Cybersecurity Roles and Responsibilities
74 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What does the acronym "CISO" stand for?

Chief Information Security Officer

Which of the following is NOT a typical function performed by a cybersecurity analyst?

  • Auditing security processes and procedures
  • Implementing and configuring security controls
  • Managing IT infrastructure and hardware (correct)
  • Conducted risk assessments

What are the two key features of a good cybersecurity analyst?

Creative thinkers and problem solvers

A SOC (Security Operations Center) typically exists for smaller companies.

<p>False (B)</p> Signup and view all the answers

Which of these is NOT a key requirement for a successful SOC?

<p>Integration of business processes (D)</p> Signup and view all the answers

What is the purpose of a security control?

<p>To mitigate vulnerabilities and risk, ensuring the confidentiality, integrity, availability, non-repudiation, and authentication of data and information.</p> Signup and view all the answers

Which document defines the Security and Privacy Controls for Federal Information Systems and Organizations?

<p>NIST Special Publication 800-53 (A)</p> Signup and view all the answers

The NIST Special Publication 800-53 is a proprietary framework that requires payment to use.

<p>False (B)</p> Signup and view all the answers

Which of these is NOT a classification of control families presented in older versions of NIST Special Publication 800-53?

<p>Administrative (D)</p> Signup and view all the answers

What is the difference between a 'technical control' and an 'operational control'?

<p>A technical control is implemented through hardware, software, or firmware, while an operational control is implemented through people and procedures.</p> Signup and view all the answers

The three control families, Technical, Operational, and Managerial, are still included in the latest versions of NIST Special Publication 800-53.

<p>False (B)</p> Signup and view all the answers

Which of the following would BEST be considered an example of a 'managerial control'?

<p>Performing a risk assessment (A)</p> Signup and view all the answers

What is the purpose of 'defense in depth' in cybersecurity?

<p>To create a layered security approach, using multiple controls to protect against different types of attacks and prevent attackers from reaching sensitive information.</p> Signup and view all the answers

A security camera is considered a 'corrective control' because it records an intruder's actions.

<p>False (B)</p> Signup and view all the answers

What is the main goal of a 'corrective control'?

<p>To reduce the impact of a successful intrusion by mitigating damage or restoring the system to its original state.</p> Signup and view all the answers

Explain the difference between a 'deterrent control' and a 'preventive control'?

<p>A deterrent control discourages an intrusion attempt by signaling a possible consequence to a potential attacker, but it doesn't necessarily prevent access. A preventive control is actively in place to stop access or prevent an attack from being successful.</p> Signup and view all the answers

What is a 'compensating control' and why is it used?

<p>A compensating control is a substitute for a principle control when the principle control is too expensive or difficult to implement. It provides an alternative way to achieve a similar level of security.</p> Signup and view all the answers

An IDS (Intrusion Detection System) is an example of a 'responsive control' because it monitors network traffic and can react to suspicious activity.

<p>True (A)</p> Signup and view all the answers

What is the primary goal of using CIA (Confidentiality, Integrity, Availability) when selecting security controls?

<p>To ensure that the chosen security controls adequately protect the confidentiality, integrity, and availability of sensitive data and information.</p> Signup and view all the answers

Which security control primarily upholds the tenet of 'integrity' for data?

<p>Digital signatures (A)</p> Signup and view all the answers

Using cloud elasticity is an effective control for ensuring the 'confidentiality' of data.

<p>False (B)</p> Signup and view all the answers

What are the two security controls that could be added to a database backup system to uphold all the tenets of CIA?

<p>Access control system and encryption.</p> Signup and view all the answers

Which of these is NOT a key component of the security intelligence cycle?

<p>Implementation and configuration (D)</p> Signup and view all the answers

How can threat intelligence be used to improve incident response?

<p>Threat intelligence provides tactical information about the attacker's location within the network, their activities, and their techniques, aiding in containing the attack and mitigating its impact.</p> Signup and view all the answers

Threat intelligence is primarily used for strategic decision-making, focusing on long-term security measures.

