Flashcards
Security+ Incident Response Steps and Tools
Cards in this deck (11)
- 1Step 1Preparation
-prepare response plans
-make system(s) resilient
-create lines of communication
-identify proper resources and assets - 2Step 2Identification
-identify the nature of the incident
-determine whether an incident has occurred, assess severity, notify stakeholders
-typically done using an attack framework
ex: Cyber Kill Framework, MITRE ATT&CK, Diamond Model of Intrusion Analysis - 3Step 3Containment
limit the spread and impact of the incident
should have step-by-step procedure in IRP - 4Step 4Eradication
find and remove the source - 5Step 5Recovery
restore from backups
reintegrate affected systems back into workflow
re-audit to ensure its no longer vulnerable - 6Step 6Lessons Learned
analyze the effectiveness of the response - 7IR Prioritizationfor when multiple incidents are happening at the same time
need to consider: data integrity, downtime, economic/publicity, scope, detection time, recovery time - 8Attack Frameworksset of comprehensive descriptions, examples, and definitions of the threat lifecycle from initial access through exfiltration
- 9MITRE ATT&CKglobal database of TTPs and documented attack types
https://attack.mitre.org/ - 10Diamond Model of Intrusion Analysisstandardized framework for how a company can classify and react to threats
4 main categories
1. adversary
2. capability
3. victim
4. infrastructure - 11Cyber Kill Chainmodel that identifies the stages an attacker must complete in order to achieve their objective
7 steps
Information
- Description
- CompTIA Information Technology (Security+ ) Flashcards on Security+ Incident Response Steps and Tools, created by Lyndsay Badding on 27/04/2023.
- Created by
- Lyndsay Badding
- Views
- 16
- Tags
- Rating