NCIC Cybersecurity & Digital Intelligence Flashcards

What are 'indicators of compromise' (IOCs) in cybersecurity intelligence?

Answer: Artifacts or behavioral patterns that indicate a system has been breached or targeted by malicious activity

Indicators of compromise are forensic artifacts — such as malicious IP addresses, file hashes, or behavioral patterns — that indicate a system has been compromised by malicious activity.

When conducting OSINT on social media platforms, which legal principle must intelligence analysts observe?

Answer: Information must only be collected from publicly accessible sources without unauthorized access or terms of service violations

Analysts must collect OSINT only from publicly accessible information without unauthorized access, as accessing private accounts without authorization can violate ECPA.

What is 'geofencing' as an investigative tool in digital intelligence?

Answer: Using location data to identify devices present within a specific geographic area during a specified time period

Geofencing uses location data to identify all devices present within a defined geographic boundary during a specific time period, generating investigative leads.

What is 'predictive cyber intelligence' used for in law enforcement operations?

Answer: Using threat data and behavioral analysis to anticipate and prevent cyber attacks before they occur

Predictive cyber intelligence uses historical threat data, behavioral patterns, and advanced analytics to anticipate and prevent cyber attacks before they materialize.

What is a 'cybercrime fusion center' specifically designed to accomplish?

Answer: Integrate cyber threat intelligence from multiple sources to support coordinated law enforcement response to cybercrime

Cybercrime fusion centers integrate cyber threat intelligence from government, private sector, and law enforcement sources to support coordinated responses to cyber threats.

What key consideration must analysts address when collecting digital intelligence to ensure its admissibility as evidence?

Answer: Proper legal authority must be obtained, methods documented, and evidence integrity maintained throughout collection

Admissible digital intelligence requires proper legal authority for collection, thorough documentation of methods, and demonstrated integrity of the evidence throughout the collection process.