CYBR 4330 - Chapter 6 | UPDATED Questions with 100%
Verified Answers
Q1: To have a coordinated reaction to unexpected events
A: an org must designate a group of indivs with primary responsibility for dealing with the
sutuation and reestablishin the security of the org's info assets
Is distinct from the IRP team
Q2: IRP team
A: primarily responsible for developing and implementing the policy and plans associated
with incident response
Q3: CSIRT
A: responsible for responding to a noteice from some predefined entity as to the possibility
of an incident
Response to that notice and words to regain control of the information assets at risk,
determine what happened, an prevent repeat occurrences
•may simply be a loose or informal association of IT and InfoSec staffers who are called if
an attack on the organization's information assets is detected.
In other, more formal implementations, it is the formal team of active and on-call
professionals prepared to respond to an incident notification
prevention role is done by entire infosec staff
In most organizations, the CSIRT is comprised of IT and InfoSec professionals who may
have other responsibilities on a day-to-day basis, but drop what they're doing and
respond to an incident once notified
May be formal part of the Infosec Dept.
Q4: •Carnegie Mellon University's Software Engineering Institute
recommends that the development of the CSIRT involve the
following stages
A: •Step 1: Obtain management support and buy-in.
•Step 2: Determine the CSIRT strategic plan.
•Step 3: Gather relevant information.
•Step 4: Design the CSIRT's vision.
•Step 5: Communicate the CSIRT's vision and operational plan.
•Step 6: Begin CSIRT implementation.
•Step 7: Announce the operational CSIRT.
•Step 8: Evaluate the CSIRT's effectiveness.
Q5: Step 1: Obtaining Management Support and Buy-In
A: •Most organizations create the CSIRT by assigning additional duties to members of the
organization who have other responsibilities and who will work on the CSIRT on an as
needed basis or as a detached assignment.
•Therefore, care must be taken to ensure that people assigned roles as CSIRT members
, do not have irresolvable conflicts with their primary job responsibilities.
requires careful coordination and authorization of proper supervisors and higher-level
managers
Sneior mgt muyst direct sub managers to ensure affected indivs can spend time away
•In addition, the time and materials needed to effectively prepare for and react to
incidents are but two of the resources that will require formal funding and support.
Management support is not a one-time thing
champion
Q6: Step 2: Determining the CSIRT Strategic Plan
A: •As with any formal effort, developing the CSIRT requires a formal plan, which should
address
•Time frame for development of the CSIRT
•Gap analysis of needed versus available personnel (skills)
•CSIRT structure and team model
•Funding for initial and ongoing CSIRT operations
•Training and testing methods and requirements for the CSIRT
•Communications requirements between the CSIRT and existing IT/InfoSec operations,
organizational management, and other responsible individuals
•Procedures for updating and modifying CSIRT documents and activities
Q7: Time Frame for Development of the CSIRT
A: One fo the first items to be determined in the CSIRt strategic plan
how soon the team needs to be up and running
could take weeks or months
Q8: Gap Analysis of Needed vs. Available Personnel Resources
(Skills)
A: Few depts have entire breadth and depth of personnel duty to support ongoing ops
Small to medium cases: entire IT/InfoSec stff belongs to CSIRT
IT staff is on call when off duty
additional resources need to be obtained to avoid losing critical personnel
org must first understand what sjills are needed
determine if it already has those resources
if not, mgt myst determine if it's willing to acquire needed personnel or live with the
consequences
Q9: Typical CSIRT needs experience
A: Malware scanning/elimination/recovery
Sysadmin
Network admin
Firewall admin
IDS
Cryptography
Data storage and recovery
Verified Answers
Q1: To have a coordinated reaction to unexpected events
A: an org must designate a group of indivs with primary responsibility for dealing with the
sutuation and reestablishin the security of the org's info assets
Is distinct from the IRP team
Q2: IRP team
A: primarily responsible for developing and implementing the policy and plans associated
with incident response
Q3: CSIRT
A: responsible for responding to a noteice from some predefined entity as to the possibility
of an incident
Response to that notice and words to regain control of the information assets at risk,
determine what happened, an prevent repeat occurrences
•may simply be a loose or informal association of IT and InfoSec staffers who are called if
an attack on the organization's information assets is detected.
In other, more formal implementations, it is the formal team of active and on-call
professionals prepared to respond to an incident notification
prevention role is done by entire infosec staff
In most organizations, the CSIRT is comprised of IT and InfoSec professionals who may
have other responsibilities on a day-to-day basis, but drop what they're doing and
respond to an incident once notified
May be formal part of the Infosec Dept.
Q4: •Carnegie Mellon University's Software Engineering Institute
recommends that the development of the CSIRT involve the
following stages
A: •Step 1: Obtain management support and buy-in.
•Step 2: Determine the CSIRT strategic plan.
•Step 3: Gather relevant information.
•Step 4: Design the CSIRT's vision.
•Step 5: Communicate the CSIRT's vision and operational plan.
•Step 6: Begin CSIRT implementation.
•Step 7: Announce the operational CSIRT.
•Step 8: Evaluate the CSIRT's effectiveness.
Q5: Step 1: Obtaining Management Support and Buy-In
A: •Most organizations create the CSIRT by assigning additional duties to members of the
organization who have other responsibilities and who will work on the CSIRT on an as
needed basis or as a detached assignment.
•Therefore, care must be taken to ensure that people assigned roles as CSIRT members
, do not have irresolvable conflicts with their primary job responsibilities.
requires careful coordination and authorization of proper supervisors and higher-level
managers
Sneior mgt muyst direct sub managers to ensure affected indivs can spend time away
•In addition, the time and materials needed to effectively prepare for and react to
incidents are but two of the resources that will require formal funding and support.
Management support is not a one-time thing
champion
Q6: Step 2: Determining the CSIRT Strategic Plan
A: •As with any formal effort, developing the CSIRT requires a formal plan, which should
address
•Time frame for development of the CSIRT
•Gap analysis of needed versus available personnel (skills)
•CSIRT structure and team model
•Funding for initial and ongoing CSIRT operations
•Training and testing methods and requirements for the CSIRT
•Communications requirements between the CSIRT and existing IT/InfoSec operations,
organizational management, and other responsible individuals
•Procedures for updating and modifying CSIRT documents and activities
Q7: Time Frame for Development of the CSIRT
A: One fo the first items to be determined in the CSIRt strategic plan
how soon the team needs to be up and running
could take weeks or months
Q8: Gap Analysis of Needed vs. Available Personnel Resources
(Skills)
A: Few depts have entire breadth and depth of personnel duty to support ongoing ops
Small to medium cases: entire IT/InfoSec stff belongs to CSIRT
IT staff is on call when off duty
additional resources need to be obtained to avoid losing critical personnel
org must first understand what sjills are needed
determine if it already has those resources
if not, mgt myst determine if it's willing to acquire needed personnel or live with the
consequences
Q9: Typical CSIRT needs experience
A: Malware scanning/elimination/recovery
Sysadmin
Network admin
Firewall admin
IDS
Cryptography
Data storage and recovery
