Cybersecurity Core Functions-IR TEAM

CIA, an acronym for cybersecurity, determines when to escalate a cyber event to cyber incident. What does is stand for?

• Counter

  Intelligence

  Agency

• Compromise

  infiltrate

  Access

• Confidentiality

  Integrity

  Availablilty

• Corporate

  Internal

  Access controls

What does WISP stand for?

• Wireless Internet Service Provider

• Wide Internet Service Protocol

• Wiritten information Security plan

• Wide Information Service Provider

You have a confirmed CIA incident. Correctly order the Response Plan :

• Start Response Log

• Initiate IR team communications logging

• determine origin, examine all logs with SOC

• document all response measures taken

• preserve evidence

Answer explanation

The NIST Cybersecurity Framework (CSF) 2.0 focuses on the Respond function to develop and implement actions against detected cybersecurity incidents, ensuring effective response planning, communication, and mitigation efforts. It supports organizations in managing cybersecurity events by providing a framework for planning, analyzing, and communicating incident-related actions. 

Key aspects of the Respond function in NIST CSF 2.0:

• Response Planning:

  Organizations should develop and maintain a comprehensive incident response plan that outlines procedures for handling various cybersecurity incidents. 

• Communication:

  Effective communication is crucial for coordinating internal and external stakeholders during an incident response. 

• Analysis:

  Analyzing incidents helps organizations understand the nature of the threat, its impact, and potential root causes. 

• Mitigation:

  Mitigation efforts involve taking actions to contain the impact of the incident and prevent further damage. 

• Improvements:

  Post-incident review and analysis should inform future improvements in response planning and incident response processes. 

• Incident Management:

  The Respond function includes a specific category focused on incident management, covering various aspects of responding to and resolving incidents. 

• Evidence Preservation:

  Maintaining evidence for forensic examination and potential legal needs is a crucial aspect of the Respond function. 

What are the key security measures in the Protect function of NIST?

• Access Control, Awareness and Training, Data Security, Information Protection Processes and Procedures, Maintenance, and Protective Technology

• Risk Assessment, Risk Management Strategy, Supply Chain Risk Management

• Anomalies and Events, Security Continuous Monitoring, Detection Processes

• Response Planning, Communications, Analysis, Mitigation, Improvements

"Ground zero" has been identified and neutralized.

Please order the objectives of Phase 4 "Response" to Cyber Incident

• Creating a secured and safe channel to restore external communications

• Begin prioritized restoration of mission critical services

• Remediation: deploy devices cleared for use. begin cleaning affected devices

• Update and complete the Incident Summary Report (ISR)

• Complete restoration of network functionality

Match the Log with the Correct Phase of an Incident response

• Response Log

• Phase 4

• Threat Level assessment

• Phase 3

• Event Report

• Phase 2

• Post Incident Review Log

• Phase 1

• Restore functionality of Critical System

• Phase 5

Put the content in order as it would be included in a public communication regarding a breach

• Incident Description
• Affected Data
• Actions Taken
• Communication and Support
• Transparency and Accountability

Where could I find a Business Continuity Plan (BCP)?

• In the company's written information security plan

• On the company's public website

• In a local library

• In a personal email

Minimum needed to effectively respond to a Cyber Incident:

​ ​​ ​ ​ (a)   (b)   ​ (c)   (d)   ​ (e)   ​

• Prepared Post incident review
• Daily IR team meetings
• Process Improvement Plan
• bi-annual tabletop exercises
• Acessible IR Contacts and RACI forms
• Prioritized order of Critical Services restoration
• "Clean" HW inventory
• Accessible WISP
• Be able to do everything

Your MDR detects unusual outbound network traffic that could indicate data exfiltration. Organize actions by category

Groups:

(a) Alert

,

(b) Investigate/Mitigate

,

(c) Event or Incident? Criteria met?

,

(d) Confirmed CIA breach

• Alert Security Official

• identify user/computer/data type

• confidentiality

• Activate full IR team

• identify Destination address

• disable user/computer account

• Review Logs-MDR/Boces SOC

• Implement Full IR Breach Plan

• Utilize Google Investigate tool to review user actions

• shutdown firewall ports to destination

• Integrity

• Availability

• Activate MDR/BOCES security operations teams