<p>False (B)</p> Signup and view all the answers

What is the main difference between security intelligence and cyber threat intelligence?

<p>Security intelligence focuses on internal data and insights about the security of your own systems, whereas cyber threat intelligence focuses on external data and insights from the broader threat landscape.</p> Signup and view all the answers

The use of SIEMs (Security Information and Event Management Systems) falls under the 'collection and processing' phase of the security intelligence cycle.

<p>True (A)</p> Signup and view all the answers

Why is it important to use automation and analysis tools like AI and machine learning in the 'analysis' phase of the intelligence cycle?

<p>The volume of data collected in modern networks is vast. Automation and AI tools help sift through massive datasets, detect anomalies, and identify suspect activities that would be difficult for humans to manually process in a timely manner.</p> Signup and view all the answers

Which of the following is NOT a level of intelligence disseminated during the 'dissemination' phase of the security intelligence cycle?

<p>Analytical (B)</p> Signup and view all the answers

What is the primary purpose of the 'feedback' phase in the security intelligence cycle?

<p>To continuously improve the intelligence gathering process by identifying what worked well, what didn't work well, and how to refine future efforts based on lessons learned and changing threat landscapes.</p> Signup and view all the answers

What is an ISAC (Information Sharing and Analysis Center)?

<p>An ISAC is a non-profit organization that provides a forum for sharing sector-specific threat intelligence and security best practices among its members within a particular industry.</p> Signup and view all the answers

Which sector DOES NOT have a dedicated ISAC?

<p>Education (A)</p> Signup and view all the answers

Organizations in the critical infrastructure sector are not typically concerned with threats against ICS (Industrial Control Systems) and SCADA (Supervisory Control and Data Acquisition) systems.

<p>False (B)</p> Signup and view all the answers

What is the main purpose of threat intelligence sharing within an organization?

<p>To proactively disseminate threat intelligence to relevant teams and personnel, enabling them to take appropriate actions to mitigate risks and improve organizational security posture.</p> Signup and view all the answers

Threat intelligence is most effective when it is only shared internally within an organization.

<p>False (B)</p> Signup and view all the answers

How can threat intelligence be used to enhance vulnerability management?

<p>By leveraging threat intelligence, organizations can identify potential vulnerabilities that may not have been uncovered by traditional vulnerability scanning. This helps prioritize remediation efforts and focus on the most critical vulnerabilities based on current threat landscape trends.</p> Signup and view all the answers

Threat intelligence primarily focuses on 'unknown threats,' as those pose the greatest risk.

<p>False (B)</p> Signup and view all the answers

What is a 'zero-day exploit,' and why is it so problematic?

<p>A zero-day exploit is a vulnerability in software or hardware that is unknown to developers or security researchers. It exposes the flaw before a patch or mitigation is available, allowing attackers to exploit it before defenses can be implemented.</p> Signup and view all the answers

The use of obfuscation techniques allows attackers to transform 'unknown threats' into 'known threats,' making them more difficult to detect.

<p>False (B)</p> Signup and view all the answers

Explain the concept of 'recycled threats' in the context of malware.

<p>Recycled threats are created by combining and modifying portions of existing malware code to generate new, unique variants that bypass signature-based detection. The malware is essentially 're-engineered' to create a new, undetected threat.</p> Signup and view all the answers

Which of the following is NOT a classification of malware threats based on the 'known/unknown' concept?

<p>Unknown knowns (C)</p> Signup and view all the answers

What are 'known unknowns' in the context of malware?

<p>Known unknowns are threats that are known to exist but have not been fully characterized or have not yet been developed into specific detection mechanisms. These threats may have been observed in the wild but are poorly understood or lacked countermeasures.</p> Signup and view all the answers

What is the role of a cybersecurity analyst in an organization?

<p>A cybersecurity analyst is responsible for protecting sensitive information and preventing unauthorized access to electronic data and the systems that protect it. They work to harden and protect networks, servers, laptops, desktops, and smartphones.</p> Signup and view all the answers

What is a Security Operations Center (SOC)?

