CyberVista Defensive Strategies & Incident Response Flashcards

What is the purpose of a security policy?

Answer: To define security protocols and guidelines

A security policy is a foundational document in cybersecurity that outlines an organization's rules, procedures, and guidelines for protecting its information assets. Its primary purpose is to define how security will be managed, what measures will be implemented, and the responsibilities of individuals. This ensures a consistent, comprehensive, and enforceable approach to security within the organization.

What is the first phase of the incident response lifecycle?

Answer: Preparation

The incident response lifecycle typically begins with the 'Preparation' phase. This phase involves proactive measures such as establishing policies, training staff, implementing security controls, and developing comprehensive incident response plans before an incident occurs. Effective preparation is crucial for minimizing the impact and improving the efficiency of subsequent response efforts.

Why is incident detection important?

Answer: To respond promptly and limit damage

Incident detection is critical because it enables an organization to identify security breaches or anomalies as quickly as possible. Early detection allows for a prompt response, which is essential to contain the incident, limit the extent of damage, and minimize potential data loss or operational disruption. Timely awareness is key to effective incident management.

What is a honeypot in cybersecurity?

Answer: A decoy system to detect and study attacks

A honeypot is a cybersecurity mechanism that acts as a decoy system, intentionally designed to attract and trap cyber attackers. Its purpose is to detect unauthorized access attempts, gather intelligence on attack methods, and study attacker behavior without risking actual production systems. This allows organizations to learn about new threats and improve their defenses proactively.

Why is containment a key step in incident response?

Answer: It prevents further damage during an attack

Containment is a critical step in incident response because its primary goal is to stop the spread of an attack and prevent further damage to systems and data. This phase involves isolating affected systems, disconnecting networks, or implementing other measures to limit the scope and impact of the security incident, thereby minimizing losses.

What should be done after an incident is resolved?

Answer: Document the lessons learned and update plans

After an incident is resolved, it is crucial to conduct a post-incident review to document lessons learned and update existing incident response plans and security policies. This step helps organizations understand what went wrong, identify areas for improvement, and enhance their preparedness for future incidents. This fosters continuous security improvement and resilience.

What is an Intrusion Detection System (IDS)?

Answer: A system that detects unauthorized activity

An Intrusion Detection System (IDS) is a security technology designed to monitor network or system activities for malicious activity or policy violations. It works by analyzing traffic and system logs for patterns indicative of an attack, such as unusual behavior or known threat signatures. The IDS then alerts administrators to potential security breaches or unauthorized access attempts, enabling timely response.

What is the goal of the eradication phase?

Answer: To remove malware and fix vulnerabilities

The eradication phase in incident response focuses on completely removing the root cause of the incident, such as malware, compromised accounts, or backdoors. It also involves identifying and patching vulnerabilities that allowed the attack to occur. The goal is to ensure that the threat is fully eliminated and systems are secured before they are restored to operation.

Why are incident response plans tested regularly?

Answer: To ensure preparedness and effectiveness

Regular testing of incident response plans is crucial to ensure that they are current, effective, and that personnel are prepared to execute them. Testing helps identify weaknesses, gaps, or outdated procedures in the plan, allowing for necessary adjustments and training. This improves an organization's ability to respond efficiently and effectively to real-world security incidents, minimizing their impact.