Sound the Alarm: Detection and Response Flashcards
1
Q
Computer Security Incident Response Team (CSIRT)
A
A specialized group of security professionals that are trained in incident management and response.
2
Q
Documentation
A
Any form of recorded content that is used for a specific purpose.
3
Q
Endpoint Detection and Response (EDR)
A
An application that monitors an endpoint for malicious activity.
4
Q
Event
A
An observable occurrence on a network, system, or device.
5
Q
False negative
A
A state where the presence of a threat is not detected.
6
Q
False positive
A
An alert that incorrectly detects the presence of a threat.
7
Q
Incident
A
An occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system.
8
Q
Incident handler’s journal
A
A form of documentation used in incident response.
9
Q
Incident response plan
A
A document that outlines the procedures to take in each step of incident response.
10
Q
NIST Incident Response Lifecycle
A
A framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-incident activity.
11
Q
Security Operations Center (SOC)
A
An organizational unit dedicated to monitoring networks, systems, and devices for security threats or attacks.
12
Q
Security Orchestration, Automation, and Response (SOAR)
A
A collection of applications, tools, and workflows that uses automation to respond to security events.
13
Q
True negative
A
A state where there is no detection of malicious activity.
14
Q
True positive
A
An alert that correctly detects the presence of an attack.
15
Q
Command
A
An objective of CSIRT. Refers to having the appropriate leadership and direction to oversee the response.
15
Q
Control
A
An objective of CSIRT. Refers to the ability to manage technical aspects during incident response, like coordinating resources and assigning tasks.
16
Q
Communication
A
An objective of CSIRT. Refers to the ability to keep stakeholders informed.
17
Q
Security analyst, Technical lead, and Incident coordinator
A
What are the three key security related roles under CSIRT?
18
Q
Security analyst
A
This job title’s role is to continuously monitor an environment for any security threats.
19
Q
Forensic investigator
A
This job title is commonly L2s and L3s (under CSIRT) who collect, preserve, and analyze digital evidence related to security incidents to determine what happened.
20
Q
Threat hunter
A
This job title is typically L3s (under CSIRT) who work to detect, analyze, and defend against new and advanced cybersecurity threats using threat intelligence.
21
Q
Endpoint
A
Any device connected on a network.
22
Q
Log analysis
A
The process of examining logs to identify events of interest.
23
Q
Command and control (C2)
A
The techniques used by malicious actors to maintain communications with compromised systems.
C2 is crucial in managing compromised devices during a cyber attack.
24
Command-line interface (CLI).
A text-based user interface that uses commands to interact with the computer.
## Footnote
CLI is often preferred for scripting and automation tasks.
25
Data exfiltration
Unauthorized transmission of data from a system.
## Footnote
Data exfiltration can lead to data breaches and loss of sensitive information.
26
Indicators of compromise (IoC)
Observable evidence that suggests signs of a potential security incident.
## Footnote
IoCs can include unusual network traffic, changes in file integrity, etc.
27
Network data
The data that’s transmitted between devices on a network.
## Footnote
Network data encompasses all forms of digital communication over a network.
28
Network traffic
The amount of data that moves across a network.
## Footnote
Network traffic can be measured in terms of bandwidth usage.
29
Network Interface Card (NIC)
Hardware that connects computers to a network.
## Footnote
NICs can be wired or wireless.
30
Packet capture (p-cap)
A file containing data packets intercepted from an interface or network.
## Footnote
P-cap files are often used for analysis in tools like Wireshark.
31
tcpdump
A command-line network protocol analyzer.
## Footnote
tcpdump is commonly used for capturing and analyzing network packets.
32
Wireshark
A GUI network protocol analyzer.
## Footnote
Wireshark provides a graphical interface for packet analysis.
33
Command and control
What does C2 stand for?
34
Indicators of compromise
What does IoC stand for?
35
Network Interface Card
What does NIC stand for?
36
Packet capture
What does p-cap stand for?
37
Network operations center (NOC)
An organizational unit that monitors the performance of a network and responds to any network disruption, such as a network outage.
38
Network operations center
What does NOC stand for?
39
Data packet
A basic unit of information that travels from one device to another within a network.
40
Version
An IPv4 field. This field indicates the IP version. For an IPv4 header, IPv4 is used.
## Footnote
For an IPv4 header, IPv4 is used.
