Incident Response: Disaster Recovery Plan
49 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What is the primary focus of a Business Continuity Plan (BCP)?

  • To develop detailed guidance for information systems
  • To keep an organization functioning during disruptions (correct)
  • To respond to specific incidents like fires and floods
  • To execute a full recovery to normal operations

Which of the following is NOT typically covered by a Disaster Recovery Plan?

  • Incident-focused responses
  • Retaining employee job functions during recovery (correct)
  • Full recovery to normal operations
  • Systematic testing of plans and procedures

What stage in the NIST 800-34 process involves identifying key assets for a business?

  • Planning maintenance of the plan
  • Developing a policy statement
  • Conducting a business impact analysis (BIA) (correct)
  • Creating contingency strategies

Which standard addresses business continuity management in the context of information security?

<p>ISO 27001 (B)</p> Signup and view all the answers

What is a critical component of the Incident Response Plan (IRP)?

<p>Addressing specific incidents thoroughly (B)</p> Signup and view all the answers

How often should the testing and training of the recovery plans typically be conducted?

<p>Annually (A)</p> Signup and view all the answers

Which of the following is an element of the contingency planning guide provided by NIST?

<p>Identifying preventative controls (D)</p> Signup and view all the answers

What does NFPA 1600 pertain to in the context of planning?

<p>Standards on Disaster/Emergency Management and Business Continuity (A)</p> Signup and view all the answers

What is the highest score indicating a very easy exploitability of an attack?

<p>10 (B)</p> Signup and view all the answers

Which rating indicates a critical vulnerability that should be addressed immediately?

<p>40-50 (A)</p> Signup and view all the answers

During the detection phase of an incident response process, what is the main goal?

<p>Determine affected systems (C)</p> Signup and view all the answers

How is the overall threat rating calculated?

<p>Summing scores across five key areas (C)</p> Signup and view all the answers

What is the primary objective during the containment phase of incident response?

<p>Limit the incident's impact (C)</p> Signup and view all the answers

Which score indicates that the vulnerability is hard to discover?

<p>0 (D)</p> Signup and view all the answers

What is considered a low risk threat rating?

<p>Low (1-10) (A)</p> Signup and view all the answers

What is a critical step in the eradication phase of incident response?

<p>Patch vulnerabilities (D)</p> Signup and view all the answers

What is the primary purpose of a Business Impact Analysis (BIA)?

<p>To contemplate likely disasters and their impact on the organization (C)</p> Signup and view all the answers

Which of the following must always be lower than the Maximum Tolerable Downtime (MTD)?

<p>All of the above (D)</p> Signup and view all the answers

What is the difference between a differential backup and an incremental backup?

<p>Differential backup includes all changes since the last full backup; incremental backup includes all changes since the last backup of any type. (D)</p> Signup and view all the answers

What does Recovery Point Objective (RPO) refer to?

<p>The maximum amount of data loss an organization can tolerate (D)</p> Signup and view all the answers

Which of the following represents the highest level of damage potential according to the criteria provided?

<p>10: Destruction of an information system; data or application unavailability (D)</p> Signup and view all the answers

How are vulnerabilities effectively described when discussing a computer incident?

<p>Through the vulnerabilities that led to the incident (C)</p> Signup and view all the answers

Which backup type captures all changes since the last backup of any type?

<p>Incremental backup (B)</p> Signup and view all the answers

Which component reflects the average time it takes to repair an item?

<p>Mean Time to Repair (MTTR) (A)</p> Signup and view all the answers

What is the maximum amount of RAM that a 32-bit system can address?

<p>4 GB (D)</p> Signup and view all the answers

Which files are essential during the boot process of a Windows system?

<p>Min.drivers (B)</p> Signup and view all the answers

What does the Windows swap file help to augment?

<p>Random Access Memory (A)</p> Signup and view all the answers

Which command would be used to identify currently loaded DLLs on a Windows machine?

<p>ListDLLs (A)</p> Signup and view all the answers

What kind of data does Index.dat store?

<p>Web addresses and search queries (D)</p> Signup and view all the answers

Which of the following is NOT one of the five Windows registry hives?

<p>Internet (C)</p> Signup and view all the answers

What is a primary characteristic of volatile memory?

<p>Requires constant power to retain data (B)</p> Signup and view all the answers

What term describes the file that stores items from memory temporarily on the hard disk in a Windows system?

<p>pagefile.sys (A)</p> Signup and view all the answers

What is the primary purpose of capturing a memory dump in forensic analysis?

<p>To analyze active processes and potential malware (A)</p> Signup and view all the answers

What do the properties of MAC in file systems refer to?

