Incident Response Organizingand Preparing the CSIRT Short Answer

Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT  41. What are the areas in which experience is needed in a typical CSIRT? ANSWER: A typical CSIRT needs experience in the following areas: Malware scanning, elimination, and recovery System administration Network administration (switches, routers, and gateways) Firewall administration Intrusion detection systems Cryptography Data storage and recovery (e.g., RAID and/or storage area networks) Documentation creation and maintenance POINTS: 1 REFERENCES: p. 130 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE:Subjective Short Answer HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.2 - Recognize the meanings of common prefixes, suffixes, and word roots. CTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:4/16/2020 9:59 AM  42. In a partially outsourced staffing model, IR duties can be divided among the organization and outsourcers in many ways. Describe two commonplace arrangements for partial outsourcing. ANSWER: Although IR duties can be divided among the organization and one or more outsourcers in many ways, a few arrangements have become commonplace: The most prevalent arrangement is for the organization to outsource 24-hour-a-day, 7-day-a-week (24/7) monitoring of intrusion detection sensors, firewalls, and other security devices to an off-site managed security service provider (MSSP). The MSSP identifies and analyzes suspicious activity and reports each detected incident to the organization’s CSIRT. Because the MSSP employees can monitor activity for multiple customers simultaneously, this model may provide a 24/7 monitoring and response capability at a skill and cost level that is preferable to a comparable internal team. Some organizations perform basic IR work in-house and call on contractors to assist with handling incidents, particularly those that are more serious or widespread. The services most often performed by the contractors are computer forensics, advanced incident analysis, incident containment and eradication, and vulnerability mitigation. POINTS: 1 REFERENCES: P. 131 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE:Subjective Short Answer Page16 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.2 - Recognize the meanings of common prefixes, suffixes, and word roots. CTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:1/1/2021 1:03 PM  43. Briefly discuss employee morale issues in incident response with respect to staffing models for a CSIRT. ANSWER: Incident response work is very stressful, as are the on-call responsibilities of most team members. This combination makes it easy for CSIRT members to become overly stressed. Many organizations struggle to find willing, available, experienced, and properly skilled people to participate, particularly in 24-hour support. POINTS: 1 REFERENCES: p. 132 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE:Subjective Short Answer HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.2 - Recognize the meanings of common prefixes, suffixes, and word roots. CTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:1/1/2021 1:03 PM  44. A measure of success of a CSIRT’s operations may be determined through how well its goals are being met. Give three examples of possible CSIRT goals. ANSWER: Examples of goals may include: Raising the bar of Internet security Assisting sites in proactive security ventures Increasing the awareness of security incidents Determining the scope of the security problem Assisting the community in applying the best security practices available POINTS: 1 REFERENCES: p. 137 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Subjective Short Answer HASVARIABLES: False STUDENTENTRYM Basic ODE: LEARNINGOBJECTI5.1 - Describe the purpose and function of the CSIRT Page17 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT VES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:03 PM 45. Discuss at least three mechanisms that can be used to counteract staff burnout with respect to incident response. ANSWER: It is important to counteract staff burnout by providing opportunities for learning and growth. Suggestions for building and maintaining skills are: - Budget enough funding to maintain, enhance, and expand proficiency in technical areas and security disciplines as well as less technical topics, such as the legal aspects of incident response. Consider sending each full-time team member to at least two technical conferences per year and each part-time team member to at least