Digital Forensics and Incident Response

Restoring data from backups after a malicious deletion incident.

Bringing down web servers affected by a DDoS attack and performing health checks before bringing them back online.

Using antimalware software to remove malware introduced by an employee.

Applying patches to fix vulnerabilities exploited by an attacker.

Ensuring the system is not vulnerable to the same attack again by patching and hardening it.

Checking and restoring permissions after an incident to ensure access is properly controlled.

Verifying the functionality of logging systems after an incident to ensure they are not compromised.

Reducing the attack surface by hardening the system to minimize vulnerabilities.

A group communication protocol where clients communicate through channels.

Commands can be sent to bots through encoded messages embedded in HTML.

Attackers can use DNS requests to send control messages to bots.

Attackers can send commands using the messaging features and account profiles of social media platforms.

IRC is no longer widely used because it's easy to detect and block.

Blocking HTTP/HTTPS completely might disrupt normal business operations, so attackers can easily use it as a C&C channel.

DNS messages aren't generally inspected, making it attractive for C&C because bots don't need direct external connections.

Attackers can leverage social media platforms for C&C operations due to their widespread use and messaging capabilities.

The maximum amount of data loss that an organization can tolerate before experiencing significant business disruption. It specifies the point in time to which data can be recovered from a backup.

The maximum amount of time that an organization can afford to be without access to its critical systems or data. It defines how long a system can be down before causing significant disruption.

A process that helps organizations identify and prioritize risks, understand the potential impact of those risks, and then develop strategies to mitigate those risks.

A response strategy that aims to reduce the possibility or impact of a risk by implementing controls and measures.

A risk mitigation technique that aims to reduce the likelihood of a risk event by implementing measures that deter or discourage the threat.

A risk mitigation technique that aims to reduce the impact of a risk event by implementing measures that minimize the damage or consequences.

A risk response strategy that involves completely avoiding or eliminating any activity or process that is associated with a particular risk.

A risk response strategy where an organization accepts the possibility of a risk event occurring and decides to take no action to mitigate it, often due to the cost of mitigation exceeding the potential loss.

A file on the hard drive that stores pages of memory when the computer's RAM is full. It allows the operating system to use disk space as virtual memory, extending the available memory.

The process of copying data from a storage device, creating a forensically sound image, preserving the original data for investigation. It involves preserving data integrity, ensuring that no changes are made to the original.

Disk image acquisition method where the data is copied while the computer is running. It might capture more data but can introduce changes to the data, potentially affecting its legal admissibility.

Disk image acquisition method where the computer is shut down before copying data. This can potentially preserve the data in a cleaner state, but there's the risk of malware wiping traces during shutdown.

Disk image acquisition method where the computer is abruptly disconnected from power, potentially preserving data, but risky due to the chance of data corruption.

Hardware or software devices that block write operations to a storage device during image acquisition, ensuring the original data remains unaltered. They are crucial for forensic investigations to maintain data integrity.

A common misconception that mounting a drive as read-only within a host OS effectively protects data. However, this is not sufficient for forensic purposes. Write blockers are essential, as they operate at a lower firmware level.

A hardware or software-based write blocker can be used to prevent modifications to a storage device during forensics.

Transferring responsibility for potential risks to a third party, such as an insurance company or external vendor, through contracts or agreements.

Communicating the potential impact of a risk in a way that is easily understood by stakeholders, including the cause of the risk, its potential consequences, and the affected parties.

A document summarizing the results of risk assessments, including likelihood and impact ratings, countermeasures, and responsible parties.

Comparing vulnerability scan results to best-practice frameworks helps ensure compliance with regulations and industry standards. These scans can identify potential vulnerabilities that may not be considered high priority or risk, allowing for informed decision-making.

Exceptions are situations where a vulnerability is acknowledged but accepted due to its importance for system functionality or a conscious risk acceptance decision. It allows for reasonable exclusions from remediation strategies.

The process of determining the priority of vulnerabilities to address based on their severity and impact. This involves considering the system context, existing risk assessments, and vulnerability scores to create a plan for remediation.

This involves reducing the exposure to the effects of risk factors. It can be achieved through implementing countermeasures, reducing the likelihood of attacks, or mitigating the impact if an attack does occur.

A risk assessment that identifies and evaluates potential vulnerabilities to a system's security. It aims to understand the probability of an attack and the potential impact if successful. It helps organizations prioritize remediation efforts.