Security Operations (OPS) Flashcards
1
Q
Acoustical Detection
A
Microphones, vibrations sensors
2
Q
Admissible Evidence
A
Relevant, sufficient, reliable, does not have to be tangible
3
Q
Alarm filtering
A
The process of categorizing attack alerts produced from an IDS in order to distinguish false positives from actual attacks
4
Q
Alert/Alarm
A
A signal suggesting a system has been or is being attacked.
5
Q
Analysis
A
Systematic assessment of threats and vulnerabilities that provides a basis for effective management of risk.
6
Q
Automatic Recovery
A
When resolving a single failure (though system administrators are needed to resolve additional failures
7
Q
Automatic Recovery Without Undo Loss
A
Higher level of recovery defining prevention against the undue loss of protected objects
8
Q
Auxiliary Station Systems
A
Alarm to local fire or police
9
Q
Backup Storage Media
A
Tape: sequential, slow read, fast write 200GB an hour, historically
cheaper than disk (now changing), robotic libraries
Disk: fast read/write, less robust than tape
Optical drive: CD/DVD. Inexpensive
Solid state: USB drive, security issues, protected by AES
10
Q
Best Evidence
A
Primary: used at the trial because it is the most reliable.
Original documents are used to document things such as contracts
11
Q
Bind Variables
A
Placeholders for literal values in SQL query being sent to the database on a server; Used to enhance performance of a database
12
Q
Business Attacks
A
Focus on illegally obtaining an organization’s confidential information. The use of the information gathered usually causes more damage than the initial event itself.
13
Q
Central Stations
A
Less than 10mins travel time for e.g. an private security firm
14
Q
Chain of Custody
A
Collection, analysis and preservation of data
Forensics uses bit-level copy of the disk
15
Q
Change Control
A
Maintaining full control over requests, implementation, traceability, and proper documentation of changes.
16
Q
Cipher Lock
A
Electrical
17
Q
Circumstantial Evidence
A
Used to help assume another fact
Cannot stand on its own to directly prove a fact
18
Q
Civil Law
A
Europe, South America
19
Q
Classification
A
The assignment of a level of sensitivity to data (or information) that results in the specification of controls for each level of classification.
20
Q
Classification Scheme
A
organization way of classifying data by factors such as criticality, sensitivity and ownership.
21
Q
Clearing
A
Overwriting media to be reused
22
Q
Combination Lock
A
3 digits with wheels
23
Q
Common Law
A
USA, UK Australia Canada (judges)
24
Q
Computer Crime Laws
A
3 types of harm:
unauthorized intrusion
unauthorized alteration or destruction
malicious code
25
Conclusive Evidence
Irrefutable, cannot be contradicted
Requires no other corraboration
26
Confidence value
A value an organization places on an IDS based on past performance and analysis to help determine its ability to effectively identify an attack
27
Configuration
Collection of component CI’s that make another CI
28
Configuration item (CI)
Component whose state is recorded
29
Containment
Mitigate damage by isolating compromised systems from the network.
30
Corroborative Evidence
Supports or substantiates other evidence presented in a case
31
Darknet
Unused network space that may detect unauthorized activity
32
Data Custodian
Individuals and departments responsible for the storage and safeguarding of computerized data.
33
Data Dictionary
A database that contains the name, type, range of values, source and authorization for access for each data element
34
Data Haven
Is a country or location that has no laws or poorly enforced laws
35
Data Integrity
The property that data meet with a priority expectation of quality and that the data can be relied upon.
36
Data Leakage
Siphoning out or leaking information by dumping computer files or stealing computer reports and tapes.
37
Data Loss Prevention (DLP)
Systems attempt to detect and block exfiltration attempts. These systems have the capability of scanning for keywords and patterns.
38
Data Owner
Individuals, normally managers or directors, who have responsibility for the integrity, accurate reporting and use of computerized data.
