows C:/ drive

How do you enable the shared folder on the VM?

In VM -- VM settings -- options -- advanced options -- select always enable -- select the folder -- APPLY

What script is used to collect infrastructure device configurations?

Darkether_local

What script is used to organize all XML output files into Multi Verse upload folder?

Darkether_run

What is the purpose of NIPPER?

A tool to check configurations in Cisco IOS for vulnerabilities.

What command line is used to shutdown/restart a machine?

INIT 0 and INIT 6

What is Compose and how does it integrate with Windows and Active Directory?

SPAWAR specific software installed on top of windows

What does SQL stand for?

Structured Query Language

What is MySQL?

free program that interfaces with SQL databases

What is MSSQL?

program used by HBSS. Made by Microsoft.

What are the default security groups?

administrators, domain administrators, enterprise administrators, remote desktop users, and schema admins

What is the purpose of the "host diagnostics" scan and what is it composed of?

Used to see which hosts in active directory are live. Remote registry, ping, DNS resolve, WMI, and admin shares.

What is the difference between a Scan and a Payload?

Scan- network intensive, done with constant contact with host. Payload- sent to a host, collects all requested data, then sends the information back to the requester.

What are the important files created by the "NMAP_SCAN2.PL" scan?

XML port scans, device info, OS info

What is XREF?

Cross reference file

What is MULTIVERSE.JAR?

Java executable to launch multiverse

What is an XCCDF file?

STIG data and checks baseline security for compliance

Explain Windows user account scan?

Check for local user accounts on a windows host

Explain virus definitions scan?

Checks to see if the most recent virus definitions are installed

Explain windows software scan?

Checks which version of windows is installed

Explain RECENTITEMS scan?

Checks recent items directory on a windows host

What is Event Logs Plus?

Checks for event logs

Explain Windows running process scan?

Checks all running processes on a windows host

What is autorun enforcer?

Checks to see if auto runs are disabled

Explain Autoruns payload:

Checks if host automatically runs devices or programs

Explain XCCDF payload:

STIG checks and XREF scan

Explain computer identification payload:

Collects host name and OS version

Explain REGRAIDER payload:

Parses registry and collects specific registry keys

Explain file audit plus payload:

Collects files with specific extensions

Explain SNARF payload:

Collects MD5 hash values of files and checks for known goods

Explain wireless connections payloads:

checks a host for enabled wireless devices

Explain Handle payload:

collects handler information

Explain REGDUMP payload:

Collects a hosts registry

Explain LOGON status payload:

Checks current logons

Explain open ports plus:

Checks open ports on a host and processes

What payloads have to be executed in order to execute the cross-reference script?

CPE Name and XCCDF

What is the Navy Blue Team Report composed of?

Ships Info, Team Member, Team Member contact info, score, violations, findings, mitigations, supporting documents, and comments

What is Pythagoras?

The scoring criteria for blue team assessments

What is the difference between a finding and a poor security practice?

FINDING- violated a CTO or instruction | POOR SECURITY PRACTICE- doesn't violate any CTO or instruction but could be harmful to the network

What is SNARF?

Scan Network And Report Findings. Only scans system root and C: FOR HASHES. Looks for malicious software. References "knowns". Exe's and DLL's only.

General NBT Flashcards

(72 cards)