one. - Ensure the availability of books, magazines, and other technical references that promote deeper technical knowledge. - Give team members opportunities to perform other tasks, such as creating educational materials, conducting security awareness workshops, writing software tools to assist system administrators in detecting incidents, and conducting research. - Consider rotating staff members in and out of the CSIRT. - Maintain sufficient staffing so that team members can have vacations. - Create a mentoring program to enable senior technical staff to help less experienced staff learn incident handling. - Participate in exchanges in which team members temporarily trade places with others (e.g., network administrators) to gain new technical skills. - Occasionally bring in outside experts and contractors with deep technical knowledge in needed areas, as funding permits. - Develop incident-handling scenarios and have the team members discuss how they would handle the scenarios. - Conduct simulated incident-handling exercises for the team. Exercises are particularly important because they not only improve the performance of the incident handlers, but also identify issues with policies, procedures, and communication. POINTS: 1 REFERENCES: p. 140 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE:Subjective Short Answer HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.2 - Recognize the meanings of common prefixes, suffixes, and word roots. Page18 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT CTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:1/1/2021 1:05 PM  46. Beginning a CSIRT implementation includes several substeps. What are they? ANSWER: This step includes the following substeps: - Recruit and train initial CSIRT staff. - Purchase equipment and prepare the required network infrastructure. - Define and prepare the necessary CSIRT policies and procedures. - Coordinate with additional IT and InfoSec department members to ensure effective communications during an incident. - Define and acquire an incident-tracking system. - Prepare incident-reporting guidelines and forms. POINTS: 1 REFERENCES: p. 142 H1: BUILDING THE CSIRT H2: Step 6: Beginning CSIRT Implementation QUESTIONTYPE: Subjective Short Answer HASVARIABLES: False STUDENTENTRYMO Basic DE: LEARNINGOBJECTI 5.3 - Explain the standard operating procedures associated with CSIRTs VES: DATECREATED: 4/16/2020 9:59 AM DATEMODIFIED: 1/1/2021 1:06 PM 47. Describe at least three advantages and three disadvantages of outsourcing an IR process. ANSWER: Advantages: 1. Services provided by professionals trained in IR 2. 24/7 monitoring 3. Early notification of potential problems in region 4. Formal reports and briefings on attacks and response 5. Equipment specified and installed by well-trained professionals 6. No additional personnel costs or training requirements POINTS: REFERENCES: Disadvantages: 1. Potential loss of control of response to incidents 2. Possible exposure of classified organizational data to service providers 3. Locked in to proprietary equipment and services 4. Loss of services when contract expires, unless renewed 5. Loss of customization to the needs of each organization 6. Organization’s needs subjugated to service provider’s needs 7. More important/prestigious companies given preference in response over smaller, less prestigious ones 1 p. 145 Page19 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS H2: Outsourcing Incident Response and the CSIRT QUESTIONTYPE:Subjective Short Answer HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:4/16/2020 9:59 AM  48. Organizations are usually unwilling to give an outside resource authority to make operational decisions for the environment, such as disconnecting a Web server. How does this affect the process of outsourcing? Give an example of a solution that might address the issue. ANSWER: It is important to decide the point at which the service provider hands off the incident response to the organization. One partially outsourced model addresses this issue by having the service provider deliver an incident report to the organization’s internal team along with recommendations for further handling of the incident. The internal team ultimately makes the operational decisions. POINTS: 1 REFERENCES: p. 145 H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS H2: Outsourcing Incident Response and the CSIRT QUESTIONTYPE:Subjective Short Answer HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:4/16/2020 9:59 AM DATEMODIFIED:4/16/2020 9:59 AM  Matching