41
Internet Header Length (IHL) field
An IPv4 field. This field specifies the length of the IPv4 header including any Options.
42
Type of Service (ToS)
An IPv4 field. This field provides information about packet priority for delivery.
43
Total Length
An IPv4 field. This field specifies the total length of the entire IP packet including the header and the data.
44
Identification field
An IPv4 field. Packets that are too large to send are fragmented into smaller pieces. This field specifies a unique identifier for fragments of an original IP packet so that they can be reassembled once they reach their destination.
45
Flags
An IPv4 field. This field provides information about packet fragmentation including whether the original packet has been fragmented and if there are more fragments in transit.
46
Fragment Offset
An IPv4 field. This field is used to identify the correct sequence of fragments.
47
Time to Live (TTL)
An IPv4 field. This field limits how long a packet can be circulated in a network, preventing packets from being forwarded by routers indefinitely.
48
Protocol
An IPv4 field. This field specifies the protocol used for the data portion of the packet.
49
Header Checksum
An IPv4 field. This field specifies a checksum value which is used for error-checking the header.
50
Source Address
An IPv4 field. This field specifies the source address of the sender.
51
Destination Address
An IPv4 field. This field specifies the destination address of the receiver.
52
Options field
An IPv4 field. This field is optional and can be used to apply security options to a packet.
53
Traffic Class
An IPv6 field. This field is similar to the IPv4 Type of Service field. The Traffic Class field provides information about the packet's priority or class to help with packet delivery.
54
Version
An IPv6 field. This field indicates the IP version. For an IPv6 header, IPv6 is used.
55
Flow Label
An IPv6 field. This field identifies the packets of a flow. A flow is the sequence of packets sent from a specific source.
56
Payload Length
An IPv6 field. This field specifies the length of the data portion of the packet.
57
Next Header
An IPv6 field. This field indicates the type of header that follows the IPv6 header such as TCP.
58
Hop Limit
An IPv6 field. This field is similar to the IPv4 Time to Live field. The Hop Limit limits how long a packet can travel in a network before being discarded.
59
Source Address
An IPv6 field. This field specifies the source address of the sender.
60
Destination Address
An IPv6 field. This field specifies the destination address of the receiver.
61
Analysis
The investigation and validation of alerts.
62
Broken chain of custody
Inconsistencies in the collection and logging of evidence in the chain of custody
63
Business continuity plan (BCP)
A document that outlines the procedures to sustain business operations during and after a significant disruption.
64
Chain of custody
The process of documenting evidence possession and control during an incident lifecycle.
65
Containment
The act of limiting and preventing additional damage caused by an incident.
66
Crowdsourcing
The practice of gathering information using public input and collaboration.
67
Detection
The prompt discovery of security events.
68
Eradication
The complete removal of the incident elements from all affected systems.
69
Honeypot
A system or resource created as a decoy vulnerable to attacks with the purpose of attracting potential intruders.
70
Final report
Documentation that provides a comprehensive review of an incident.
71
Indicators of attack (IoA)
The series of observed events that indicate a real-time incident.
71
Lessons learned meeting
A meeting that includes all involved parties after a major incident.
72
Open-source intelligence (OSINT)
The collection and analysis of information from publicly available sources to generate usable intelligence.
73
Post-incident activity
The process of reviewing an incident to identify areas for improvement during incident handling.
74
Recovery
The process of returning affected systems back to normal operations.
75
Resilience
The ability to prepare for, respond to, and recover from disruptions.
76
Standards
References that inform how to set policies.
77
Threat hunting
The proactive search for threats on a network.
78
Threat intelligence
Evidence-based threat information that provides context about existing or emerging threats.
79
Triage
The prioritizing of incidents according to their level of importance or urgency.
80
VirusTotal
A service that allows anyone to analyze suspicious files, domains, URLs, and IP addresses for malicious content.
81
What does BCP stand for?
Business continuity plan
82
What does IoA stand for?
Indicators of attack
83
What does OSINT stand for?
Open-source intelligence
84
What are three common public or private threat intelligence sources?
Industry reports, Government advisories, and threat data feeds.
84
What are different types of indicators of compromise (IoCs) found in the Pyramid of Pain?
Hash values, IP addresses, Domain names, Network artifacts, Host artifacts, Tools, and Tactics, techniques, and procedures (TTPs).
84
What are three types of recovery sites used for site resilience?
