OPS Flashcards
1
Q
Microphones, vibrations sensors
A
Acoustical Detection
2
Q
Relevant, sufficient, reliable, does not have to be tangible
A
Admissible Evidence
3
Q
The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks
A
Alarm filtering
4
Q
A signal suggesting a system has been or is being attacked.
A
Alert/Alarm
5
Q
Systematic assessment of threats and vulnerabilities that provides a basis for effective management of risk.
A
Analysis
6
Q
When resolving a single failure (though system administrators are needed to resolve additional failures
A
Automatic Recovery
7
Q
Higher level of recovery defining prevention against the undue loss of protected objects
A
Automatic Recovery Without Undo Loss
8
Q
Alarm to local fire or police
A
Auxiliary Station Systems
9
Q
Tape: sequential, slow read, fast write 200GB an hour, historically
cheaper than disk (now changing), robotic libraries
Disk: fast read/write, less robust than tape
Optical drive: CD/DVD. Inexpensive
Solid state: USB drive, security issues, protected by AES
A
Backup Storage Media
10
Q
Primary: used at the trial because it is the most reliable.
Original documents are used to document things such as contracts
A
Best Evidence
11
Q
Placeholders for literal values in SQL query being sent to the database on a server; Used to enhance performance of a database
A
Bind Variables
12
Q
Focus on illegally obtaining an organization’s confidential information. The use of the information gathered usually causes more damage than the initial event itself.
A
Business Attacks
13
Q
Less than 10mins travel time for e.g. an private security firm
A
Central Stations
14
Q
Collection, analysis and preservation of data
Forensics uses bit-level copy of the disk
A
Chain of Custody
15
Q
Maintaining full control over requests, implementation, traceability, and proper documentation of changes.
A
Change Control
16
Q
Electrical
A
Cipher Lock
17
Q
Used to help assume another fact
Cannot stand on its own to directly prove a fact
A
Circumstantial Evidence
18
Q
Europe, South America
A
Civil Law
19
Q
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification.
A
Classification
20
Q
organization way of classifying data by factors such as criticality, sensitivity and ownership.
A
Classification Scheme
21
Q
Overwriting media to be reused
A
Clearing
22
Q
3 digits with wheels
A
Combination Lock
23
Q
USA, UK Australia Canada (judges)
A
Common Law
24
Q
3 types of harm:
unauthorized intrusion
unauthorized alteration or destruction
malicious code
A
Computer Crime Laws
25
Irrefutable, cannot be contradicted
Requires no other corroboration
Conclusive Evidence
26
A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack
Confidence value
27
Collection of component CI’s that make another CI
Configuration
28
Component whose state is recorded
Configuration item (CI)
29
Mitigate damage by isolating compromised systems from the network.
Containment
30
Supports or substantiates other evidence presented in a case
Corroborative Evidence
31
Unused network space that may detect unauthorized activity
Darknet
32
Individuals and departments responsible for the storage and safeguarding of computerized data.
Data Custodian
33
A database that contains the name, type, range of values, source and authorization for access for each data element
Data Dictionary
34
Is a country or location that has no laws or poorly enforced laws
Data Haven
35
The property that data meet with a priority expectation of quality and that the data can be relied upon.
Data Integrity
36
Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes.
Data Leakage
37
Systems attempt to detect and block exfiltration attempts. These systems have the capability of scanning for keywords and patterns.
Data Loss Prevention (DLP)
38
Individuals, normally managers or directors, who have responsibility for the integrity, accurate reporting and use of computerized data.
Data Owner
39
Real-time data backup ( Data Mirroring)
Database Shadowing
40
External communications
Debriefing / Feedback
41
Protection of stored or displayed information by removal/reduction of the magnetic field (demagnetization).
Degauss
42
Identification and notification of an unauthorized and/or undesired action
Detection
43
Bolt down hardware
Device Lock
44
Only modified files, doesn’t clear archive bit. Advantage: full and only last one needed, Intermediate time between.
Differential backup
45
Can prove fact by itself and does not need any type of backup.
Testimony from a witness; one of their 5 senses.
Oral: case can’t stand on it alone
Oral: does not need other evidence to substantiate
Direct Evidence
46
Senses a break or change in a circuit magnets pulled lose, wires door, pressure pads
Electromechanical Detection
47
Periodic, automatic and transparent backup of data in bulk.
Electronic Vaulting
48
Occurs after a failure happens in an uncontrolled manner. E.g. when a low privileged user tries to access restricted memory segments
Emergency Restart Failure
49
Can scan files stored on a system as well as files sent to external devices, such as printers. For example, an organization ? can prevent users from copying sensitive data to USB flash drives or sending sensitive data to a printer.