39
Database Shadowing
Real-time data backup ( Data Mirroring)
40
Debriefing / Feedback
External communications
41
Degauss
Protection of stored or displayed information by removal/reduction of the magnetic field (demagnetization).
42
Detection
Identification and notification of an unauthorized and/or undesired action
43
Device Lock
Bolt down hardware
44
Differential backup
Only modified files, doesn’t clear archive bit. Advantage: full and only last one needed, Intermediate time between.
45
Direct Evidence
Can prove fact by itself and does not need any type of backup.
Testimony from a witness; one of their 5 senses.
Oral: case can’t stand on it alone
Oral: does not need other evidence to substantiate
46
Electromechanical Detection
Senses a break or change in a circuit magnets pulled lose, wires door, pressure pads
47
Electronic Vaulting
Periodic, automatic and transparent backup of data in bulk.
48
Emergency Restart Failure
Occurs after a failure happens in an uncontrolled manner. E.g. when a low privileged user tries to access restricted memory segments
49
Endpoint-based DLP
Can scan files stored on a system as well as files sent to external devices, such as printers. For example, an organization endpoint-based DLP can prevent users from copying sensitive data to USB flash drives or sending sensitive data to a printer.
50
Enticement
The legal action of luring an intruder, like in a honeypot
51
Entitlement
Refers to the amount of privileges granted to users, typically when first provisioning an account. A user audit can detect when employees have excessive privileges
52
Entrapment
The illegal act of inducing a crime; the individual had no intent of committing the crime at first
53
Espionage
Malicious act of gathering proprietary, secret, private, sensitive, or confidential information about an organization. Often with the intent of disclosing or selling the information to a competitor or other interested organization (such as a foreign government). Attackers can be dissatisfied employees, and in some cases, employees who are being blackmailed from someone outside the organization. Countermeasures are to strictly control access to all nonpublic data, thoroughly screen new employee candidates, and efficiently track all employee activities.
54
Evidence
Must be preserved and identifiable
Sufficient –persuasive enough to convince one of its validity
Reliable –consistent with fact, evidence has not been tampered with or modified
Relevant –relationship to the findings must be reasonable and sensible, Proof of crime, documentation of events, proof of acts and methods used, motive proof, identification of acts
Permissible – lawful obtaining of evidence, avoid: unlawful search and seizure, secret recording, privacy violations, forced confessions, unlawful obtaining of evidence
Preserved and identifiable – collection, reconstruction
Identification labeling, recording serial number etc.
Evidence must be preserved and identifiable
55
Evidence Lifecycle
1. Discovery
2. Protection
3. Recording
4. Collection and identification
5. Analysis
6. Storage, preservation, transportation
7. Present in court
8. Return to owner
56
Exigent Circumstances
Allows officials to seize evidence before it's destroyed (police team fall in)
57
Fail Closed/Secure
Most conservative from a security perspective
58
Fail safe system
Program execution is terminated and system protected from hardware or software compromise occurs DOORS usually
59
Fail soft
Or resilient system: reboot, selected, non-critical processing is terminated
60
Failover
Switches to hot backup
61
Failure Preparation
Backup critical information thus enabling data recovery
62
False attack stimulus
The event signaling an IDS to produce an alarm when no attack has taken place
63
False negative
A failure of an IDS to detect an actual attack
64
False positive
An alert or alarm that is triggered when no actual attack has taken place
65
Fault tolerance
Mitigation of system or component loss or interruption through use of backup capability.
66
Financial Attacks
Carried out to unlawfully obtain money or services.
67
Full Backup
All files, archive bit and modify bit are cleared. Advantage: only previous day needed for full restore, disadvantage: time consuming
68
Function Recovery
System can restore functional processes automatically
69
Grudge Attacks
Carried out to damage an organization or a person. The damage could be in the loss of information or information processing capabilities or harm to the organization or a person’s reputation.