Hot sites, Warm sites, and Cold sites
85
What does TTP stand for?
Tools, and Tactics, techniques, and procedures
86
Hash values
An IoC. They correspond to known malicious files. These are often used to provide unique references to specific samples of malware or to files involved in an intrusion.
87
Domain names
An IoC. A web address such as www.google.com
87
IP addresses
An IoC. An internet protocol address like 192.168.1.1
87
Network artifacts
An IoC. Observable evidence created by malicious actors on a network. For example, information found in network protocols such as User-Agent strings.
88
Host artifacts
An IoC. Observable evidence created by malicious actors on a host. A host is any device that’s connected on a network. For example, the name of a file created by malware.
89
Tools
An IoC. Software that’s used by a malicious actor to achieve their goal. For example, attackers can use password cracking tools like John the Ripper to perform password attacks to gain access into an account.
90
Tactics, techniques, and procedures (TTPs)
An IoC. This is the behavior of a malicious actor. Tactics refer to the high-level overview of the behavior. Techniques provide detailed descriptions of the behavior relating to the tactic. Procedures are highly detailed descriptions of the technique. TTPs are the hardest to detect.
91
Anomaly-based analysis
A detection method that identifies abnormal behavior.
## Footnote
Used in various security applications to detect potential threats.
92
Array
A data type that stores data in a comma-separated ordered list.
## Footnote
Commonly used in programming for organizing data.
93
Common Event Format (CEF)
A log format that uses key-value pairs to structure data and identify fields and their corresponding values.
## Footnote
Facilitates interoperability among security products.
94
Configuration file
A file used to configure the settings of an application.
## Footnote
Essential for customizing application behavior.
95
Endpoint
Any device connected on a network.
## Footnote
Includes computers, mobile devices, and IoT devices.
96
Endpoint Detection and Response (EDR)
An application that monitors an endpoint for malicious activity.
## Footnote
Helps in detecting, investigating, and responding to threats.
97
Host-based Intrusion Detection System (HIDS)
An application that monitors the activity of the host on which it’s installed.
## Footnote
Focuses on detecting malicious activity on individual machines.
98
Key-value pair
A set of data that represents two linked items: a key, and its corresponding value.
## Footnote
Fundamental in data organization and storage.
99
Log Management
The process of collecting, storing, analyzing, and disposing of log data.
## Footnote
Involves ensuring logs are available for analysis and compliance.
100
Logging
The recording of events occurring on computer systems and networks.
## Footnote
Essential for monitoring and security.
101
Network-based Intrusion Detection System (NIDS)
An application that collects and monitors network traffic and network data.
## Footnote
Focuses on detecting threats across the entire network.
102
Object
A data type that stores data in a comma-separated list of key-value pairs.
## Footnote
Commonly used in software development.
103
Search Processing Language (SPL)
Splunk’s query language.
## Footnote
Used for searching and analyzing data within Splunk.
104
Signature
A pattern that is associated with malicious activity.
## Footnote
Used in detection methods to identify threats.
105
Signature analysis
A detection method used to find events of interest.
## Footnote
Relies on known patterns to detect threats.
106
Suricata
An open-source intrusion detection system, intrusion prevention system, and network analysis tool.
## Footnote
Widely used for network security monitoring.
107
Telemetry
The collection and transmission of data for analysis.
## Footnote
Important in various fields, including IT and security.
108
YARA-L
A computer language used to create rules for searching through ingested log data.
## Footnote
Facilitates identification of specific patterns in logs.
109
What does CEF stand for?
Common Event Format
110
What does EDR stand for?
Endpoint detection and response
111
What does HIDS stand for?
Host-based intrusion detection system
112
What does SPL stand for?
Search Processing Language
112
What does NIDS stand for?
Network-based intrusion detection system
112
What types of logs are there?
Network, System, Application, Security, and Authentication.
113
Network
A type of log. These logs are generated by network devices like firewalls, routers, or switches.
113
System
A type of log. These logs are generated by operating systems like Chrome OS™, Windows, Linux, or macOS®.
114
Application
A type of log. These logs are generated by software applications and contain information relating to the events occurring within the application such as a smartphone app.
115
Security
A type of log. These logs are generated by various devices or systems such as antivirus software and intrusion detection systems. Security logs contain security-related information such as file deletion.
115
Authentication
Authentication logs are generated whenever authentication occurs such as a successful login attempt into a computer.