<p>A SOC is a location where security professionals monitor and protect critical information assets within an organization. It acts as a single point of contact area where data comes in for analysis by security analysts.</p> Signup and view all the answers

Smaller companies usually have their own SOCs to monitor their networks.

<p>False (B)</p> Signup and view all the answers

What is the primary function of a Computer Security Incident Response Team (CSIRT)?

<p>A CSIRT is responsible for responding to data breaches and other cybersecurity incidents that occur within an organization.</p> Signup and view all the answers

What is the role of the Chief Information Security Officer (CISO) in an organization?

<p>The CISO is a senior-level position responsible for overseeing the security of an organization's information systems and assets. They lead and provide governance for the organization's cybersecurity efforts.</p> Signup and view all the answers

What are the three main categories of security controls discussed in the provided text?

<p>Technical, Operational, Managerial (B)</p> Signup and view all the answers

What is a technical control, also known as a logical control?

<p>A technical control is a security control that is implemented through the use of hardware, software, or firmware.</p> Signup and view all the answers

What is an operational control?

<p>An operational control is a security control that is implemented primarily by people, rather than technology.</p> Signup and view all the answers

What is a managerial control?

<p>A managerial control provides oversight and governance for information systems. They involve processes like risk identification, vulnerability assessment, and control selection.</p> Signup and view all the answers

The three categories of technical, operational, and managerial controls are still included in the NIST Special Publication 800-53.

<p>False (B)</p> Signup and view all the answers

What is an administrative control?

<p>An administrative control is a hybrid control category that combines elements of both operational and managerial controls.</p> Signup and view all the answers

What is a preventative control?

<p>A preventative control is a security control that aims to reduce the likelihood of a successful attack.</p> Signup and view all the answers

What is a detective control?

<p>A detective control is a security control that identifies and records attempted or successful intrusions, even if it doesn't prevent them.</p> Signup and view all the answers

What is a physical control?

<p>A physical control is a security control that acts against in-person intrusion attempts.</p> Signup and view all the answers

What is a compensating control?

<p>A compensating control is a substitute for a primary control that may not be feasible or affordable to implement.</p> Signup and view all the answers

What is a responsive control?

<p>A responsive control proactively monitors for potential vulnerabilities and attacks, taking action to mitigate them before they cause damage.</p> Signup and view all the answers

What are the two primary forms of cyber threat intelligence?

<p>Narra ve reports and data feeds (B)</p> Signup and view all the answers

Organizations should rely on only one type of cyber threat intelligence – either narra ve reports or data feeds – for the best security.

<p>False (B)</p> Signup and view all the answers

What is the purpose of the security intelligence cycle?

<p>The security intelligence cycle is a structured process for collecting, processing, analyzing, dissemina ng, and reviewing security intelligence to improve the effectiveness of security efforts.</p> Signup and view all the answers

What is the purpose of the requirements phase of the security intelligence cycle?

<p>The requirements phase sets the goals and objectives for intelligence gathering, ensuring that the process is focused on collecting relevant data.</p> Signup and view all the answers

What is the purpose of the collection and processing phase of the security intelligence cycle?

<p>The collection and processing phase involves gathering data from various sources and converting it into a standard format suitable for analysis.</p> Signup and view all the answers

What is the purpose of the analysis phase of the security intelligence cycle?

<p>The analysis phase involves examining collected data and applying use cases to identify potential threats and vulnerabilities.</p> Signup and view all the answers

What is the purpose of the dissemination phase of the security intelligence cycle?

<p>The dissemination phase involves communicating the results of security intelligence analysis to relevant stakeholders who need to take action.</p> Signup and view all the answers

What is the purpose of the feedback and review phase of the security intelligence cycle?

<p>The feedback and review phase involves evaluating the effectiveness of the entire security intelligence cycle and identifying areas for improvement.</p> Signup and view all the answers

What is an Information Sharing and Analysis Center (ISAC)?

<p>An ISAC is a not-for-profit organization that provides sector-specific threat intelligence and best practices among its members within a particular industry.</p> Signup and view all the answers

Which of the following is NOT a critical infrastructure sector as defined by the Department of Homeland Security?