70
Hackers and Crackers
Want to verify their skills as intruders
71
Hacktivists
Often combine political motivations with the thrill of hacking.
72
Hardware/ Embedded Device Analysis
Review the contents. This may include a review of Personal computers & Smartphones
73
Hearsay
Second-hand data not admissible in court
74
Hearsay Evidence
Something a witness hears another one say.
Business records and all that’s printed or displayed. Exception: audit trails and business records when the documents are created in the normal course of business.
75
Highly Confidential
Information that, if made public or even shared around the organization, could seriously impede the organization's operations
76
Host-based IDS (HIDS)
Monitors activity on a single computer, including process calls and information recorded in firewall logs. Often examines events in more detail than NIDS, can pinpoint specific files compromised in an attack. Can track processes employed by the attacker. A benefit over NIDSs is that it can detect anomalies on the host system.
77
Hot Spares
Redundant component that provides failover capability in the event of failure or interruption of a primary component.
78
Hypervisor
Software component that manages the virtual components. Adds an additional attack surface, so it’s important to ensure it is deployed in a secure state and kept up-to-date with patches, controls access to physical resources
79
Incident
Event or series of events that adversely impact the ability of an organization to do business; suspected attack
80
Incident handling
A documented battle plan for coordinating response to incidents.
81
Incident response process
Detect
Respond
Report
Recover
Remediate
Review
82
Incremental Backup
Only modified files, archive bit cleared, Advantage: least time and space, Disadvantage: first restore full then all incremental backups, thus less reliable because it depends on more components
83
Internal Use only
loss would inconvenience the organization but disclosure is unlikely to result in financial loss or serious damage to credibility.
84
Interrogation
Evidence retrieval method, ultimately obtain a confession
85
Interviewing
Gather facts and determine the substance of the case.
86
Intrusion
Occurs when an attacker is able to bypass or thwart security mechanisms and gain access to an organization’s resources.
87
Intrusion Detection System (IDS)
Monitors recorded information and real-time events to detect abnormal activity indicating a potential incident. Automates the inspection of logs and real-time events to find attempts and failures. An effective method of detecting many DoS and DDoS attacks. Can recognize attacks that come from external connections, such as from the Internet, and attacks that spread internally such as a malicious worm. Responds by sending alerts or raising alarms. In some cases can modify the environment to stop an attack.
A primary goal is to provide a means for a timely and accurate response to attacks. Intended as part of a defense-in-depth security plan. It will work with and compliment other security mechanisms but does not replace them.
88
Intrusion Prevention System (IPS)
Includes all the capabilities of an IDS but can also take additional steps to stop or prevent intrusions. If desired, administrators can disable these extra features, essentially causing it to function as an IDS.
89
Islamite and other Religious Laws
ME, Africa, Indonesia
90
JBOD
Most basic type of storage
91
Lighting Continuous
Evenly distributed
92
Lighting Controlled
No bleeding over no blinding
93
Lighting Glare Protection
Against blinding
94
Lighting Responsive Areas Illumination
IDS detects activities and turns on lightning
95
Lighting Standby
Timers
96
Line Supervision Check
If no tampering is done with the alarm wires
97
Local Alarms
Audible at least 4000 feet
98
Locard’s principle
every time you make contact with another it results in an exchange of materials for both physical and digital evidence.
99
Log
Record of system activity, which provides for monitoring and detection.
100
Manual Recovery
System administrator intervention is required to return the system to a secure state
101
Media Analysis
A branch of computer forensic analysis. Involves the identification and extraction of information from storage. This may include the following: Magnetic (e.g., hard disks, tapes) Optical (e.g., CDs, DVDs, Blu-ray discs) Memory (e.g., RAM, solid state storage)
Techniques used may include the recovery of deleted files from unallocated sectors of the physical disk, the live connection to a computer system (especially useful when examining encrypted), and the static examination of forensic images of storage.
102
Military or Intelligence Attack
Designed to extract secret information.
