CYBR 4330 Chapter 8 Exam Questions and Answers

CYBR 4330 Chapter 8 Exam Questions and Answers Introduction - Answer-•After an incident has been contained and system control has been regained, incident recovery can begin. •As in the response phase, the first task is to inform the appropriate people—most importantly, executive management. •Almost simultaneously, the CSIRT must assess the full extent of the damage to determine what must be done to restore the systems. •The CSIRT must also examine the appropriate systems and network logs and try to determine exactly how the attack began and spread; as individuals begin recovery operations based on the IR plan. incident damage assessment - Answer-•Recovery from an incident or incidents begins with what , which can take days or weeks, depending on the extent of the damage. The initial determination of the scope of the breach of CIA of info and assets can range from minor to major Recovery - Answer-•Recovery from an incident or incidents begins with incident damage assessment, which can take days or weeks, depending on the extent of the damage. •The organization ensures that the appropriate systems and data recovery procedures are initiated, working to restore all systems from backup to usable condition. •Concurrently, teams begin investigating what happened and how, trying to determine how the attack began and spread throughout the organization's systems. •They also seek to ensure the organization knows the full extent of any loss of data, damage, or destruction of resources and to ensure no residual effects remain, Assesses current state of info and systems and compares it to a known state Identify and Resolve Vulnerabilities - Answer-•At this point, many sources of guidance on intrusion detection practices direct the investigator to delve into the reams of forensic data that will have been collected. •Digital forensics can be used both for intrusion analysis and as part of evidence collection and analysis, but it can also be used to assess how the incident occurred and what vulnerabilities were exploited to cause the assessed damage. •It is imperative that the individuals performing the analysis are trained to recognize and handle evidentiary material in a way that does not violate its value as evidence in civil or criminal proceedings. •After any incident, an organization should address the safeguards that failed to stop or limit the incident, or that were missing from the system in the first place. •Safeguards must then be installed, replaced, or upgraded as needed. •The organization should evaluate monitoring capabilities when they are present and improve the detection and reporting methods as needed. •If necessary, new monitoring capabilities should be installed. If you don't have monitoring capabilities, get them. Restore Data - Answer-•Unfortunately, many organizations associate the entire IR process with simple data backup and recovery schemes. •The IR team must understand the backup strategy used by the organization, must restore the data contained in backups, and then must use the appropriate recovery processes to re-create any data that was created or modified since the last backup. •It is equally important at this point to emphasize the need to regularly test backups. •Routine testing will identify issues and allow the organization to resolve them before critical backups are needed to restore business operations. Restore Services and Processes - Answer-•Compromised services and processes must be examined, verified, and then restored. •If services or processes were interrupted in the course of regaining control of the systems, they need to be brought back online. •The same testing requirements for backups apply to documented system services and processes. •It is a given that an organization should continuously monitor its systems; however, the organization is especially vulnerable after an incident. Restore Confidence Across the Organization - Answer-•With management's permission, the IR team may want to issue an announcement outlining the incident and assuring everyone that it was handled, and the damage was controlled. •If the incident was minor, that should be communicated. •If the incident was major or severely damaged systems or data, users should be reassured that they can expect operations to return to normal as soon as possible. •There may also be a legal requirement to notify select stakeholders, depending on the organization's industry. Maintenance - Answer-•The maintenance of the IR plan includes: •procedures to complete effective after-action review meetings, •a process to complete comprehensive, periodic plan review and maintenance, •efforts to continue the training of staff members who will be involved in IR, and •a continuing process of rehearsing plan actions in order to maintain readiness for all aspects of the incident plan. After-Action Review (AAR) - Answer-•An absolutely essential activity is the after-action review. •All key players review their notes during an AAR and verify that the IR documentation is accurate and precise. •All team members review their actions during the incident and identify areas where the IR plan worked, didn't work, or should improve. •This exercise allows the team to update the IR plan. •The entire AAR is recorded for use as a training case for future staff. •The AAR formally brings the IR team's actions to a close after an incident. AAR to Document Lessons Learned and Generate IR Plan Improvements - Answer-•At the end of the incident review, the AAR serves as a review tool, allowing the team to examine how it responded to the incident. •Examining the documentation of the incident should reveal the point at which the incident was first detected, the point in time that the IR plan was enacted, and how the first responders and CSIRT reacted.