<p>Educa on (A)</p> Signup and view all the answers

What is the difference between a known threat and an unknown threat?

<p>A known threat can be identified using basic signature or pattern matching, while an unknown threat cannot.</p> Signup and view all the answers

What is a zero-day exploit?

<p>A zero-day exploit is an unknown vulnerability in software or hardware that is exploited before a patch or fix is available.</p> Signup and view all the answers

What is obfuscated malware code?

<p>Obfuscated malware code is malicious code whose execution is hidden through techniques like compression, encryption, or encoding to make it difficult to analyze.</p> Signup and view all the answers

What is behavior-based detection?

<p>Behavior-based detection is a malware detection method that analyzes an object's intended actions before it executes to determine if it is malicious.</p> Signup and view all the answers

What is a recycled threat?

<p>A recycled threat is a new threat created by combining and modifying parts of existing exploit code, making detection by signature-based methods more difficult.</p> Signup and view all the answers

What is the difference between a known unknown and an unknown unknown?

<p>A known unknown is a malware that includes obfuscation techniques to avoid signature detection, while an unknown unknown is entirely new malware with novel attack vectors and exploits.</p> Signup and view all the answers

Flashcards

Cybersecurity Analyst

A senior role within an organization's security team, responsible for protecting sensitive information and preventing unauthorized access to electronic data and systems.

Security Specialist/Technician

A cybersecurity professional responsible for configuring and implementing security controls, including firewalls, intrusion detection systems, and other threat management technologies.

Cybercrime Investigator

A cybersecurity professional who investigates cybercrimes in the digital forensics realm.

IncidentResponse Analyst

A cybersecurity professional who specializes in responding to data breaches and cyberattacks, focusing on containment and remediation.

Signup and view all the flashcards

Chief Information Security Officer (CISO)

The highest-ranking information security professional within an organization, responsible for establishing and overseeing security policies and ensuring their effective implementation.

Signup and view all the flashcards

Penetration Tester

A cybersecurity expert who simulates attacks on systems with permission to identify vulnerabilities and weaknesses.

Signup and view all the flashcards

Security Engineer

A cybersecurity professional who focuses on designing and building tools and techniques for security, creating a comprehensive security architecture for an organization.

Signup and view all the flashcards

Security Operations Center (SOC)

A location where security professionals monitor and protect critical information assets within an organization, acting as a centralized point for security data and analysis.

Signup and view all the flashcards

Security Control

A distinct set of actions, techniques or tools implemented to mitigate vulnerabilities and reduce risks to ensure the security of data and information.

Signup and view all the flashcards

Technical Control

A security control that aims to block or prevent an attack from being successful by implementing technical barriers.

Signup and view all the flashcards

Operational Control

A security control implemented primarily through human actions, such as security rules, procedures, and employee training.

Signup and view all the flashcards

Managerial Control

A security control that focuses on the oversight and governance of information systems, including risk identification, assessment, and selection of other suitable security controls.

Signup and view all the flashcards

Administrative Control

A hybrid category of security controls that combine aspects of both operational and managerial controls.

Signup and view all the flashcards

Preventive Control

A security control acting to prevent an attack. It reduces the likelihood of someone successfully breaching the system.

Signup and view all the flashcards

Detective Control

A security control designed to detect an attack or attempted intrusion. They identify and record any suspicious activity but don't necessarily stop it.

Signup and view all the flashcards

Corrective Control

A security control that aims to eliminate or reduce the impact of an attack. It focuses on restoring a system to a functional state after an attack.

Signup and view all the flashcards

Physical Control

A security control that deals with physical access to a building or system, including alarms, locks, security guards, and security systems.

Signup and view all the flashcards

Deterrent Control

A security control that discourages an intrusion attempt by visibly signifying the presence of a security system or measure. It may not actively prevent an attack.

Signup and view all the flashcards

Compensating Control

A security control acting as a substitute for a primary control when the primary control is unavailable or too costly to implement.

Signup and view all the flashcards

Responsive Control

A security control that actively monitors the network for potential threats and vulnerabilities, taking action to mitigate them before they can cause damage.

