What is fundamental to a Incident Response Plan? Check all that apply

Training personnel for incidents within the organization, should include:

Having Insurance is a great solution in your Incident Management Plan. It can be leaned on when you don't have the capacity to resolve incidents.

When is the IR Plan activated?

When determining severity of an incident, what two types of impact do we compare?

Both types of impact, Functional and Informative, categorize the level of severity this way.

Once the impact is analyzed, how many levels of severity are there?

Information Impact focuses on _______, while Functional Impact focuses on __________.

Severity level 1 is equivalent to which level of impact?

How long should it take for a Level 3 incident be resolved?

What is an IoC?

What information does an IoC give us?

Where is IoC data typically found? Check all that apply.

Which one(s) are examples of TTP's? Check all that apply.

This is an effective tool that can assist you with more IoC and TTP discovery, which has a very effective APT (Advanced Persistent Threat) profile.

In order to "stop the bleed" on impacted system, what are some short term strategies? Select all that apply.

In order to "stop the bleed" for compromised Users, what are some short term strategies? Select all that apply.

During an attack, what can be lost if you shut down the system?

How do you secure all Forensic data? Select all that apply

During the Containment Phase of Incident Management, what the preferred method of isolation?

What does patient-zero mean?

What some examples of what may take place during the Eradication Phase? Select all that apply.

What is the goal during the Recovery Phase? Select all that apply.

When the business is fully operational, after the recover, this indicates the response is complete.

During the Recovery Phase, how should data be handled?

What Phase must we continually execute?

Upon a compromised attack, with an integrated IR Plan, identify the steps that are likely to occur.

During what Phase of BEC do these steps reside?

1. Determine members of the CSIRT

2. Determine Extended Members

3. Define escalation paths

4. Ensure email system component logging levels are set.

5. Ensure the logging system is stored in secure locations like a SIEM

During what Phase of BEC do these steps reside?

1. Analyze method of compromise evidence will help determine next steps

2. Determine initial method of account compromise

3. Use Indicators of Compromise (IoCs) gathered from previous step to search the environment for other victims

4. Review logs in email system searching for anomalies.

5. Assess victim emails to determine if sensitive information was contained in them

6. Search impacted systems for newly created users or modified user accounts

During what Phase of BEC do these steps reside?

1. Reset all passwords associate with identified victims

2. Revoke authentication tokens for all identified victim accounts

3. Inform 3rd Party organizations of any compromise or concerns

4. Block any external organizations identified, during the investigation, and their related domains from sending email to your organization

5. Preserve, anlayze, and isolate malware discovered during the investigation

6. Block all IoCs in email systems and endpoint systems

During what phase of BEC do these steps reside?

1. Preserve artifacts, systems, and relevant backups

2. Preserve volatile data

3. Replace or rebuild systems

During what phase of BEC do these steps reside?

1. Remediate vulnerabilities and gaps

2. Reset passwords for all impacted accounts and/or create replacement accounts and leave the impacted accounts disabled permanently

3. Continue to monitor for malicious activity related to this incident for extended period of time

4. Consult cybersecurity insurance, if needed.