Key Concepts 7.2 Conduct logging and monitoring activities

Question 1

are a method used in event monitoring where only events surpassing a set threshold (the clipping level) trigger an alert or action are collected.

Answer 1

clipping levels

Question 2

focuses on catching specific, significant events, rather
than about getting a representative sample of all data

Answer 2

nonstatisical sampling

Question 3

tools monitor network traffic and system activities for signs of malicious activity and can
take automated actions to prevent or mitigate attacks.

Answer 3

Intrusion detection and prevention system (IDPS)

Question 4

monitors traffic for any anomalies or changes when compared to
a baseline of what is considered normal. Creation of this baseline will generally take a
period of days or weeks of data collection and analysis by the system. Also called behavior-based or heuristics-based. Can be effective in identifying zero-day threats.

Answer 4

Anomaly-based IDPS

Question 5

uses pattern-based detection, leveraging a collection/database
of signatures for known attacks. Also called knowledge-based
or pattern-based. Can only detect known threat for which a signature has been generated

Answer 5

Signature-based

Question 6

attack exploits a previously unknown software vulnerability before a patch is available.

Answer 6

Zero Day Exploit

Question 7

tools collect, aggregate,
and analyze log data from various sources to provide a centralized view of an organization’s
security posture.

Answer 7

Security information and event management (SIEM)

Question 8

• Log centralization and aggregation. SIEM platforms can gather logs from operating
  systems, applications, network appliances, user workstations, etc., providing a single
  location to support investigations. This is often referred to as forwarding logs when
  looked at from the perspective of individual hosts sending log files to the SIEM.
• Data normalization. SIEMs can normalize incoming data to ensure that the data from a
  variety of sources is presented in a consistent format, allowing diverse data sources to be
  searched in a single query.
• Data integrity. The SIEM Will generally be on a separate host be on a separate host
  or cloud platform with access permissions unique from the rest of the environment,
  preventing data tampering or unauthorized changes.
• Automated or continuous monitoring. Sometimes referred to as correlation, SIEMs use
  algorithms to evaluate data and identify potential attacks or compromises.
• Alerting. SIEMs can automatically generate alerts such as emails or tickets when action
  is required based on analysis of incoming log data
• Manual investigation. When manual investigation is required, a SIEM will generally
  provide support capabilities such as querying log files, generating reports.

Answer 8

Common features of SIEM solutions

Question 9

1. Collect log data from sources
2. Aggregate and normalize data
3. Discover and detect threats
4. Investigate alerts, raise incidents

Answer 9

SIEM and SOAR Process Flow

Question 10

• Log collection. Configuring the SIEM solution to collect and normalize log data from
  relevant sources, such as identity platforms, servers, network devices, and security tools
• Rule configuration. Defining correlation rules and alerts to detect potential security
  incidents and anomalies. Many SIEM solutions come with preconfigure rules, but also the
  capability to configure custom rules for alerting and detection.
• Tuning and optimization. Conducting regular SIEM tuning and optimization to ensure
  effective detection and response, minimizing false positive detections.
• Integration. Integrating SIEM with other security tools and processes, such as threat
  intelligence feeds/platforms, IDPS, and incident response automation (e.g., SOAR).

Answer 10

Key activities in SIEM setup and configuration

Question 11

is a set of technologies and
processes designed to streamline and enhance an organization’s security operations. focuses on incident response automation, automating the process of detecting, triaging, and
responding to security incidents.

Answer 11

Security Orchestration, Automation, and Response (SOAR)

Question 12

are documents or checklists that defines the process for verifying and responding
to a specific type of security incident. It serves as a guide for security analysts
and provides a standardized approach to incident handling.

Answer 12

Playbooks

Question 13

are the implementation of a playbook’s data and processes into an automated
tool within the SOAR platform. It translates the manual steps outlined in a playbook into a
series of automated actions and workflows.

Answer 13

Runbooks

Question 14

involve the ongoing assessment and adjustment of security controls
and processes to ensure their effectiveness and alignment with changing risks and requirements.
Important aspects include:
* Measurement. Establishing metrics and key performance indicators (KPIs) to measure
the effectiveness, such as number of false positives and true positives.
* Maintenance. Regularly reviewing and analyzing monitoring data to identify trends,
anomalies, and improvement opportunities.
* Assessment. Conducting periodic assessments and audits to validate the effectiveness of
security controls and processes
* Improvement. Implementing a continuous improvement process to address identified
gaps and enhance security posture.

Answer 14

Monitoring and tuning

Question 15

involves the monitoring and control of outbound network traffic to detect and prevent unauthorized data exfiltration and other malicious activities, such as command and control.
Key considerations in monitoring include:
* Implementing egress filtering and monitoring controls, such as firewalls, data loss
prevention (DLP), and web proxies.
* Defining policies and rules to detect and block unauthorized data transfers (data
exfiltration) and communications (with known malicious IPs, etc.).
* Regularly reviewing and analyzing egress monitoring logs and alerts to identify potential
incidents and anomalies.
* Integrating threat intelligence into firewalls (where supported, such as with an NGFW)
will be useful in identifying traffic to potentially malicious external hosts.
* Integrating egress monitoring with other security tools and processes, such as SIEM and
SOAR.

