soa Flashcards
(58 cards)
Front
Back
What is an asset?
An asset is anything of value to an organization. This includes tangible items like database servers, SCADA systems, or firewalls, as well as intangible assets like customer data and intellectual property. Identifying and protecting critical assets is a core goal of cybersecurity.
What is a threat?
A threat is any entity—internal or external—that has the capability and intention to exploit vulnerabilities. Examples include hackers, malware, disgruntled employees, or nation-state actors.
What is a vulnerability?
A vulnerability is a flaw or weakness in hardware, software, or procedures that could be exploited by a threat actor. Think of it like a crack in a wall that weakens its defense.
What is an exploit?
An exploit is the method or tool used to take advantage of a vulnerability. Exploits often include malicious code designed to achieve unauthorized access or control.
What is risk in cybersecurity?
Risk refers to the likelihood that a threat will successfully exploit a vulnerability. It helps organizations prioritize their security measures by considering potential impact.
What is an anomaly?
An anomaly is an unusual event or behavior in a system that could indicate a threat, such as large data transfers or access at odd hours.
What is a security incident?
A security incident is any violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.
What does a Tier-1 SOC Analyst do?
Tier-1 analysts, or triage specialists, monitor and review security alerts. They filter out false positives and escalate unresolved alerts to Tier-2 analysts.
What does a Tier-2 SOC Analyst do?
Tier-2 analysts investigate more critical alerts, use threat intelligence (like IOCs), and confirm incidents. They escalate high-impact threats to Tier-3 if necessary.
What does a Tier-3 SOC Analyst do?
Tier-3 analysts or threat hunters handle major incidents and advanced threats. They also conduct or supervise penetration testing and vulnerability assessments.
What are the six NSM components?
Sensor, Parser, Integrator, Detector, Inspector, Actuator. Each component plays a role from data collection to action.
What does a Sensor do in NSM?
Collects data such as logs or packets from network traffic or host systems. It initiates the monitoring process.
What does a Parser do in NSM?
Processes and formats the raw data collected by sensors into a readable structure for analysis.
What does an Integrator do in NSM?
Combines various parsed data streams into a unified dataset for comprehensive monitoring.
What does a Detector do in NSM?
Analyzes integrated data to detect suspicious patterns or known threats.
What does an Inspector do in NSM?
Performs detailed forensic analysis of detected threats or anomalies to understand root causes.
What does an Actuator do in NSM?
Takes automated or manual action in response to incidents, such as isolating a device or alerting admins.
Name a tool used for detection in NSM.
Snort or Suricata – both are intrusion detection/prevention systems used to identify malicious activity.
Name a tool used for analysis in NSM.
Splunk – used for analyzing logs, visualizing data, and correlating events for threat detection.
What is a SIEM?
A Security Information and Event Management system collects, aggregates, and analyzes log data to detect threats and support compliance.
What is the push method in log collection?
The device or application sends log data directly to the SIEM.
What is the pull method in log collection?
The SIEM retrieves log data from the device or application.
What is Splunk used for?
It indexes and analyzes machine-generated data. Used for monitoring, searching logs, alerting, and compliance.
