- Welcome to Lesson 21, Deep Dive Quiz.
Now, Lesson 21 was all about explaining
the appropriate incident response activities.
And in 21.1, we talked about incident management;
21.2, incident response;
21.3, evidence handling;
21.4, forensic examination;
and 21.5, disclosure and notification;
as well as information sharing.
Covered a lotta material.
So you ready?
Together, we're gonna do 10 questions.
Make sure you have a pen or pencil, piece of paper,
and keep putting me on pause as often
as you need so you can be answering the questions.
All right, let's get started.
Your organization is particularly worried
about a ransomware attack.
Which document would most likely be used
to detail your response instructions?
Incident management procedures,
an incident playbook, an incident response plan
or an incident management policy.
This is about ransomware.
Which document would most likely be used
to detail the response instructions?
What are you gonna choose?
I like incident playbook.
That's the one I'm gonna choose because
that's the one that's gonna allow us
to be very, very specific in our details.
Now, we also wanna have an incident response plan,
for sure, right, but that's gonna
be sort of more overarching and generic.
Incident management procedures isn't specifically about
how we respond, but really about how
our whole incident management program is.
And, of course, our incident management policy
is gonna be a very high-level document.
So I'm going with playbook. You like it?
Yeah, that's correct.
Let's move on.
All right, we are gonna drag the appropriate words
to best describe exercises and testing.
So let's read this paragraph first.
It's important to exercise and test
incident response disaster recovery
and business continuity plans.
The objective of a blank is to review procedures
for completeness and accuracy.
A blank is a scenario-based group workshop
that focuses on the application of plans,
as well as participant readiness.
And a blank is a localized scenario
that mimics an actual event.
And formats include surprise and preplanned.
So we have walkthrough, group, service provider,
external, simulation and tabletop.
So important to exercise and test
our incidence response, our disaster recovery,
our business continuity plans.
The objective of a blank is to review procedures
for completeness and accuracy.
What do you like?
I like a walkthrough.
In a walkthrough, right,
we're just walking through, step by step by step,
through our procedures, to say, "Are these complete?
Are these accurate?"
Usually, that'll be done by an individual
or by a department.
A blank is a scenario-based group workshop
that focuses on the application of plans,
as well as participant readiness.
So we're bringing a group together, right?
We're sitting them all around a table.
So how about a tabletop?
A tabletop being a scenario-based group workshop
that focuses on the application of plans,
as well as participant readiness.
And then our last one, a blank
is a localized scenario that mimics
an actual event.
Formats includes surprise and preplanned.
I'm gonna go with simulation.
Do you agree? You like those?
Well, let's read through this.
The objective of a walkthrough is to review procedures
for completeness and accuracy.
A tabletop is a scenario-based group workshop
that focuses on the application of plans,
as well as participant readiness.
And a simulation is a localized scenario
that mimics an actual event,
and formats include surprise and preplanned.
Now, I didn't prompt you to put me
on pause to do this.
I hope you did or I hope you
just worked it out right with me.
Are you ready to check it? Let's see.
And that is correct.
All right, next question.
Defines how cyber threat information can be shared
via services and message exchanges.
Is this an ISAC, GDPR,
TAXII or STIX?
This defines how cyber threat information
can be shared via services and message exchanges.
ISACs, GDPR, TAXII or STIX.
Put me on pause if you wanna think it through.
Well, ISACs are, they're our information-sharing groups,
so it's not that one.
GDPR is our general data protection regulation, right?
Not that one.
TAXII. Hmm.
TAXII really is about how we share information
via message exchanges.
And STIX, well, STIX is actually
the language that we used, right,
to define the information that we're gonna share.
So I'm going to TAXII. You like it?
Let's see.
And that's correct.
Which in the following is not
an evidence collection imperative?
Avoiding contamination, creating a media clone,
maintaining an evidentiary chain
or acting in order of volatility.
Three of these are absolutely definite
evidence collection imperatives.
One is not.
Tell me which one isn't.
Put me on pause if you wanna read through this again.
Well, avoiding contamination
is an evidence collection imperative.
Maintaining an evidentiary chain
or a chain of custody,
definitely a evidence collection imperative.
And acting in order of volatility,
meaning collecting information or evidence
before it disappears, is overwritten
or no longer useful,
is an evidence collection imperative.
Creating a media clone, that's not done
during the evidence collection stage.
Creating the media clone would be done
during the acquisition stage.
So I'm gonna choose creating a media clone.
You agree? Let's check.
And that's correct.
My next question, why should
media evidence hash fingerprints be created?
So why do we ever create a hash?
To prove integrity, to establish non-repudiation,
to identify the examination technique
or to maintain confidentiality.
So why are we gonna have a media evidence
hash fingerprint or a CRC,
however we wanna call it?
Kinda hash fingerprints, a little bit redundant.
It's like saying hash, hash or fingerprint, fingerprint,
but you get the idea.
Why are we doing this?
Oh, I think we all know, right?
We do it to prove integrity.
A hash or a CRC or a fingerprint, right,
is a visual representation, right, of the media.
And we know that if anything changes whatsoever
when we make that next hash or fingerprint,
CRC, it will be different and we'll know
that something changed.