Endpoint-based DLP
50
The legal action of luring an intruder, like in a honeypot
Enticement
51
Refers to the amount of privileges granted to users, typically when first provisioning an account. A user audit can detect when employees have excessive privileges
Entitlement
52
The illegal act of inducing a crime; the individual had no intent of committing the crime at first
Entrapment
53
Malicious act of gathering proprietary, secret, private, sensitive, or confidential information about an organization.
Espionage
Often with the intent of disclosing or selling the information to a competitor or other interested organization (such as a foreign government). Attackers can be dissatisfied employees, and in some cases, employees who are being blackmailed from someone outside the organization. Countermeasures are to strictly control access to all nonpublic data, thoroughly screen new employee candidates, and efficiently track all employee activities.
54
Must be preserved and identifiable
Evidence
Sufficient –persuasive enough to convince one of its validity
Reliable –consistent with fact, evidence has not been tampered with or modified
Relevant –relationship to the findings must be reasonable and sensible, Proof of crime, documentation of events, proof of acts and methods used, motive proof, identification of acts
Permissible – lawful obtaining of evidence, avoid: unlawful search and seizure, secret recording, privacy violations, forced confessions, unlawful obtaining of evidence
Preserved and identifiable – collection, reconstruction
Identification labeling, recording serial number etc.
Evidence must be preserved and identifiable
55
1. Discovery
2. Protection
3. Recording
4. Collection and identification
5. Analysis
6. Storage, preservation, transportation
7. Present in court
8. Return to owner
Evidence Lifecycle
56
Allows officials to seize evidence before it's destroyed (police team fall in)
Exigent Circumstances
57
Most conservative from a security perspective
Fail Closed/Secure
58
Program execution is terminated and system protected from hardware or software compromise occurs DOORS usually
Fail safe system
59
Or resilient system: reboot, selected, non-critical processing is terminated
Fail soft
60
Switches to hot backup
Failover
61
Backup critical information thus enabling data recovery
Failure Preparation
62
The event signaling an IDS to produce an alarm when no attack has taken place
False attack stimulus
63
A failure of an IDS to detect an actual attack
False negative
64
An alert or alarm that is triggered when no actual attack has taken place
False positive
65
Mitigation of system or component loss or interruption through use of backup capability.
Fault tolerance
66
Carried out to unlawfully obtain money or services.
Financial Attacks
67
All files, archive bit and modify bit are cleared. Advantage: only previous day needed for full restore, disadvantage: time consuming
Full Backup
68
System can restore functional processes automatically
Function Recovery
69
Carried out to damage an organization or a person. The damage could be in the loss of information or information processing capabilities or harm to the organization or a person’s reputation.
Grudge Attacks
70
Want to verify their skills as intruders
Hackers and Crackers
71
Often combine political motivations with the thrill of hacking.
Hacktivists
72
Review the contents. This may include a review of Personal computers & Smartphones
Hardware/ Embedded Device Analysis
73
Second-hand data not admissible in court
Hearsay
74
Something a witness hears another one say.
Business records and all that’s printed or displayed. Exception: audit trails and business records when the documents are created in the normal course of business.
Hearsay Evidence
75
Information that, if made public or even shared around the organization, could seriously impede the organization's operations
Highly Confidential
76
Monitors activity on a single computer, including process calls and information recorded in firewall logs. Often examines events in more detail than NIDS, can pinpoint specific files compromised in an attack. Can track processes employed by the attacker. A benefit over NIDSs is that it can detect anomalies on the host system.
Host-based IDS (HIDS)
77
Redundant component that provides failover capability in the event of failure or interruption of a primary component.
Hot Spares
78
Software component that manages the virtual components. Adds an additional attack surface, so it’s important to ensure it is deployed in a secure state and kept up-to-date with patches, controls access to physical resources
Hypervisor
79
Event or series of events that adversely impact the ability of an organization to do business; suspected attack
Incident
80
A documented battle plan for coordinating response to incidents.
Incident handling
81
Incident response process
Detect
Respond
Report
Recover
Remediate
Review
82
Only modified files, archive bit cleared, Advantage: least time and space, Disadvantage: first restore full then all incremental backups, thus less reliable because it depends on more components
Incremental Backup
83
loss would inconvenience the organization but disclosure is unlikely to result in financial loss or serious damage to credibility.
Internal Use only
84
Evidence retrieval method, ultimately obtain a confession
Interrogation
85
Gather facts and determine the substance of the case.
Interviewing
86
Occurs when an attacker is able to bypass or thwart security mechanisms and gain access to an organization’s resources.
Intrusion
87
Monitors recorded information and real-time events to detect abnormal activity indicating a potential incident. Automates the inspection of logs and real-time events to find attempts and failures. An effective method of detecting many DoS and DDoS attacks. Can recognize attacks that come from external connections, such as from the Internet, and attacks that spread internally such as a malicious worm. Responds by sending alerts or raising alarms. In some cases can modify the environment to stop an attack.