Answer 15

Egress monitoring

Question 16

involves the collection, storage, and analysis of log data from various
sources to support security monitoring, incident response, and compliance. Important aspects
include:
* Aggregation and collection. Establishing a centralized log management infrastructure
to collect and store log data from relevant sources, such as in a SIEM (covered in “7.2.2
Security information and event management (SIEM)”).
* Retention. Implementing log retention and archival policies to ensure the availability and
integrity of log data, which will be of elevated importance for organizations in regulated
industries.
* Integrity. Secure storage of logs is always important. In retention scenarios, storing logs
in an immutable (unchangeable) format is often desirable.
* Confidentiality. Ensuring the security and confidentiality of log data through access
controls, encryption, and other measures.

Answer 16

Log management

Question 17

involves the collection, analysis, and sharing of information about current and emerging threats to support proactive defense and incident response

Answer 17

Threat intelligence

Question 18

It is a continuous stream of data about potential cyber threats. This data is collected from
various sources and formatted to provide security professionals with actionable intelligence.
Think of it like a real-time news feed, but instead of news articles, it delivers updates on the
latest cyber threats

Answer 18

threat intelligence feed (threat feed)

Question 19

It varies by provider, but can include indicators of compromise (IoCs), threat actor information,
and emerging threats.

Answer 19

threat feed

Question 20

A Cybersecurity and Infrastructure Security Agency
(CISA) capability, enables the real-time exchange of machine-readable cyber threat
indicators and defensive measures. It’s provided free to help protect participants of the community and ultimately reduce the prevalence of cyberattacks

Answer 20

Automated Indicator Sharing (AIS).

Question 21

defines how real-time cyber threat
information can be shared via services and message exchanges. “how” STIX formatted messages are
securely transferred between systems.

Answer 21

Trusted Automated eXchange of Intelligence Information (TAXII)

Question 22

Defines a common language for
expressing cyber threat information. defines “what” is shared

Answer 22

Structured Threat Information eXpression (STIX)

Question 23

is a proactive cybersecurity practice where security professionals actively
search for hidden threats or malicious activities within an organization’s network or systems.
It involves using knowledge and tools to analyze data for suspicious patterns, operating
continuously rather than reactively. It is an evidence-based approach aims to uncover threats
that evade standard security measures, thereby enhancing overall defensive capabilities and
response times.

Answer 23

Threat hunting

Question 24

is a model used in cybersecurity to describe the stages of a cyberattack. Its purpose is to help security professionals understand and defend against complex cyber
threats by breaking down the attack process into distinct phases.

Answer 24

Cyber Kill Chain

Question 25

1. Reconnaissance: The attacker gathers information about the target, such as network structure, potential vulnerabilities, and employee details. 2. Weaponization: The attacker creates a malicious payload, often combining an exploit with a backdoor, to be delivered to the target. 3. Delivery: The weaponized payload is transmitted to the target, commonly via email attachments, websites, or USB drives. Domain 7 - Security Operations 369 4. Exploitation: The malicious payload is triggered, exploiting a vulnerability in the target system to execute code. 5. Installation: The attacker’s malware is installed on the target system, establishing a persistent presence. 6. Command and Control (C2): A command channel is established, allowing the attacker to remotely control the compromised system. 7. Actions on Objectives: The attacker carries out their intended goals, such as data exfiltration, system damage, or further network penetration

Answer 25

Lockheed Martin Cyber Kill Chain

Question 26

* Improved threat intelligence to counter reconnaissance * Email filtering and user training to prevent delivery * Regular patching to reduce exploitation risks * Network segmentation to limit installation and C2 communication * Monitoring and incident response to detect and mitigate actions on objectives

Answer 26

How the kill chain helps organizations improve their security posture

Question 27

is a publicly accessible knowledge base that describes common adversary tactics, techniques, and procedures (TTPs) used in cyberattacks. It provides a structured framework that catalogs cyber adversary tactics and techniques, aiding organizations in anticipating, detecting, and countering cyber threats by providing a common language and model for understanding and defending against cyberattacks. Its primary purpose is to provide a common language for describing and understanding attacker behavior, allowing organizations to evaluate their security posture and improve their defense strategies against known attack patterns.

Answer 27

MITRE ATT&CK Matrix

Question 28

is an advanced cybersecurity approach that uses machine learning and statistical analysis to detect anomalies in user and entity behavior within an organization’s network. Here’s

Answer 28

User and Entity Behavior Analytics (UEBA)

Question 29

* Data collection:UEBA systems gather and analyze data from various sources, such as application logs, user activity logs, access control systems, and endpoint devices. * Baseline establishment: The system analyzes historical data to create a baseline of normal behavior for users and entities (e.g., devices, applications, servers). The time to establish this baseline of “normal” will vary, but often takes two or three weeks. * Continuous monitoring: UEBA continuously monitors current activity and compares it to the established baselines. * Anomaly detection: Using machine learning algorithms, UEBA identifies deviations from normal behavior patterns. * Risk scoring: Detected anomalies are assigned risk scores based on their severity and potential impact. * Alert generation: High-risk anomalies trigger alerts for security teams to investigate.

Answer 29

How UEBA works

Question 30

Insider threat detection: Identifying unusual user behavior that may indicate malicious intent or compromised accounts. * Privileged account abuse: Monitoring activities of users with high-level access rights to detect misuse. * Data exfiltration: Detecting unusual data transfer patterns that could signify unauthorized data removal. * Account compromise: Identifying signs of stolen credentials or account takeovers. * Lateral movement: Detecting attempts by attackers to move laterally within the network. * Policy violations: Identifying users who violate security policies or access restricted resources. * Advanced Persistent Threats (APTs): Uncovering subtle, long-term attack campaigns that might otherwise go unnoticed.

Answer 30

Common Use cases for UEBA