Matcheachitemwithastatementbelow. a. incident candidate b. fingerprinting c. indicator d. false positive e. noise f. footprinting g. precursor h. incident classification Page20 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT i. cyber kill QUESTIONTYPE: HASVARIABLES: DATECREATED: DATEMODIFIED: Matching False 4/16/2020 9:59 AM 1/1/2021 4:34 PM 49. The process of gathering information about the oraganization and its network activities ANSWER: POINTS: b 1 50. An alert or alarm that occurs in the absence of an actual attack ANSWER: POINTS: d 1 51. A series of steps that document the stages of a cyberattack ANSWER: POINTS: i 1 52. An adverse event that is a possible incident ANSWER: POINTS: a 1 53. The organized research and investigation of Internet addresses owned or controlled by a target organization ANSWER: f POINTS: 1 54. An activity that may signal an incident could occur in the future ANSWER: POINTS: g 1 55. An event that does not rise to the level of an incident ANSWER: POINTS: e 1 56. The process of evaluating the circumstances of a reported event ANSWER: POINTS: h 1 57. An activity that may signal an adverse event is underway ANSWER: POINTS: c 1 Modified True / False 58. The final step in the development of the CSIRT involves obtaining management support and buy-in. Page21 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT ANSWER: POINTS: REFERENCES: QUESTIONTYPE: HASVARIABLES: STUDENTENTRYMODE: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: False - first 1 p. 128 H1: BUILDING THE CSIRT Modified True / False False Basic 5.1 - Describe the purpose and function of the CSIRT 9/16/2020 3:26 PM 9/16/2020 3:27 PM 59. An incident response team composed of technical IT, managerial IT, and InfoSec professionals who are prepared to detect, react to, and recover from an incident is known as the IRPT. ANSWER: False - CSIRT POINTS: 1 REFERENCES: p. 128 H1: BUILDING THE CSIRT QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:51 PM DATEMODIFIED: 9/16/2020 4:52 PM 60. Management support is an ongoing requirement needed for both the start-up and the continued operation of the CSIRT. ANSWER: True POINTS: 1 REFERENCES: p. 129 H1: BUILDING THE CSIRT H2: Step 1: Obtaining Management Support and Buy-In QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE:Basic LEARNINGOBJECTIVES:5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:55 PM DATEMODIFIED: 9/25/2020 7:15 PM 61. Developing the CSIRT requires a formal budget, which encompasses the scope and responsibilities of the team as well as its reporting structure and functional processes. ANSWER: False - plan POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT Page22 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT H2: Step 2: Determining the CSIRT Strategic Plan p. 129 QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 4:59 PM DATEMODIFIED: 9/16/2020 5:00 PM 62. In a distributed CSIRT, a single CSIRT handles incidents throughout the organization. ANSWER: False - central False - centralized POINTS: 1 REFERENCES: p. 131 H1: BUILDING THE CSIRT H2: Step 2: Determining the CSIRT Strategic Plan QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 5:02 PM DATEMODIFIED: 9/16/2020 5:03 PM 63. Establishing the scope and responsibilities of the CSIRT is the second task of the IRPT when it is forming the CSIRT. ANSWER: False - first POINTS: 1 REFERENCES: p. 133 H1: BUILDING THE CSIRT H2: Step 3: Gathering Relevant Information QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.1 - Describe the purpose and function of the CSIRT DATECREATED: 9/16/2020 5:06 PM DATEMODIFIED: 9/16/2020 5:07 PM 64. A mission statement establishes the tone for the team and provides a path to obtaining its goals and objectives. ANSWER: True POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision p. 135 QUESTIONTYPE: Modified True / False Page23 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT HASVARIABLES: STUDENTENTRYMODE: LEARNINGOBJECTIVES: DATECREATED: DATEMODIFIED: False Basic 5.1 - Describe the purpose and function of the CSIRT 9/16/2020 6:56 PM 1/1/2021 1:13 PM 65. Apprehend and prosecute is an organizational CP philosophy for incident response and digital forensics that focuses on the collection and preservation of potential evidence when responding to and recovering from an incident, with the expectation of possibly finding and prosecuting the attacker. ANSWER: True POINTS: 1 REFERENCES: p. 136 H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYM Basic ODE: LEARNINGOBJECTI 5.1 - Describe the purpose and function of the CSIRT