Signup and view all the flashcards

Security Intelligence

The process of collecting, analyzing, and disseminating information about the security status of systems and networks.

Signup and view all the flashcards

Cyber Threat Intelligence

The process of gathering, analyzing, and sharing information about external threats and attackers, including malware, zero-day exploits, and attack tactics.

Signup and view all the flashcards

Narrative Threat Intelligence Report

A detailed written report analyzing a specific adversary group, malware type, or attack tactic, providing in-depth information about their capabilities, targets, and techniques.

Signup and view all the flashcards

Data Feed

A collection of data points, including IP addresses, domain names, and malware hashes, that indicate known malicious activity. These feeds provide actionable information to block or mitigate threats.

Signup and view all the flashcards

Security Information and Event Management (SIEM)

A system that collects, normalizes, and analyzes security data from various sources to provide a comprehensive view of security events and threats within an organization.

Signup and view all the flashcards

Indicator of Compromise (IOC)

A unique identifier that helps identify a suspicious or malicious activity, potentially indicating the presence of a threat.

Signup and view all the flashcards

Zero-Day Exploit

A security vulnerability that is undiscovered and not yet known to the public.

Signup and view all the flashcards

Behavior-Based Detection

A security control that analyzes the actions and behavior of a program or file to determine its malicious intent before it can execute.

Signup and view all the flashcards

Recycled Threat

A type of malware that has been altered or combined with other malware to create a new threat that may bypass security controls.

Signup and view all the flashcards

Known Unknowns

Malware that contains obfuscation techniques designed to hide its presence or functionality from security scanners.

Signup and view all the flashcards

Unknown Unknowns

A completely new threat or attack vector that is unknown and undiscovered.

Signup and view all the flashcards

Information Sharing and Analysis Center (ISAC)

A non-profit organization dedicated to sharing threat intelligence and security best practices among members within a specific critical industry.

Signup and view all the flashcards

What is a Cybersecurity Analyst?

A senior role within an organization's security team, responsible for protecting sensitive information and preventing unauthorized access to electronic data and systems.

Signup and view all the flashcards

What is a Security Specialist/Technician?

A specialist or technician who performs hands-on configuration of systems under the direction of a cybersecurity analyst.

Signup and view all the flashcards

What is a Cybercrime Investigator?

A cybersecurity professional who investigates cybercrimes in the digital forensics realm.

Signup and view all the flashcards

What is an Incident Response Analyst?

A cybersecurity professional who specializes in responding to data breaches and cyberattacks, focusing on containment and remediation.

Signup and view all the flashcards

What is a Chief Information Security Officer (CISO)?

The highest-ranking information security professional within an organization, responsible for establishing and overseeing security policies and ensuring their effective implementation.

Signup and view all the flashcards

What is a Penetration Tester?

A cybersecurity expert who simulates attacks on systems with permission to identify vulnerabilities and weaknesses.

Signup and view all the flashcards

What is a Security Engineer?

A cybersecurity professional who focuses on designing and building tools and techniques for security, creating a comprehensive security architecture for an organization.

Signup and view all the flashcards

What is a Security Operations Center (SOC)?

A location where security professionals monitor and protect critical information assets within an organization, acting as a centralized point for security data and analysis.

Signup and view all the flashcards

What is a security control?

A distinct set of actions, techniques or tools implemented to mitigate vulnerabilities and reduce risks to ensure the security of data and information.

Signup and view all the flashcards

What is a Technical Control?

A security control that aims to block or prevent an attack from being successful by implementing technical barriers.

Signup and view all the flashcards

What is an Operational Control?

A security control implemented primarily through human actions, such as security rules, procedures, and employee training.

Signup and view all the flashcards

What is a Managerial Control?

A security control that focuses on the oversight and governance of information systems, including risk identification, assessment, and selection of other suitable security controls.

Signup and view all the flashcards

What is an Administrative Control?

A hybrid category of security controls that combine aspects of both operational and managerial controls.

Signup and view all the flashcards

What is a Preventive Control?

