Lesson 21 - Explain Appropriate Incident Response Activities

Incident Management

strategies and procedures for preparing for, responding to, and managing security incidents

Security Incident

event that endangers confidentiality, integrity, or availability, of information/information systems

Data breach

- when data is exfiltrated or there is a loss of control

- may trigger reporting and notification requirements

Incident Prevention

threat modeling, risk assessment, controls implementations, monitoring, and assurance activities

Incident Preparation

planning, documenting, assigning responsibilities, training and practicing response capabilities

Incidenet Detection

monitoring, incident reporting, analysis, and participation in threat intelligence and information sharing activities

Incident Response

validation, containment, mitigation, eradication, recovery, and evaluation activities

Incidenet Playbook

set of instructions for planning for and responding to a specific type of event

Threat Modeling

the process of anticipating threats

Reporting Standards

determine how incidents must be documented and commnicated as well as when notification requirements are triggered

Escalation Thresholds

point at which and issue requires a higher level of response

Categorization

- the process of classifying incidents based on severity

- used to determine response times, resource assignments, and preparation requirements

IRT (Incident Response Team)

- composed of internal personnel and external resources (e.g. PR, forensic experts, legal coucil, etc)

- internal team should represent a cross-section of the org (not just members of the IT team)

SETA (Security Education, Training and Awareness)

program that handles incident response training

Walkthrough

incident response exercise were personnel review their plans and procedures for completeness

Tabletop

- scenario-based group workshop that focuses on the application of plans/procedures and participant readiness

- incident response exercise

Simulation

- localized scenario that simulated an actual event

- can be pre-planned or suprise

- incident response exercise

What are the IR (Incident Response) phases in order?

validation -> prioritization -> containment -> eradication -> recovery -> lessons learned

Validation

IR phase to determine if an incident has actually occurred and, if so, the magnitude of the problem

Prioritization

- IR phase to determine order of importance/urgency

- factors include: functional impact, confidentiality impact, recoverability

Containment

- IR phases that handles short term approach for limiting/reducing the impact of an incident

Eradication

- IR phase that focuses on eliminating the the root cause of the threat (not just the symptoms)

- uses RCA

RCA (Root Cause analysis)

- problem solving method used to identify underlying causes

- main goal is to prevent the problem rom recurring

Recovery

- IR phases for restoring normal operations

- often involves implementing enhanced monitoring

What are the 3 types of cyber investigations?

criminal, civial, internal (a.k.a administrative)

Digital Evidence

any information or data of value to an investigation that is stored on, received by, or transmitted by an electronic device

Direct Evidence

supports the truth of an assertion directly (non additional evidence or inference needed)

Circumstantial Evidence

relies on inference to connect it to a conclusion of fact

eDiscovery

any process where digital data is located and search with the intent of using it as evidence in a legal case

Legal Hold

an order that suspends the modification, deletion, and destruction of record and media

Evidence Spoilation

the intentional, reckless, or negligent withholding, hiding, altering, fabricating or destroying of evidence

Admissibility of evidence

whether the evidence can be used in court

Weight of evidence

the qulity and completeness of the evidence

Preservation

done to maintain the integrity and reliability of digital evidence so that it can be used in a legal or investigative context

Order of Volatility

the aquisition of evidence before it disappears, is overwritten, or is no longer useful

Persistent data

data that does not change and is preserved when the device is turned off

Volatile data

data that is easily degradable and can be lost when the device is turned off

Evidentiary Chain

- chronological documentation that records who interacted with the evidence and what they did with it

- used to show that there was no mishandling or evidence spoilation

Factual Witness

individual who is knowledgeable about the facts of the case through direct participation or observations

Expert Witness

a person who has knowledge beyond that of a lay person that allows them to give testimony on a issue that requires expertise to understand

Digital Forensics

application of science to the identification, collection, examination, and analysis of evidence while preserving the integrity of the information

Computer Digital Forensics

examination and analysis of digital devices such as computers, laptops, servers and storage media

Memory Digital Forensics

examination and analysis of the volatile memory (RAM) and registers

Software Digital Forensics

examination and analysis of software source code or binary code

Network Digital Forensics

examination and analysis of network traffic and data packets as well as audit, event, and security logs

Multimedia Digital Forensics

examination and analysis of digital images, videos, and audio recordings

Mobile Digital Forensics

examination and analysis of smartphones, tablets, and other mobile devices (complicated by biometrics and encryption)

Cloud Digital Forensics

Memory Imaging

used to acquired (dump) short-term, volatile data (e.g. RAM, virtual memory)

Write Blocker

used to intercept inadverent drive writes

Bit Stream Image

bit-by-bit copy of the source material that preservers all latent data in addition to files and directory structure

Clone

exact copy of entire physical hard drive including all active and residual data and unallocated or slack space

Checksum

- single value derived from a block of digital data to detect errors that may have been introduces during transmission or storage

- similar to a hash but smaller and use simpler algorithms

Cluster

fixed length block of disk space indexed in a File Allocation Table

Slack Space

- space between the end of a file and the end of a cluster

- can contain data from RAM or segments of deleted files

Unallocated (free) space

- clusters that are not allocated to a file

- can contain deleted file fragments

Metadata

data about data

Carving

the process by which deleted files or fragments are recovered

In digital forensics, the absence of evidence means that nothing happened. (T or F)

False.

Forensic Examination Phases in order

data collection -> analysis -> reporting -> retention and archiving

Data Breach

incident that results in the discolsure of data or loss of control

Dark Web

- anonymous part of the Internet that is not indexed by search engines

- compromisd data often ends up on the dark web after a data breach

Disclosure

the requirement to reveal a situation

Notification

the act of informing affected parties

Information Sharing

the means of conveying information or experience efrom one trusted party to another

ISAC (Information Sharing and Analysis Center)

- trusted, sector-specific entity that facilitates sharing about vulnerabilities, threats, and incidents

- use STIX and TAXII

STIX (Structured Threat Information Expression)

- standardized language to describe cyber threat information

- developed by MITRE and CTI

TAXII (Trusted Automated eXchange of Intelligence Information)

- defines how cyber threat information can be shared via services and message exhanges by defining an API

- 3 principle models: hub and spoke, source/subscriber, or peer-to-peer

- specifically designed to support STIX information

Downstream Liability

responsibility for damages that result from a security compromise in your business

Jurisdiction

area of legal authority