Exam (elaborations)
CompTIA Security+ Cert Prep 9 Op and Inc Responses (Answered) Updated Fall 2024/2025.
- Course
- Institution
CompTIA Security+ Cert Prep 9 Op and Inc Responses (Answered) Updated Fall 2024/2025.
[Show more]
Seller
Follow
ACADEMICAIDSTORE
Reviews received
Content preview
CompTIA Security+ Cert Prep 9 Op andInc Responses (Answered) Updated Fall
2024/2025.
incident response plan
provides structure during cybersecurity incidents
SP 800-61
NIST Computer Security Incident Handling Guide
-development plan
isolating affected systems
The highest priority of a first responder must be containing damage through_____
Low Impact Incidents
minimal potential to affect security
normally handled by first responders
Don't require after-hours response
Moderate Impact Incidents
have significant potential to affect security
trigger incident response team activation
require prompt notification to management
High Impact Incidents
may cause critical damage to information or systems
justify an immediate, full response
require immediate notification to senior management
demand full mobilization of incident response team
Preparation
Detection & Analysis
Containment, Eradication, & Recovery
Post-Incident Activity
NIST Incident Response Process
segmentation, isolation, removal
3 ways to contain incident:
segmentation
, Containment strategy
divides networks into logical segments
group by types of users and systems
isolation
containment strategy
affected systems are moved to a network that is completely disconnected
removal
containment strategy
removes affected systems from network completely
eradication
removes all traces of an incident
clearing, purging, destroying
sanitization techniques
lessons learned
Post incident activity
provide incident responders with a opportunity to reflect on the incident response efforts and offer
feedback that will improve the organizations response to future incidents
Lessons learned, evidence retention, indicator of compromise generation
post incident activities
Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
MITRE ATT&CK
MITRE ATT&CK
model that provides a taxonomy for describing different tactics used by hackers
diamond model
assist with intrusion analysis
provides an approach for modeling attacks by describing the relationship between the adversary, victim,
infrastructure, and capability
Cyber Kill Chain (CKC)
Lockheed Martin
models phases of an attack
focuses on APTs
reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on
objectives
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller ACADEMICAIDSTORE. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $10.99. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
75632 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now