CISSP - Domain 7

27 flashcards · Computer Science · by Jaysen Lewis

What are the 4 types of Investigations?
1) Organizational/ Administrative Technology issues, conducted by Orgs Low standards of evidence. Uses root cause analysis, fix 2) Criminal The highest standards of Evidence Conducted by Govt agencies "Beyond a reasonable doubt" standard 3) Civil Non-criminal disputes between 2 parties Govt, Businesses, Private citizens Employment law violations, civil disputes "More likely than not" evidence standard 4) Regulatory Investigations Can be criminal or civil Evidence standard depends on the level o…
What are types of evidence?
Real (Physical) Evidence: Tangible & Physical Objects from the actual crime in IT Security: Tools, Damaged Property, Hard disks, USB drives – NOT the data on them. Documentary Evidence: Consists of written information. Testimonial Evidence: Direct Evidence: Oral or Written Testimony from a firsthand witness, what they experienced with their 5 senses, that either proves or disproves a specific fact. Expert Opinion: Expert witness draws conclusions based upon other evidence Circumstantial Evidenc…
Investigations must never alter ___________ .
Evidence.
What is the volatility order for which you should collect evidence?
Network Traffic Memory contents System & Process info Files Logs Archived Records
What is the evidence Lifecycle?
Discovery Protection Recording Collection & Identification Analysis Storage (preservation, transportation) Present in Court Return to Owner
What is a downside to using a packet capture tool like Wireshark for forensics?
Requires a lot of storage. Network forensics becomes a data problem.
What type of info does Netflow Data show?
Source & Destination IPs & Ports Timestamps Amount of data transferred Useful for Network Forensics.
Software forensics can be used to resolve what types of disputes?
Intellectual property disputes Identify the origin of Malware
What is an embedded system?
Systems that contain Embedded Devices - Systems within Systems (Smart home devices, smart cars, smart fridges)
What does Chain of Custody provide?
Trail (or chain) of Evidence (Think receipt)
What is the difference between Interviewing and Interrogations?
Interviewing - Collecting facts to determine matters of the incident. Interrogation - Obtain a confession by evidence retrieval method. The Process: Prepare questions and topics, summarize information
What is the Electronic Discovery (eDiscovery) process?
(information) Governance Identification Preservation Collection Processing Review Analysis Production Presentation "IGIP CPR APP" ("I Give CPR App")
What are the major functions of SIEM tools?
Using IDS, it receives input from many logs, security tools and many other sources. Real‐time analysis of events occurring on systems Provides a central, secure collection point for logs Apply (AI) Artificial Intelligence to help detect patterns that other systems might miss
What is a SOAR platform?
Security Orchestration Automation & Response Enhanced SIEM Correlated & Auto-respond to alerts 2 types of responses: Playbooks - Process-oriented responses, can include Human-performed steps & automated actions. Runbooks - Automated actions, rapid response.
Be familiar with the Continuous Monitoring Process (as defined by NIST):
Know the Incident Response Lifecycle (according to NIST)?
1. Preparation To prepare for incidents, compile a list of IT assets such as networks, servers and endpoints, identifying their importance and which ones are critical or hold sensitive data. Set up monitoring so you have a baseline of normal activity. Determine which types of security events should be investigated, and create detailed response steps for common types of incidents. 2. Detection and Analysis Detection involves collecting data from IT systems, security tools, publicly available inf…
What are 3 Containment strategies used in Incident Response?
Segmentation Example: Quarantine VLAN (still within the corporate LAN) Contain the spread of an attack Isolation Next-Level Segmentation Move it to a completely disconnected network (not on the corporate LAN) Removal Completely disconnect it from the network
Know the quick facts about Change Mgmt:
Changes should be formally requested RFC = Request for Change Analyze requests against goals to ensure validity Cost and effort estimation before approval Identify the change steps after approval Incremental testing during implementation Complete documentation
What does DLP do?
Data Loss Prevention *think Data Leak Prevention Protects from Data exfiltration Scans data for tags, keywords (watermarking) and data patterns. Protects before an incident occurs (i.e. prevention).
What is Network-based DLP vs. Endpoint-based DLP?
Network-based DLP: DLP for Data in motion. Scans all outbound data (network transmissions) looking for anomalies. Place at the edge of the network to scan all outgoing data. Endpoint-based (aka Host-based) DLP: DLP for Data in use. Scans all internal end-user workstations, servers and devices. Keeps users from Copying out data too. Installed as an agent on local hosts
What are the different ways to test your Incident Response Plan?
1) Read-throughs Each team member reviews their role in the plan on their own 2) Walk-throughs (aka Table-Top Exercises) Team reviews the plan together 3) Simulations The team goes through a scenario together
What temperature range should data centers be kept at?
Also called the "Expanded Envelope"
What other environmental conditions should you look out for within facilities/ data centers?
High Humidity leads to condensation & can damage equipment Low Humidity Causes Static Electricity & can damage equipment The "sweet spot" for environmental Humidity is called the Dew Point Range:
What are the 3 elements required for fire to burn?
Know the different Fire & Fire Extinguisher types:
What does a Faraday cage protect against?
Electromagnetic Interference (EMI)
What is Two-Person Integrity vs Two-Person Control?