Detect and Respond to Cyber Incidents Flashcards

What is the purpose of a Security Information and Event Management (SIEM) system?

Answer: Aggregate and analyze security logs

A Security Information and Event Management (SIEM) system centralizes and correlates security event data from various sources across an organization's IT infrastructure. Its primary purpose is to aggregate these logs, analyze them for potential security incidents, and provide real-time alerts and reporting. This enables proactive threat detection, incident response, and compliance management by offering a holistic view of security events.

What is the first step in an incident response process?

Answer: Identification

The first step in the incident response process is identification, where an organization detects and confirms that a security incident has occurred. This phase involves monitoring systems, analyzing alerts, and validating suspicious activities to determine the scope and nature of the potential breach. Accurate and timely identification is crucial for initiating an effective response.

Which metric best reflects the effectiveness of detecting cyber incidents quickly?

Answer: Mean Time to Detect

Mean Time to Detect (MTTD) is a crucial metric that measures the average time it takes for an organization to identify a security incident from the moment it occurs. A lower MTTD indicates a more effective and responsive security monitoring system, allowing for quicker intervention and reduced potential damage. It directly reflects the efficiency of an organization's detection capabilities.

Why is containment important during incident response?

Answer: To prevent further damage and spread

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security incident. By isolating compromised systems or segments of the network, organizations can prevent the attack from spreading further, minimizing damage and preserving evidence for later analysis. This step is essential to prevent a localized incident from escalating into a widespread disaster.

What is a common method to confirm a detected security incident?

Answer: Log correlation and validation

To confirm a detected security incident, security analysts often perform log correlation and validation. This involves examining logs from multiple sources (e.g., firewalls, IDS, servers) to find corroborating evidence, identify patterns, and verify that an alert represents a genuine threat rather than a false positive. This systematic approach ensures that resources are focused on actual incidents.

Which action is taken during the recovery phase of incident response?

Answer: Restore and validate system functionality

During the recovery phase of incident response, the primary goal is to bring affected systems and services back to full operational status. This involves restoring data from backups, rebuilding compromised systems, and thoroughly validating their functionality and security. The aim is to ensure systems are clean, resilient, and fully operational after the incident.