Primary Definitions 23.0-27.0 Flashcards
(56 cards)
Incident Response Process
Outlines a structured approach to manage and mitigate security incidents effectively.
Incident
Act of violating an explicit or implied security policy.
The 7 Phases of Incident Response
Preparation, Detection, Analysis, Containment, Eradication, Recovery, and Lessons Learned.
Root cause analysis
Identifies incident source and how to prevent it in the future.
Lessons learned process
Documents experiences during incident in formalized way.
After-action report
Collects formalized information about what occurred.
Threat Hunting
Cybersecurity method for finding hidden threats not caught by regular security monitoring.
Advisories and Bulletins
Published by vendors and security researchers when new TTPs and vulnerabilities are discovered.
Digital Forensic
Process of investigating and analyzing digital devices and data to uncover evidence for legal purposes.
Order of Volatility
Dictates the sequence in which data sources should be collected and preserved based on their susceptibility to modification or loss.
Chain of Custody
Documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law.
Disk Imaging
Involves creating a bit-by-bit or logical copy of a storage device, preserving its entire content, including deleted files and unallocated space.
File Carving
Focuses on extracting files and data fragments from storage media without relying on the file system.
Legal Hold
Formal notification that instructs employees to preserve all potentially relevant electronic data, documents, and records.
Electronic Discovery
Process of identifying, collecting, and producing electronically stored information during potential legal proceedings.
4 Procedures of Digital Forensics
Identification, Collection, Analysis, and Reporting.
5 Steps of the Order of Volatility
- Collect data from the system’s memory
- Capture data from the system state
- Collect data from storage devices
- Capture network traffic and logs
- Collect remotely stored or archived data
Data Acquisition
The method and tools used to create a forensically sound copy of the data from a source device, such as system memory or a hard disk.
6 Steps of Data Acquisition
- CPU registers and cache memory
- RAM, routing tables, ARP caches, process table, temporary swap files
- Data on persistent mass storage (HDD, SSD, Flash Drive)
- Remote logging and monitoring data
- Physical configuration and network topology
- Archival media
Log File
A file that records either events that occur in an operating system or other software that runs, or messages between different users of a communication software.
Syslog/Rsyslog/Syslog-ng
Variations of syslog which all permit the logging of data from different types of systems in a central repository.
Journalctl
Linux command line utility used for querying and displaying logs from the journald (journal daemon), which is responsible for managing and storing log data on a Linux machine.
NXLog
A multi-platform log management tool that helps to easily identify security risks, policy breaches, or analyze operational problems.
Sampled Flow (SFlow)
Provides a means for exporting truncated packets, together with interface counters for the purpose of network monitoring.