A security control acting to prevent an attack. It reduces the likelihood of someone successfully breaching the system.

Signup and view all the flashcards

What is a Detective Control?

A security control designed to detect an attack or attempted intrusion. They identify and record any suspicious activity but don't necessarily stop it.

Signup and view all the flashcards

What is a Corrective Control?

A security control that aims to eliminate or reduce the impact of an attack. It focuses on restoring a system to a functional state after an attack.

Signup and view all the flashcards

What is a Physical Control?

A security control that deals with physical access to a building or system, including alarms, locks, security guards, and security systems.

Signup and view all the flashcards

What is a Deterrent Control?

A security control that discourages an intrusion attempt by visibly signifying the presence of a security system or measure. It may not actively prevent an attack.

Signup and view all the flashcards

What is a Compensating Control?

A security control acting as a substitute for a primary control when the primary control is unavailable or too costly to implement.

Signup and view all the flashcards

What is a Responsive Control?

A security control that actively monitors the network for potential threats and vulnerabilities, taking action to mitigate them before they can cause damage.

Signup and view all the flashcards

What is Security Intelligence?

The process of collecting, analyzing, and disseminating information about the security status of systems and networks.

Signup and view all the flashcards

What is Cyber Threat Intelligence?

The process of gathering, analyzing, and sharing information about external threats and attackers, including malware, zero-day exploits, and attack tactics.

Signup and view all the flashcards

What is a Narrative Threat Intelligence Report?

A detailed written report analyzing a specific adversary group, malware type, or attack tactic, providing in-depth information about their capabilities, targets, and techniques.

Signup and view all the flashcards

What is a Data Feed?

A collection of data points, including IP addresses, domain names, and malware hashes, that indicate known malicious activity. These feeds provide actionable information to block or mitigate threats.

Signup and view all the flashcards

What is a Security Information and Event Management (SIEM)?

A system that collects, normalizes, and analyzes security data from various sources to provide a comprehensive view of security events and threats within an organization.

Signup and view all the flashcards

What is an Indicator of Compromise (IOC)?

A unique identifier that helps identify a suspicious or malicious activity, potentially indicating the presence of a threat.

Signup and view all the flashcards

What is a Zero-Day Exploit?

A security vulnerability that is undiscovered and not yet known to the public.

Signup and view all the flashcards

What is Behavior-Based Detection?

A security control that analyzes the actions and behavior of a program or file to determine its malicious intent before it can execute.

Signup and view all the flashcards

What is a Recycled Threat?

A type of malware that has been altered or combined with other malware to create a new threat that may bypass security controls.

Signup and view all the flashcards

What is a Known Unknown?

Malware that contains obfuscation techniques designed to hide its presence or functionality from security scanners.

Signup and view all the flashcards

What is an Unknown Unknown?

A completely new threat or attack vector that is unknown and undiscovered.

Signup and view all the flashcards

Study Notes

Cybersecurity Roles and Responsibilities

  • Cybersecurity Analyst: A senior role responsible for protecting sensitive information and preventing unauthorized access. They harden networks, servers, and devices. Junior analysts typically have 2-4 years experience as a specialist/technician first. Analysts work under senior analysts and report to the CISO. Their responsibilities include implementing and configuring security controls (firewalls, intrusion detection systems), working in a SOC or CSIRT, auditing security processes and procedures for third-party vendors, training employees, performing risk assessments, vulnerability assessments, penetration tests, and maintaining threat intelligence. Analyst work within a team, with 5-10 junior analysts and 1-2 senior analysts. They report to the CISO. Analysts need strong problem-solving and creative thinking skills, and excellent communication to explain issues and proposed solutions to non-technical audiences.
  • Specialist/Technician: Performs hands-on system configurations under the direction of a cybersecurity analyst. Covered by the Security+ exam.
  • Cybercrime Investigators: Work in digital forensic areas. Covered in the course.
  • Incident Response Analysts: Respond to data breaches and cyberattacks. Covered in the course.
  • Penetration Tester: Breaks into systems with permission to identify vulnerabilities. A role a cybersecurity analyst may fill.
  • Manager/Engineer: Focuses on building security tools and techniques to design systems for the organization. Analysts operate the daily systems.
  • CISO (Chief Information Security Officer): Senior C-level position, providing governance and leadership. Oversees the analyst team and other security personnel.

