Root Cause Analysis in Cybersecurity

The video tutorial by Toby from Oline Security covers a root cause analysis of a security breach. It begins with an introduction to the lab, followed by logging into systems and gathering initial data. The tutorial then delves into analyzing security events to identify anomalies, tracing the attack path, and understanding how the system was compromised through phishing and proxy setup. The video concludes with network and proxy analysis, reviewing packet captures, and summarizing the findings.

What is the primary focus of the lab introduced in the video?

• Learning about network configurations

• Performing a root cause analysis

• Setting up a new security system

• Understanding basic programming concepts

What tool is used to investigate security events in the lab?

• Metasploit

• Wazo

• Wireshark

• Nmap

What was the significant change observed in the audit policies?

• Network traffic was encrypted

• New user accounts were created

• Successful and failed events were no longer logged

• Firewall rules were modified

Which user was identified as having made changes to the audit policy?

• Admin

• Jamie

• Toby

• Dylan

What type of connection did Jamie use to access the domain controller?

• SSH

• VPN

• Remote Desktop Protocol (RDP)

• Telnet

Who was found to have used Jamie's credentials for the RDP session?

• Jamie

• Dylan

• Admin

• Toby

How did Dylan gain access to Jamie's credentials?

• By guessing the password

• Via a phishing email

• By exploiting a software vulnerability

• Through a brute force attack

What was the purpose of the proxy set up on Jamie's computer?

• To encrypt all outgoing data

• To block unauthorized access

• To monitor and capture network traffic

• To enhance network speed

What type of file was used to capture network traffic?

• Text file

• Log file

• CSV file

• Pcap file

What was the ultimate goal of the root cause analysis conducted in the lab?

• To develop new security software

• To train new security personnel

• To upgrade the security system

• To identify the initial security breach