Or if it's the same, well, we've proven the integrity.
We know that everything has remained
as it should be.
Do you agree?
Let's check. And that's correct.
We're gonna arrange the evidence here
in order of volatility.
So we're gonna arrange the evidence
in order of volatility.
We'll start with number one.
We have virtual memory, log files,
RAM and static data.
So if we're gonna collect virtual memory,
log files, RAM and static data,
what's the very first thing that we're gonna collect?
Then do the second, then the third,
then the fourth.
Definitely put me on pause for a moment
and figure this one out.
Well, the first thing we're gonna collect is RAM.
Why?
'Cause we know that RAM is easily degradable,
that it gets overwritten,
or it could end up not being useful.
Or if we lose power, right,
we're gonna lose what's in RAM.
So first, RAM.
Oh, number two is already there for us.
Next, we're gonna do virtual memory,
for really all of the same reasons
that we collected RAM, except that virtual memory,
at least, is written to the drive,
so we've got a little bit of better chance
of keeping it around.
After that, oh, already right in our order.
How about log files?
The log files is written to static media,
but we know that log files
have a specific size that they can grow to,
so there's always the possibility a log file
is gonna get overwritten.
And then, lastly, static data,
which should not change.
So our evidence in order of volatility: RAM,
virtual memory, log files, static data.
Do you agree?
All right, let's see.
And that is correct.
Okay, I want you to select the cluster
that illustrates slack space.
So we have three 4K clusters here.
It looks like in the first cluster,
we've got ones and zeros throughout the whole cluster.
The second cluster looks like it's empty,
like it's never been written in.
And the third 4K cluster looks like
it has information in about,
I don't know, 9/10 of it.
It's been written to about 9/10 of it.
So which one of these clusters
illustrates slack space?
All right, and make your choice.
Are we gonna click on the first 4K,
the middle 4K or the last 4K?
Put me on pause if you wanna think about it.
I'm gonna click on the last 4K
because this area right here,
the area that's grayed out,
that you don't see ones and zeros,
that's gonna be the slack space.
And that's the area where we could potentially
get parts of deleted files,
recover parts of deleted files from.
Let's check.
And that is correct.
All right, our next question.
We want to arrange the incident response phases
in the correct order.
So we've got detection, containment,
eradication, lessons learned,
validation and confirmation, and recovery.
And we wanna arrange these incident response plans
in the correct order.
So what's the first thing that's gotta happen?
Well, you gonna put me on pause and figure it out?
Go ahead and do that, if you want.
All right, well, let's do it together, then.
We have detection.
That's right up there already as number one.
That's the first thing we're gonna do, right?
After we have detected, what do we do next,
contain, eradicate, lessons learned,
validation or recovery?
Well, I think the next thing we're gonna do
is validation and confirmation
that this really is an incident.
Once we have confirmed it's an incident,
what do we wanna do?
Well, already, right there,
we're gonna contain it, right?
We don't want it to get any bigger.
We wanna contain it, limit the damage.
After that, oh, already there.
We're gonna eradicate it.
After eradication, what do we wanna do?
Well, now we're gonna go into our recovery phase
and get everything back to normal.
And then once everything is back to normal,
we're gonna do our lessons learned, right,
so that we can say, "Why did this happen?
Should we do anything different in the future?
Could we have prevented this from happening?"
So our correct order: detection,
validation and confirmation,
containment, eradication,
recovery, lessons learned.
You agree? Let's check.
And that is correct.
So question nine.
This method of problem solving is used to investigate
known problems and identify what happened,
and the underlying causes.
Is this key performance indicators,
also known as KPIs, a cost-benefit analysis,
a root cause analysis, known as an RCA,
or a balanced scorecard?
This was a method of problem solving
that we used to investigate known problems
and identify what happened and the underlying causes.
So not just the symptoms,
but the underlying causes.
So go ahead and put me on pause, if you need,
but if not, just go ahead and choose that answer.
Key performance indicators, a cost-benefit analysis
a root cause analysis or a balanced scorecard.
I'm gonna choose a root cause analysis
because the underlying causes, that's the root cause.
And we really want to identify what happened
and the underlying causes so they can prevent
that problem from happening again.
Let's check. And that's correct.
All right, our last one.
Responsibility for damages
that result from a security compromise
in your business.
Is this downstream liability,
due care, due diligence
or a declaration?
This is responsibility for damages that result
from a security compromise in your business.
What do you think?
I introduced this term to you in this lesson.
Downstream liability, due care,
due diligence or declaration.
Well, due care is a standard of care
that a reasonable person would exercise.
Due diligence, remember, is doing
our investigation before we enter into a relationship,
during the life of a relationship,
and definitely before we renew a contract.
Declaration, that's just kind of a term
thrown in here, I think.
Downstream liability, that's what I'm going with.
The responsibility for damages that result
from a security compromise
in your business that would impact others
right, downstream, right?
And the responsibility for damages is liability.
So downstream liability,
that's what we're gonna go with.
You agree? Let's check.
And that is correct.
Awesome. Great job.
All right, up next, Lesson 22.
Given a scenario, we're gonna use data sources
to support an investigation.
I'll see you there.