103
MOM
Means, Opportunity and Motive
Used in determining suspects
104
Monitor
Continuous surveillance, to provide for detection and response of any failure in preventive controls.
105
Motion Detector
wave pattern movement sensors
106
MTBF
Mean Time Between Failures (Useful Life) = MTTF + MTTR
107
Network Analysis
Often depends on either prior knowledge that an incident is underway or the use of preexisting security controls that log activity. These include: Intrusion detection and prevention system logs, data captured by a flow monitoring system, Packet captures deliberately collected during an incident. Logs from firewalls and other security devices. Collect and correlate information from these disparate sources and produce as comprehensive a picture of activity as possible.
108
Network Attached Storage (NAS)
Server optimized for providing file-based data storage to the network. Unlike a File Server, a NAS unit has no input or output devices, and the OS is dedicated for providing storage services.
109
Network-based DLP
Scans all outgoing looking for specific variables. If a user sends out a restricted file, the system will detect it and prevent it from leaving the organization. Sends an alert, such as an email to an administrator.
110
Network-based IDS (NIDS)
Monitors and evaluates network activity to detect attacks or event anomalies. Cannot monitor content of encrypted traffic but can monitor other packet details. Just one can monitor a large network by using remote sensors to collect data at key network locations that send data to a central management console.
111
Noise
Data or interference that can trigger a false positive
112
Notebook
Most preferred in the legal investigation; pages are attached to a binding.
113
Notification
Communication of a security incident to stakeholders and data owners.
114
Object Reuse
Utilization after initial use
115
Opinion Rule
Requires witnesses to testify only about the facts of the case; cannot be used as evidence in the case.
116
Parallel Tests
Involve relocating personnel to the alternate site and commencing operations there. Critical systems are run at an alternate site, main site open also
117
Passive Infrared Detection
Through sensing changes in temperature
118
Photoelectric Detector
Light beams interrupted (as in an store entrance)
119
Prefabricated Building
A very cold site.
120
Preset Lock
Comes with door
121
Prevention
Controls deployed to avert unauthorized and/or undesired actions.
122
Programmable Lock
Combination or electrical lock
123
Proprietary
Define the way in which the organization operates.
124
Proprietary Systems
Owned and operated by the customer.
System provides many of the features in-house
125
Prototyping
Customer view taken into account
126
Proximity or Capacitance Detector
Magnetic field shows presence around an object
127
Pseudo Flaw
False vulnerability in a system that may attract an attacker
128
Purging
Degaussing or overwriting to be removed
129
RAID Levels
RAID 0 Striped, one large disk out of several. Improved performance but no fault tolerance
RAID 1 Mirrored drives: fault tolerance from disk errors and single disk failure, expensive; redundancy only, not speed
RAID 2 not used commercially. Hammering Code Parity/error
RAID 3 Striped on byte level with extra parity drive. Improved performance and fault tolerance, but parity drive is a single point of failure and write intensive. 3 or more drives
RAID 4 Same as Raid 3 but striped on block level; 3 or more drives
RAID 5 Striped on block level, parity distributed over all drives. Requires all drives but one to be present to operate hot. Swappable. Interleave parity, recovery control; 3 or more drives
RAID 6 Dual Parity; parity distributed over all drives. Requires all drives but two to be present to operate hot. Swappable.
RAID 7 Same as raid 5 but all drives act as one single virtual disk
130
Raking
Circumvent a pin tumbler lock
131
Recovery
Measures followed to restore critical functions following a security incident.
132
Redundant Array of Independent Drives (RAID)
A group of hard drives working as one storage unit for the purpose of speed and fault tolerance
133
Redundant Servers
Use of a backup server(s) to protect information and essential processes in the event of a primary system failure.
134
Remanence
Potentially retrievable data residue that remains following intended erasure of data.
135
Remote Journaling
Real-time, automatic and transparent backup of data.