A primary goal is to provide a means for a timely and accurate response to attacks. Intended as part of a defense-in-depth security plan. It will work with and compliment other security mechanisms but does not replace them.
Intrusion Detection System (IDS)
88
Includes all the capabilities of an IDS but can also take additional steps to stop or prevent intrusions. If desired, administrators can disable these extra features, essentially causing it to function as an IDS.
Intrusion Prevention System (IPS)
89
ME, Africa, Indonesia
Islamite and other Religious Laws
90
Most basic type of storage
When two drives or disks have a logical joining without redundacy
JBOD
91
Evenly distributed
Lighting Continuous
92
No bleeding over no blinding
Lighting Controlled
93
Against blinding
Lighting Glare Protection
94
IDS detects activities and turns on lightning
Lighting Responsive Areas Illumination
95
Timers
Lighting Standby
96
If no tampering is done with the alarm wires
Line Supervision Check
97
Audible at least 4000 feet
Local Alarms
98
every time you make contact with another it results in an exchange of materials for both physical and digital evidence.
Locard’s principle
99
Record of system activity, which provides for monitoring and detection.
Log
100
System administrator intervention is required to return the system to a secure state
Manual Recovery
101
A branch of computer forensic analysis. Involves the identification and extraction of information from storage. This may include the following: Magnetic (e.g., hard disks, tapes) Optical (e.g., CDs, DVDs, Blu-ray discs) Memory (e.g., RAM, solid state storage)
Techniques used may include the recovery of deleted files from unallocated sectors of the physical disk, the live connection to a computer system (especially useful when examining encrypted), and the static examination of forensic images of storage.
Media Analysis
102
Designed to extract secret information.
Military or Intelligence Attack
103
MOM
Means, Opportunity and Motive
Used in determining suspects
104
Continuous surveillance, to provide for detection and response of any failure in preventive controls.
Monitor
105
wave pattern movement sensors
Motion Detector
106
MTBF
Mean Time Between Failures (Useful Life) = MTTF + MTTR
Mean Time To Failure
Mean Time To Recover
107
Often depends on either prior knowledge that an incident is underway or the use of preexisting security controls that log activity. These include: Intrusion detection and prevention system logs, data captured by a flow monitoring system, Packet captures deliberately collected during an incident. Logs from firewalls and other security devices. Collect and correlate information from these disparate sources and produce as comprehensive a picture of activity as possible.
Network Analysis
108
Server optimized for providing file-based data storage to the network. Unlike a File Server, a ? unit has no input or output devices, and the OS is dedicated for providing storage services.
Network Attached Storage (NAS)
109
Scans all outgoing looking for specific variables. If a user sends out a restricted file, the system will detect it and prevent it from leaving the organization. Sends an alert, such as an email to an administrator.
Network-based DLP
110
Monitors and evaluates network activity to detect attacks or event anomalies. Cannot monitor content of encrypted traffic but can monitor other packet details. Just one can monitor a large network by using remote sensors to collect data at key network locations that send data to a central management console.
Network-based IDS (NIDS)
111
Data or interference that can trigger a false positive
Noise
112
Most preferred in the legal investigation; pages are attached to a binding.
Notebook
113
Communication of a security incident to stakeholders and data owners.
Notification
114
Utilization after initial use
Object Reuse
115
Requires witnesses to testify only about the facts of the case; cannot be used as evidence in the case.
Opinion Rule
116
Involve relocating personnel to the alternate site and commencing operations there. Critical systems are run at an alternate site, main site open also
Parallel Tests
117
Through sensing changes in temperature
Passive Infrared Detection
118
Light beams interrupted (as in an store entrance)
Photoelectric Detector
119
A very cold site.
Prefabricated Building
120
Comes with door
Preset Lock
121
Controls deployed to avert unauthorized and/or undesired actions.
Prevention
122
Combination or electrical lock
Programmable Lock
123
Define the way in which the organization operates.
Proprietary
124
Owned and operated by the customer.
System provides many of the features in-house
Proprietary Systems
125
Customer view taken into account
Prototyping
126
Magnetic field shows presence around an object
Proximity or Capacitance Detector
127
False vulnerability in a system that may attract an attacker
Pseudo Flaw
128
Degaussing or overwriting to be removed
Purging
129
RAID Levels
RAID 0 Striped, one large disk out of several. Improved performance but no fault tolerance
RAID 1 Mirrored drives: fault tolerance from disk errors and single disk failure, expensive; redundancy only, not speed
RAID 2 not used commercially. Hammering Code Parity/error
RAID 3 Striped on byte level with extra parity drive. Improved performance and fault tolerance, but parity drive is a single point of failure and write intensive. 3 or more drives
RAID 4 Same as Raid 3 but striped on block level; 3 or more drives
RAID 5 Striped on block level, parity distributed over all drives. Requires all drives but one to be present to operate hot. Swappable. Interleave parity, recovery control; 3 or more drives
RAID 6 Dual Parity; parity distributed over all drives. Requires all drives but two to be present to operate hot. Swappable.
