Fichas
2.4 Incident Respone and Recovery Procedures
Fichas del conjunto (42)
- 1What is E-Discovery?When evidence is recovered from electronic devices
- 2What is an asset?- An item of value
- Can be digital or physical - 3What is a DRP?Data Recovery Plan
- 4What is a full backup?- When all data is backed up.
- Archive bit is cleared - 5What is an incrememental backup?When backups are only accomplished on files that have been created or modified since last incremental.
- Archive bit is cleared. - 6What is a differential backup?Backups are completed on data created since last full backup.
- Archive bit is not cleared - 7What is copy backup?Not considered part of scheduled backup scheme.
Do not reset the files archive bit. - 8What is a daily backup?Use a file's timestamp to determine if it needs to be archived.
- Popular is mission-critical environments. - 9What is a transaction log backup?Captures all transactions that have occurred since last backup.
- 10What is a FIFO backup scheme?- First in, First Out
- The newest backup is saved to the oldest media.
- Does not protect against data errors. - 11What is a GFS backup scheme?Grandfather, Father, Son
-3 Sets of backups
- Daily(S), Weekly(F), Monthly(G)
- Son advances to father, father advances to grandfather - 12What is electronic vaulting?- Copies files as modifications.
- Real time - 13What is remote journaling?- Copies the journal (transaction log) offside
- Scheduled, occurs in batches - 14What is tape vaulting?- Backups over direct line to off site facility
- Off side backups - 15What is Hierarchical Storage Management (HSM)- Stores frequently accessed data on faster media.
- Store infrequently accessed data on slower media. - 16What is an optical jukebox?- Stores data on optical disks.
- Robots load and unload disks as needed
- Ideal for 24.7 availability - 17What is replication?Copies data from one location to another.
- 18What is data purging?Uses degausing, makes data unavailable to forensics.
- Data is unrecoverable against laboratory attacks. - 19What is data clearing?Rendering information unrecoverable by keyboard.
- 20What is Remanence?Any data left over from erased media.
- 21What is a data breach?Any incident where private/confidential information is released to unauthorized parties.
- 22What is a PIA?Privacy Impact Assessment
- Risk assessment that determines risk of PII. - 23What are the 5 rules that digital evidence must adhere too?- Authentic
- Accurate
- Complete
- Convincing
- Admissible - 24What is surveillance?The act of monitoring behavior, activities or other changing activities.
- 25What are two types of surveillance?- Physical
- Computer - 26What are some types of media analysis?- Disk imaging
- Slack space analysis
- Content analysis
- Steganography Analysis - 27What is disk imaging?Creating an exact copy of HDD contents.
- 28What is slack space analysis?Analyzing empty or reusable space on drive to see if there is remains of older data.
- 29What is content analysis?Analyzing contents of drive and giving a report detailing the types of data by percentage.
- 30What is steganography analysis?Analyzing files on a drive to discover encryption used on the file.
- 31What are some types of software analysis?- Content analysis
- Reverse engineering
- Author identification
- Context analysis - 32What is content analysis?Analyzing the content of software to determine purpose for which the software was created.
- Used heavily in malware analysis - 33What is reverse engineering?Retrieving the source code from a program to study how the program performs.
- 34What is author identification?Attempting to determine the software's author.
- 35What is context analysis?Analyzing the environment the software was found to discover clues related to determining risk.
- 36What are some types of network analysis?- Communications analysis
- Log analysis
- Path tracing - 37What is communications analysis?Analyzes traffic over the network for specific types of activity.
- 38What is log analysis?Analyzing network traffic logs.
- 39What is path tracing?Tracing the path of a particular traffic packet to determine route used by the attacker.
- 40What is RFC 3327?Order of volatility
Guidelines for Evidence Collection and Archiving - 41What are the first four orders of data volatility?- Memory Contents
- Swap files
- Routing table, ARP cache
- File system information - 42What are the last four orders of data volatility- Raw disk blocks
- Remote logging and monitoring
- Physical config and topology
- Archival media
Información
- Descripción
- Conduct incident response and recovery procedures.
- Creado por
- DJ Perrone
- Visitas
- 52
- Etiquetas
- Valoración