Key Risk Indicators (KRI) and Indicators of Compromise (IOC) in Network Security

Module 4 1. An IOC occurs when what metric exceeds its normal bounds? a. IRR b. LRG c. EXR d. KRI Analysis: a. Incorrect. This is fictitious for the context of this question. b. Incorrect. This is fictitious for the context of this question. c. Incorrect. This is fictitious for the context of this question. d. Correct. A KRI is a metric of the upper and lower bounds of specific indicators of normal network activity. These indicators may include the total network logs per second, \number of failed remote logins, network bandwidth, and outbound email traffic. Once a KRI exceeds its normal bounds, this could be (but is not always) evidence of an indicator of compromise (IOC). An IOC shows a malicious activity is occurring but is still in the early stages of an attack. 2. What are the two concerns about using public information sharing centers? a. Cost and availability b. Privacy and speed c. Security and privacy d. Regulatory approval and sharing Analysis: a. Incorrect. This is fictitious for the context of this question. b. Correct. There are generally two concerns around public information sharing centers. These are the privacy of shared information and the speed at which the information is shared. c. Incorrect. This is fictitious for the context of this question. d. Incorrect. This is fictitious for the context of this question. 3. Which privacy protection uses four colors to indicate the expected sharing limitations that are to be applied by recipients of the information? a. CISA b. FOIA c. TLP d. PCII Analysis: a. Incorrect. CISA is a federal law pass in 2015 that provides authority for cybersecurity information sharing between the private sector, state and local governments, and the federal government. b. Incorrect. FOIA was passed in 1967 and provides the public the right to request access to records from any federal agency. c. Correct. TLP uses four colors (red, amber, green, and white) to indicate the expected sharing limitations that applied by the recipients. d. Incorrect. To qualify for PCII protections, information must be related to the security of the critical infrastructure and is voluntarily submitted and not submitted in place of compliance with a regulatory requirement. 4. Oskar has been receiving emails about critical threat intelligence information from a public information sharing center. His team leader has asked him to look into how the process can be automated so that the information can feed directly into their technology security. What technology will Oskar recommend? a. Automated Indicator Sharing (AIS) b. Bidirectional Security Protocol (BSP) c. Linefeed Access d. Lightwire JSON Control Analysis: a. Correct. Critical threat intelligence information should be distributed as quickly as possible to others. To rely on email alerts that require a human to read them and then react takes far too much time. As an alternative, Automated Indicator Sharing (AIS) can be used instead. AIS enables the exchange of cyberthreat indicators between parties through computer-to-computer communication and not email communication. b. Incorrect. This is fictitious and does not exist. c. Incorrect. This is fictitious and does not exist. d. Incorrect. This is fictitious and does not exist. 5. Which of the following is an application protocol for exchanging cyberthreat intelligence over HTTPS? a. STIX b. AIP-TAR c. TAXII d. TCP-Over-Secure (ToP) Analysis: a. Incorrect. Structured Threat Information Expression (STIX) is a language and format used to exchange cyberthreat intelligence. All information about a threat can be represented with objects and descriptive relationships. STIX information can be visually represented for a security analyst to view or stored in a lightweight format to be utilized by a computer. b. Incorrect. This is fictitious and does not exist. c. Correct. Trusted Automated Exchange of Intelligence Information (TAXII) is an application protocol for exchanging cyberthreat intelligence over Hypertext Transfer Protocol Secure (HTTPS). TAXII defines an application protocol interface (API) and a set of requirements for TAXII clients and servers. d. Incorrect. This is fictitious and does not exist. 6. What are the two limitations of private information sharing centers? a. Access to data and participation b. Government approval and cost c. Timing of reports and remote access d. Bandwidth and CPU Analysis: a. Correct. Organizations that are participants in closed source information are part of private information sharing centers that restrict both access to data and participation. b. Incorrect. This is fictitious for the context of this question. c. Incorrect. This is fictitious for the context of this question. d. Incorrect. This is fictitious for the context of this question. 7. Which of the following is NOT a limitation of a threat map? a. Many maps claim that they show data in real time, but most are simply a playback of previous attacks. b. Because threat maps show anonymized data it is impossible to know the identity of the attackers or the victims. c. They can be difficult to visualize. d. Threat actors usually mask their real locations so what is displayed on a threat map is incorrect. Analysis: a. Incorrect. This statement is accurate. b. Incorrect. This statement is accurate. c. Correct. A cybersecurity threat map illustrates cyberthreats overlaid on a diagrammatic representation of a geographical area. d. Incorrect. This statement is accurate. 8. Luka has been asked by his supervisor to monitor the dark web for any IOCs concerning their organization. The next week, Luca reports back that he was unable to find anything due to how looking for information on the dark web is different from using the regular web. Which of the following is not different about looking for information on the dark web? a. It is necessary to use Tor or IP2. b. Dark web search engines are identical to regular search engines. c. Dark web merchants open and close their sites without warning. d. The naming structure is different on the dark web. Analysis: a. Incorrect. This statement is accurate. b. Correct. Dark web search engines are very different from regular search engines. c. Incorrect. This statement is accurate. d. Incorrect. This statement is accurate. 9. Which of the following is not an improvement of UEFI over BIOS? a. Stronger boot security b. Networking functionality in UEFI c. Access larger hard drives d. Support of USB 3.0 Analysis: a. Incorrect. This statement is accurate. b. Incorrect. This statement is accurate. c. Incorrect. This statement is accurate. d. Correct. USB 3.0 is not dependent on UEFI. 10. Which boot security mode sends information on the boot process to a remote server? a. UEFI Native Mode b. Secure Boot c. Trusted Boot d. Measured Boot Analysis: a. Incorrect. There is no validation or protection of the boot process in this mode. b. Incorrect. All system firmware, bootloaders, kernels, and other boot-time executables are validated in Secure Boot. c. Incorrect. Windows OS checks the integrity of every component of boot process before loading it in Trusted Boot. d. Correct. Computer’s firmware logs the boot process so OS can send it to a trusted server to assess the security for the highest degree of security in Measured Boot. 11. Which of the following is NOT an important OS security configuration? a. Employing least functionality b. Disabling default accounts c. Disabling unnecessary services d. Restricting patch management Analysis: a. Incorrect. The concept of “least functionality” states a user should only be given the minimum set of permissions required to perform necessary tasks; all other permissions should be configured as not available to the user. b. Incorrect. Another important disabling function is disabling default accounts/passwords. Some OSs include unnecessary accounts. For example, Microsoft Windows 10 includes a built-in Administrator account that can be used for those building new computers to run programs and applications before a user account is created. In addition, some accounts may come with default passwords that should be changed. c. Incorrect. One of the primary OS security configurations involves disabling unnecessary open ports and services, or “turning off” any service that is not being used. In addition, closing any unnecessary TCP ports can also enhance security. d. Correct. Patch management should not be restricted on an OS. 12. Which stage conducts a test that will verify the code functions as intended? a. Production stage b. Testing stage c. Staging stage d. Development stage