RAID 7 Same as raid 5 but all drives act as one single virtual disk
130
Circumvent a pin tumbler lock
Raking
131
Measures followed to restore critical functions following a security incident.
Recovery
132
A group of hard drives working as one storage unit for the purpose of speed and fault tolerance
Redundant Array of Independent Drives (RAID)
133
Use of a backup server(s) to protect information and essential processes in the event of a primary system failure.
Redundant Servers
134
Potentially retrievable data residue that remains following intended erasure of data.
Remanence
135
Real-time, automatic and transparent backup of data.
Remote Journaling
136
Policy, procedures, a team
Response Capability
137
Criminal act of destruction or disruption committed against an organization by an employee. It can become a risk if an employee is knowledgeable enough about the assets of an organization, has sufficient access to manipulate critical aspects of the environment, and has become disgruntled.
Sabotage
138
Goes back to the primary site to normal processing environmental conditions. Clean, repair, save what can be saved. Can declare when primary site is available again
Salvage Team
139
Attackers who lack the ability to devise their own attacks will often download programs that do their work for them. The main motivation behind these attacks is the “high” of successfully breaking into a system. Service interruption. An attacker may destroy data, the main motivation is to compromise a system and perhaps use it to launch an attack against another victim. Website defacements common
Script Kiddies
140
Copies of documents. Not as strong as best. A copy is not permitted if the original (Best) is available. Oral like Witness testimony
Secondary Evidence
141
Group of independent servers which are managed as a single system. All servers are online and take part in processing service requests.
All share the same OS and application software vs. grid devices that can have different OSs while still working on same problem.
Server Clustering
142
Guidelines within an organization that control the rules and configurations of an IDS
Site policy
143
The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity
Site policy awareness
144
Conduct forensic reviews of applications or the activity that takes place within a running application. In some cases, conduct a review of software code, looking for back doors, logic bombs, or other security vulnerabilities. In other cases, review and interpret the log files from application or database servers, seeking other signs of malicious activity, such as SQL injection attacks, privilege escalations, or other application attacks.
Software Analysis
145
Controlled area only accessible for approved users
Software Library
146
A subnetwork with storage devices servicing all servers on the attached network.
Storage Area Network (SAN)
147
Third party, commercial services provide alternate backups and processing facilities. Most common of implementations!
Subscription Services
148
When an unexpected kernel or media failure happens and the regular recovery procedure
System Cold Start Failure
149
System shuts itself down in a controlled manner after detecting inconsistent data structures or runs out of resources
System Reboot Failure
150
System Recovery
1. Rebooting system in single user mode or recovery console, so no user access is enabled
2. Recovering all file systems that were active during failure
3. Restoring missing or damaged files
4. Recovering the required security characteristic, such as file security labels
5. CheckingSystem Recovery
151
Purpose of a ? is to disrupt normal life and instill fear
Terrorist Attacks
152
Launched only for the fun of it. Pride, bragging rights
Thrill Attacks
153
Highly sensitive internal documents that could seriously damage the organization if such information were lost or made public
Top Secret
154
An event that triggers an IDS to produce an alarm and react as though a real attack were in progress
True attack stimulus
155
Ensures that the security is not breached when a system crash or failure occurs. Only required for a B3 and A1 level systems.
Trusted Recovery
156
Cylinder slot
Tumbler Lock
157
- Operational
- Criminal
- Civil
- eDiscovery
Types of Investigation
158
Legislative: writes (statutory laws)
Executive: enforces (administrative laws)
Juridical: interprets laws (makes common laws out of court decisions)
US Law: 3 Branches
159
Criminal: individuals in violation; punishment mostly imprisonment
Civil: wrongs against individual or organization that result in a damage or loss. Punishment can include financial penalties. AKA tort (I’ll Sue You!) Jury decides liability
Administrative/Regulatory: – how industries, organizations and officers have to act. Wrongs can be penalized with imprisonment or financial penalties
US Law: 3 Categories
160
Why certain people fall prey to crime and how lifestyle affects their chances
Victimology
161
Hanging, with a key
Warded Lock
162
Raid 6
Does not require a hot spare drive or disk
163
piracy act of copying software from top notch brands and distributing over the Internet
warez
164
colocation cloud
Colocation cloud combines the benefits of colocation and cloud computing to provide a comprehensive solution that addresses the limitations of traditional data management approaches.
165
blue team
defends from attacks
166
red team
attacks
167
white team
handles security incidents
