Ch. 13 Incident Prep and Investigation

business continuity

the ability of an organization to maintain its operations and services in the face of a disruptive event or a major disaster

business continuity planning

process an organization undertakes in advance to determine a plan of action in the event of a disaster

business continuity plan (BSP)

strategic document that provides alternative modes of operation for business activities

continuity of operation planning (COOP)

a federal initative that is intended to encourage organizations to address how critical operations will continue under a broad range of negative circumstances

business impact analysis (BIA)

identifies business processes and functions and then quantifies the impact a loss of these functions may have on business operations

mission-essential function

the activity that serves as the core purpose of the enterprise

single point of failure

component or entity in a system that if it no longer functions, will disable the entire system, is also a goal of a BIA

disaster recovery plan (DRP)

written document that details the process for restoring IT resources following an event that causes a significant disruption in service

incident response plan

set of written instructions for reacting to an information security incident and should contain the following: definitions, incident response teams, and reporting requirements

information security framework

series of documented processes used to define policies and procedures for implementation and management of security controls in an enterprise environment

capacity planning

process of forecasting the need for future resources

people capacity planning

capacity planning that involves calculating future human resources

technology capacity planning

capacity planning for predicting the future number of devices needed

infrastructure capacity planning

capacity planning for predicting the future size of the network

platform diversity

using multiple different devices to host or serve an application or a service

hard disk drives (HDD)

use spinning platters, actuator arms with read/write heads, and motors to store and retrieve data

solid-state drives (SSDs)

stores data on chips instead of magnetic platters

mean time between failures (MTBF)

refer to average amount of time until a component fails, cannot be repaired, or must be replaced

RAID (Redundant Array of Independent Drives)

uses multiple hard drives for increased reliability and performance

storage area network (SAN)

dedicated network storage facility that provides access to data storage over a high-speed network

uninterruptible power supply (UPS)

device that maintains power to equipment in case of an interruption in the primary electrical power source

off-line UPS

if power is interrupted, the UPS quickly begins supplying power to the equipment

on-line UPS

always running off its battery while the main power runs the battery charger - it can cleran the electrical power before reaching the server

hot site

generally run by a commercial disaster recovery service that allows a business to continue computer and network operations to maintain business continuity

cold site

provides office space, but the customer must provide and install all the equipment needed to continue operations

warm site

has all equipment installed but doers not have active internet or telecommunications facilities and does not have current backups of fata

multicloud systems

comprises multiple cloud computing services from different providers, allowing businesses to optimize performance, cost, and redundancy by avoiding reliance on a single vendor.

recovery point objective (RPO)

maximum length of time that an organization can tolerate between copies

recovery time objective (RTO)

length of time it will take to recover the data that has been copied

backup

single scheduled even where data is copiued and then stored so that it can be used in the event of a disaster

snapshot

takes a “picture” of the state of the data repeatedly so that data can be restored from a specific point in time

journaling

makes a copy of the data whenever a change to the data occurs

root-cause analysis (RCA)

process of discovering the origin (root) cause of the security event

SIEM dashboard

can provide information collected from sensors

automated reports

automatically generated summaries of data analysis results to track security events and system performance.

packet capture

protocol that generates information based on capturing packets

forensics

application of science to questions that are of interest to the legal profession

digital forensics

involves the retrieval of difficult-to-obtain data, which is usually hidden, altered, or deleted by the perpetrator

E-discovery

is the electronic counterpart of manually sifting through documents in discovery

acquisition

is the process of collecting, preserving, and analyzing digital evidence for investigation purposes.

order of volatility

refers to the principle that digital evidence should be collected in a specific sequence based on its likelihood of being altered or lost, prioritizing the most volatile data first.

reporting

a detailed written description of the acquisition and analysis of the evidence is required