136
Response Capability
Policy, procedures, a team
137
Sabotage
Criminal act of destruction or disruption committed against an organization by an employee. It can become a risk if an employee is knowledgeable enough about the assets of an organization, has sufficient access to manipulate critical aspects of the environment, and has become disgruntled.
138
Salvage Team
Goes back to the primary site to normal processing environmental conditions. Clean, repair, save what can be saved. Can declare when primary site is available again
139
Script Kiddies
Attackers who lack the ability to devise their own attacks will often download programs that do their work for them. The main motivation behind these attacks is the “high” of successfully breaking into a system. Service interruption. An attacker may destroy data, the main motivation is to compromise a system and perhaps use it to launch an attack against another victim. Website defacements common
140
Secondary Evidence
Copies of documents. Not as strong as best. A copy is not permitted if the original (Best) is available. Oral like Witness testimony
141
Server Clustering
Group of independent servers which are managed as a single system. All servers are online and take part in processing service requests.
All share the same OS and application software vs. grid devices that can have different OSs while still working on same problem.
142
Site policy
Guidelines within an organization that control the rules and configurations of an IDS
143
Site policy awareness
The ability an IDS has to dynamically change its rules and configurations in response to changing environmental activity
144
Software Analysis
Conduct forensic reviews of applications or the activity that takes place within a running application. In some cases, conduct a review of software code, looking for back doors, logic bombs, or other security vulnerabilities. In other cases, review and interpret the log files from application or database servers, seeking other signs of malicious activity, such as SQL injection attacks, privilege escalations, or other application attacks.
145
Software Library
Controlled area only accessible for approved users
146
Storage Area Network (SAN)
A subnetwork with storage devices servicing all servers on the attached network.
147
Subscription Services
Third party, commercial services provide alternate backups and processing facilities. Most common of implementations!
148
System Cold Start Failure
When an unexpected kernel or media failure happens and the regular recovery procedure
149
System Reboot Failure
System shuts itself down in a controlled manner after detecting inconsistent data structures or runs out of resources
150
System Recovery
1. Rebooting system in single user mode or recovery console, so no user access is enabled
2. Recovering all file systems that were active during failure
3. Restoring missing or damaged files
4. Recovering the required security characteristic, such as file security labels
5. Checking
151
Terrorist Attacks
Purpose of a terrorist attack is to disrupt normal life and instill fear
152
Thrill Attacks
Launched only for the fun of it. Pride, bragging rights
153
Top Secret
Highly sensitive internal documents that could seriously damage the organization if such information were lost or made public
154
True attack stimulus
An event that triggers an IDS to produce an alarm and react as though a real attack were in progress
155
Trusted Recovery
Ensures that the security is not breached when a system crash or failure occurs. Only required for a B3 and A1 level systems.
156
Tumbler Lock
Cylinder slot
157
Types of Investigation
- Operational
- Criminal
- Civil
- eDiscovery
158
US Law: 3 Branches
Legislative: writes (statutory laws)
Executive: enforces (administrative laws)
Juridical: interprets laws (makes common laws out of court decisions)
159
US Law: 3 Categories
Criminal: individuals in violation; punishment mostly imprisonment
Civil: wrongs against individual or organization that result in a damage or loss. Punishment can include financial penalties. AKA tort (I’ll Sue You!) Jury decides liability
Administrative/Regulatory: – how industries, organizations and officers have to act. Wrongs can be penalized with imprisonment or financial penalties
160
Victimology
Why certain people fall prey to crime and how lifestyle affects their chances
161
Warded Lock
Hanging, with a key
162
Raid 6
Does not require a hot spare drive or disk
163
warez
piracy act of copying software from top notch brands and distributing over the Internet
164
colocation cloud
Colocation cloud combines the benefits of colocation and cloud computing to provide a comprehensive solution that addresses the limitations of traditional data management approaches.
165
blue team
defends from attacks
166
red team
attacks
167
white team
handles security incidents