Security Operations Center (SOC)

  • A SOC is a central security monitoring point for critical information assets. It's a single point of contact for all incoming security data; junior analysts monitor logs/network information for Indicators of Compromise (IOCs).
  • Indicators of Compromise (IOCs): Like fingerprints of malicious activity. Junior analysts look for them.
  • Senior analysts oversee junior analysts and guide incident response.
  • SOCs are often used by larger organizations, governments, and healthcare due to high costs.
  • Smaller companies may outsource SOC services.
  • Key requirements for a successful SOC: authority, motivated and skilled professionals, integrated security processes, incident response capabilities, internal protection (of the SOC), separating signal from noise (analyzing data through the use of automation), and collaboration with other SOCs for threat intelligence sharing.

Security Control Categories

  • Security controls are technologies or procedures mitigating vulnerabilities and risks, ensuring confidentiality, integrity, availability, non-repudiation, and authentication (CIA Triad).
  • Historical approach was reactive – implementing controls after threats emerged. Not a sustainable model.
  • Security controls are now selected strategically using a risk management framework for a layered defense approach (defense in depth).
  • NIST Special Publication 800-53: A US government publication on security and privacy controls for IS. A crucial resource. Memorization is not required, but review is recommended.
  • Control categories (technical, operational, managerial): While less relevant today, the technical, operational, and managerial classification remains useful concepts for categorizing controls. These were removed from newer NIST publications but remain on the CySA+ exam.
  • Hybrid controls, like vulnerability management, often blend categories (operational and managerial).
  • Functional categories of controls: preventative, detective, corrective
  • Additional categories: physical, deterrent, compensating, and responsive controls.

Threat Intelligence

  • Security intelligence focuses on internal network security posture.
  • Cyber threat intelligence focuses on external threats (attacker groups, malware, vulnerabilities).
  • Threat intelligence comes in narrative reports (analysis) and data feeds (provides tactical information to make decisions).
  • Organizations subscribe to intelligence feeds from companies like FireEye, McAfee, etc. to defend against emerging threats.

Information Sharing and Analysis Centers (ISACs)

  • ISACs (and the UK's CSIP): Sector-specific, not-for-profit information sharing groups.
  • Focus on sharing threat intelligence and security best practices within a particular industry.
  • Multiple ISAC types exist (critical infrastructure, government, healthcare, financial, aviation).
  • Critical Infrastructure: Vital physical or virtual systems critical to a country’s economy and safety. Examples include 16 critical sectors identified by the Department of Homeland Security (chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government facilities, healthcare and public health, information technology, nuclear reactors, materials and waste, transportation systems, and water and wastewater systems).

Threat Classification

  • Known threats: Easily identified using signature matching (e.g., malware, documented exploits).
  • Unknown threats: Cannot be identified by signature matching. Examples include: zero-day exploits, obfuscated malware, behavior-based attacks, recycled threats, known-unknowns, unknown-unknowns.

Security Intelligence Cycle

  • Five phases: Requirements/Planning, Collection/Processing, Analysis, Dissemination, Feedback
  • Requirements/Planning: Defining goals and constraints (legal restrictions, organizational factors).
  • Collection/Processing: Standardizing data into usable formats.
  • Analysis: Using automated analysis, AI, and machine learning to filter data (categorizing data as known good, known bad, unsure).
  • Dissemination: Communicating analyzed information to stakeholders (strategic, operational, tactical).
  • Feedback: Evaluating process effectiveness to identify improvements.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

Cybersecurity Roles and Responsibilities PDF
Cybersecurity Roles and Responsibilities PDF

Description

Explore various roles in the cybersecurity field, including the responsibilities of analysts, specialists, and chief information security officers. This quiz will help you understand the critical functions within an organization that protect sensitive information and respond to cyber incidents.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser