Security+ (SY0-701): Lesson 12: Explain Incident Response and Monitoring Concepts Part 2

A file containing data captured from system memory.

An image file of running processes; Temporary files, registry data, network connections, cryptographic keys, etc.

Acquiring data from nonvolatile storage; HDDs, SSDs, flash memory, optical media (CD/DVD).

1. Live acquisition

2. Static acquisition by shutting down the host

3. Static acquisition by pulling the plug

Copying the data while the host is still running.

Captures more evidence/data for analysis and reduces the impact on overall services.

The data on the actual disks will have changed, so this method may not produce legally acceptable evidence; May also alert the bad actor and allow time to perform anti-forensics.

Runs the risk that the malware will detect the shutdown process and perform anti-forensics to try to remove traces of itself.

Most likely to preserve the storage devices in a forensically clean state, but there is the risk of corrupting data.

To document the steps taken and supply a timeline and video-recorded evidence of actions taken to acquire the evidence.

Linux command that makes a bit-by-bit copy of an input file, typically used for disk imaging.

dd if=input file of=output file

Establishes the provenance; Being able to trace the source of evidence to a crime scene and show that it has not been tampered with.

Capture tool must not alter data or metadata (properties) on the source disk or file system.

By attaching the target device to a forensics workstation or field capture device equipped with a write blocker.

A forensic tool to prevent the capture tool or analysis device from changing data on a target disk or media.

A cryptographic hash of the disk media is made, using either the MD5 or SHA hashing function.

A bit-by-bit copy of the media is made using an imaging utility.

A second hash is then made of the image, which should match the original hash of the media.

A copy is made of the reference image, validated again by the checksum. Analysis is performed on the copy.

Record of handling evidence from collection to presentation in court to disposal.

Establishes the integrity and proper handling of evidence; Protects an organization against accusations that evidence has either been tampered with.

Filtering relevant evidence produced from all the data gathered in a forensic examination and storing it in a database in a format such that it can be used as evidence in a trial.

Unused space in an extended partition.

inode

Something that can be subjected to analysis to discover indicators.

Log files from a network device, host/OS, application, system memory, etc.

1. Alerts/Alarms to detect the presence of an IoC

2. Status reports

Information stored or recorded as a property of an object, state of a system, or transaction.

1. PRI code

2. Header

3. Message

Calculated from the facility and a severity level.

Contains a timestamp, host name, app name, process ID, and message ID fields.

Contains a tag showing the source process plus content.

Audit events, such as a failed login or access to a file being denied.

A target for security-related events generated by host-based malware and intrusion detection agents.`

A record of the email servers involved in transferring an email message from a sender to a recipient.

Establish timeline questions, such as when and where a breach occurred, as well as containing other types of evidence.

Via commands on a mail client or from a message transfer agent (MTA).

Provides real-time or near-real-time analysis of security alerts generated by network hardware and applications.

1. Agent-based

2. Listener/Collector

3. Sensor

A network appliance that gathers or receives log and/or state data from other network systems.

Parsing information from multiple data sources so that it can be presented in a consistent and searchable format.

A function of log analysis that links log and state data to identify a pattern that should be logged or alerted as an event.

High-level summary for decision-makers. This guides planning and investment activity.

Provides cybersecurity and department leaders with detailed information. This guides day-to-day operational decision-making.

Process of adjusting detection and correlation rules to reduce incidence of false positives and low-priority alerts.

Adjust the parameter of the rules, adding more correlation factors, setting to log only/no alert, or to produce a notification for x amount of events.

By redirecting alerts to a different group based on the type of alert.

Deploying machine learning (ML) to rapidly analyze the sort of data sets produced by SIEM and how analysts respond to alerts and tuning the ruleset in a way that reduces alert.

Auditing software that collects status and configuration information from network devices typically based on SNMP.

Records metadata and network traffic statistics rather than recording each frame for analysis.

Highlight patters in traffic; Alert based on anomalies, flow patterns or custom rules; Visualization of network.

By packets sharing the same characteristics, referred to as keys.

A flow label.

A flow record.

Packets that share the same key characteristics, such as IP source and destination addresses and protocol type; Also known as a 5-tuple.

Software that tracks the health of a computer's subsystems using metrics reported by system hardware or sensors; high temperature, chassis intrusion, and so on.

Security Content Automation Protocol (SCAP) allows compatible scanners to determine whether a computer meets a configuration baseline.

1. Open Vulnerability and Assessment Language (OVAL)

2. Extensible Configuration Checklist Description Format (XCCDF)

A SIEM collector receives log data from a remote host and parses it into a standard format that can be recorded within the SIEM; A sensor (or sniffer) copies data frames from the network, using a mirror port or a TAP.

Retrospective network analysis (RNA)

Recording the totality of network events at a packet header or payload level.

Detailed analysis of captured traffic to identify attack tools, data exfiltration attempts, and suspicious domains.