Cybersecurity Core Functions-IR TEAM

CIA, an acronym for cybersecurity, determines when to escalate a cyber event to cyber incident. What does is stand for?

• Counter

  Intelligence

  Agency

• Compromise

  infiltrate

  Access

• Confidentiality

  Integrity

  Availablilty

• Corporate

  Internal

  Access controls

What does WISP stand for?

• Wireless Internet Service Provider

• Wide Internet Service Protocol

• Wiritten information Security plan

• Wide Information Service Provider

You have a confirmed CIA incident. Correctly order the Response Plan :

• Initiate IR team communications logging

• document all response measures taken

• determine origin, examine all logs with SOC

• preserve evidence

• Start Response Log

Answer explanation

The NIST Cybersecurity Framework (CSF) 2.0 focuses on the Respond function to develop and implement actions against detected cybersecurity incidents, ensuring effective response planning, communication, and mitigation efforts. It supports organizations in managing cybersecurity events by providing a framework for planning, analyzing, and communicating incident-related actions. 

Key aspects of the Respond function in NIST CSF 2.0:

• Response Planning:

  Organizations should develop and maintain a comprehensive incident response plan that outlines procedures for handling various cybersecurity incidents. 

• Communication:

  Effective communication is crucial for coordinating internal and external stakeholders during an incident response. 

• Analysis:

  Analyzing incidents helps organizations understand the nature of the threat, its impact, and potential root causes. 

• Mitigation:

  Mitigation efforts involve taking actions to contain the impact of the incident and prevent further damage. 

• Improvements:

  Post-incident review and analysis should inform future improvements in response planning and incident response processes. 

• Incident Management:

  The Respond function includes a specific category focused on incident management, covering various aspects of responding to and resolving incidents. 

• Evidence Preservation:

  Maintaining evidence for forensic examination and potential legal needs is a crucial aspect of the Respond function. 

What are the key security measures in the Protect function of NIST?

• Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance, and Protective Technology

• Risk Assessment, Risk Management Strategy, Supply Chain Risk Management

• Anomalies and Events, Security Continuous Monitoring, Detection Processes

• Response Planning, Communications, Analysis, Mitigation, Improvements

"Ground zero" has been identified and neutralized.

Please order the objectives of Phase 4 "Response" to Cyber Incident

• Complete restoration of network functionality

• Begin prioritized restoration of mission critical services

• Creating a secured and safe channel to restore external communications

• Update and complete the Incident Summary Report (ISR)

• Remediation: deploy devices cleared for use. begin cleaning affected devices

Match the Log with the Correct Phase of an Incident response

• Event Report

• Phase 4

• Restore functionality of Critical System

• Phase 5

• Post Incident Review Log

• Phase 2

• Response Log

• Phase 3

• Threat Level assessment

• Phase 1

Put the content in order as it would be included in a public communication regarding a breach

• Affected Data
• Communication and Support
• Actions Taken
• Incident Description
• Transparency and Accountability

Where could I find a Business Continuity Plan (BCP)?

• In the company's written information security plan

• On the company's public website

• In a local library

• In a personal email

Minimum needed to effectively respond to a Cyber Incident:

​ ​​ ​ ​ (a)   (b)   ​ (c)   (d)   ​ (e)   ​

• Prepared Post incident review
• Daily IR team meetings
• Process Improvement Plan
• bi-annual tabletop exercises
• Acessible IR Contacts and RACI forms
• Prioritized order of Critical Services restoration
• "Clean" HW inventory
• Accessible WISP
• Be able to do everything

Your MDR detects unusual outbound network traffic that could indicate data exfiltration. Organize actions by category

Groups:

(a) Alert

,

(b) Investigate/Mitigate

,

(c) Event or Incident? Criteria met?

,

(d) Confirmed CIA breach

• Activate full IR team

• Implement Full IR Breach Plan

• Alert Security Official

• Integrity

• Availability

• Activate MDR/BOCES security operations teams

• identify Destination address

• confidentiality

• identify user/computer/data type

• shutdown firewall ports to destination

• disable user/computer account

• Review Logs-MDR/Boces SOC

• Utilize Google Investigate tool to review user actions