VES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 9/16/2020 6:52 PM DATEMODIFIED: 9/25/2020 7:16 PM 66. Regardless of which services a CSIRT chooses to provide, the goals of a CSIRT must be based on the security goals of the constituent or parent organizations. ANSWER: False - business POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 4: Designing the CSIRT’s Vision p. 137 QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYM Basic ODE: LEARNINGOBJECTI 5.1 - Describe the purpose and function of the CSIRT VES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 9/16/2020 6:58 PM DATEMODIFIED: 9/16/2020 6:59 PM 67. Equally important to the development of the CSIRT's mission plan to an organization's general management and employees is a mechanism that allows feedback from these constituencies. ANSWER: False - communication POINTS: 1 REFERENCES: p. 141 Page24 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT H1: BUILDING THE CSIRT H2: Step 5: Communicating the CSIRT’s Vision and Operational Plan QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMOD Basic E: LEARNINGOBJECTIVE5.3 - Explain the standard operating procedures associated with CSIRTs S: DATECREATED: 9/16/2020 7:00 PM DATEMODIFIED: 1/1/2021 1:14 PM 68. Prior to moving forward with IR plans that have been developed, the development team should gain CSIRT approval with a formal sign-off. ANSWER: False - management POINTS: 1 REFERENCES: p. 142 H1: BUILDING THE CSIRT H2: Step 6: Beginning CSIRT Implementation QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 9/16/2020 7:05 PM DATEMODIFIED: 9/25/2020 7:19 PM 69. A summary of the CSIRT formation announcement should be circulated regularly as part of the organization’s security awareness program. ANSWER: True POINTS: 1 REFERENCES: H1: BUILDING THE CSIRT H2: Step 7: Announcing the Operational CSIRT p. 143 QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYM Basic ODE: LEARNINGOBJECTI 5.3 - Explain the standard operating procedures associated with CSIRTs VES: 5.4 - Describe training and deployment of the CSIRT DATECREATED: 9/16/2020 7:08 PM DATEMODIFIED: 9/16/2020 7:09 PM 70. Assessing CSIRT effectiveness is done through two key mechanisms: IR consultant reviews and CSIRT performance measures. ANSWER: False - plan tests Page25 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT 1 p. 143 H1: BUILDING THE CSIRT H2: Step 8: Evaluating the CSIRT’s Effectiveness QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 9/16/2020 7:10 PM DATEMODIFIED: 9/16/2020 7:12 PM POINTS: REFERENCES: 71. Feedback mechanisms such as performance measures offer the opportunity to measure efficiency. ANSWER: False - effectiveness POINTS: 1 REFERENCES: p. 143 H1: BUILDING THE CSIRT H2: Step 8: Evaluating the CSIRT’s Effectiveness QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.3 - Explain the standard operating procedures associated with CSIRTs DATECREATED: 9/16/2020 7:13 PM DATEMODIFIED: 9/16/2020 7:15 PM 72. One of the first signals that the organization is making progress in the development of its IR program is a dramatic decrease in the number of identified incidents. ANSWER: False - increase POINTS: 1 REFERENCES: p. 144 H1: BUILDING THE CSIRT H2: Final Thoughts on CSIRT Development QUESTIONTYPE: Modified True / False HASVARIABLES: False STUDENTENTRYMODE: Basic LEARNINGOBJECTIVES: 5.4 - Describe training and deployment of the CSIRT DATECREATED: 9/16/2020 7:16 PM DATEMODIFIED: 9/16/2020 7:17 PM 73. While the SOC is designed to manage all security operations, the CSIRT focuses on responding to incidents. ANSWER: False - monitor POINTS: 1 REFERENCES: p. 144 H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS Page26 Name  : Clas  s: Dat  e: Module 05 - Incident Response: Organizing and Preparing the CSIRT H2: CSIRT Operations and the Security Operations Center QUESTIONTYPE:Modified True / False HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:9/16/2020 7:19 PM DATEMODIFIED:9/25/2020 7:20 PM  74. Organizations should consider not only the current quality of work but the service provider’s efforts to ensure the quality of future work. ANSWER: True POINTS: 1 REFERENCES: H1: SPECIAL CIRCUMSTANCES IN CSIRT DEVELOPMENT AND OPERATIONS H2: Outsourcing Incident Response and the CSIRT p. 145 QUESTIONTYPE:Modified True / False HASVARIABLES:False STUDENTENTRY Basic MODE: LEARNINGOBJE 5.5 - Identify the special circumstances of CSIRT interaction with the security operations center CTIVES: (SOC) and when outsourcing incident response operations DATECREATED:9/16/2020 7:25 PM DATEMODIFIED:9/16/2020 7:26 PM  Page27