<p>File modified, created, and accessed dates (A)</p> Signup and view all the answers

What technique is used to inject a malicious DLL into a legitimate process?

<p>DLL Injection (B)</p> Signup and view all the answers

What is the purpose of the Pslist command in Volatility?

<p>Listing running processes (C)</p> Signup and view all the answers

Which memory capturing tool offers a graphical interface?

<p>RAM Capturer (B)</p> Signup and view all the answers

What does the term 'hollowed processes' refer to?

<p>Legitimate processes that have been hijacked by malware (D)</p> Signup and view all the answers

Which of the following best describes the stack in computer memory?

<p>Automatically managed memory for temporary variables (B)</p> Signup and view all the answers

What is the function of the Memory Address Register (MAR)?

<p>Stores memory addresses to fetch data (C)</p> Signup and view all the answers

In Linux forensics, which command is essential for undeleting files?

<p>extundelete (C)</p> Signup and view all the answers

Which term refers to the memory that is lost when the device is powered off?

<p>Volatile memory (C)</p> Signup and view all the answers

Which command in Volatility is specifically used for identifying malware?

<p>Malfind (C)</p> Signup and view all the answers

Which shell was originally the default shell for UNIX systems?

<p>Bourne shell (sh) (D)</p> Signup and view all the answers

What are the three main sections of a network packet?

<p>Header, Payload, Footer (A)</p> Signup and view all the answers

Which command is used to check the current configuration of a router?

<p>Show running-config (A)</p> Signup and view all the answers

Why should a forensic investigator not shut down a router when gathering evidence?

<p>It can erase valuable evidence (A)</p> Signup and view all the answers

Which protocol operates on port 25?

<p>SMTP (A)</p> Signup and view all the answers

What type of data can TCP header synchronization bits provide?

<p>Interesting forensic data (A)</p> Signup and view all the answers

Flashcards

Disaster Recovery Plan (DRP)

A plan to respond to events like fires, floods, or malware infections, to ensure business continuity and data recovery.

Business Continuity Plan (BCP)

A plan to maintain core business functions during disruptive events, aiming for sustained operation until full recovery.

Incident Response Plan (IRP)

A plan specifically for dealing with incidents, such as malware attacks or data breaches, focusing on mitigation and containment.

ISO 27001

A broad standard for information security management, including aspects of business continuity.

Signup and view all the flashcards

NIST 800-34

A contingency planning guide for information technology systems, providing a seven-step process for BCP and DRP development.

Signup and view all the flashcards

Business Impact Analysis (BIA)

A critical step to identify important organizational assets and assess their impact during a disruption, for effective contingency planning.

Signup and view all the flashcards

Contingency strategies

Backup plans and alternative methods to maintain business functionality when normal operations are jeopardized.

Signup and view all the flashcards

Information System Contingency Plan

A detailed plan for handling disruptions to information systems (IT), focusing on the recovery of IT systems.

Signup and view all the flashcards

Maximum Tolerable Downtime (MTD)

The longest a system or organization can be down before recovery is impossible.

Signup and view all the flashcards

Mean Time to Repair (MTTR)

Average time it takes to repair an item. Must be lower than MTD.

Signup and view all the flashcards

Recovery Time Objective (RTO)

Target time to return to normal business operations. Must be lower than MTD.

Signup and view all the flashcards

Recovery Point Objective (RPO)

Amount of data loss acceptable. Directly related to backups.

Signup and view all the flashcards

Full Backup

All changes in data are included in this type of backup.

Signup and view all the flashcards

Incremental Backup

Copies all the changes made since the last backup of any kind.

Signup and view all the flashcards

Damage Potential

Assessment of the possible impact an attack could have. (0-10 scale)

Signup and view all the flashcards

Exploitability

How easy it is for an attacker to use a vulnerability to launch an attack.

Signup and view all the flashcards

Affected Users

The number of people who could be impacted by a successful attack.

Signup and view all the flashcards

Discoverability

How easy it is to find a vulnerability in a system.

Signup and view all the flashcards

Overall Threat Rating

A combined score representing the overall risk posed by a vulnerability.

Signup and view all the flashcards

Incident Response Process

A structured approach to handling security incidents, including detection, containment, eradication, recovery, and follow-up.

Signup and view all the flashcards

Containment

The crucial step in incident response aimed at limiting the impact of a security breach.

Signup and view all the flashcards

Eradication

The process of completely eliminating a security threat from a system.

Signup and view all the flashcards

Recovery

Returning systems and operations back to normal after a security incident.

Signup and view all the flashcards

Network Packet

A small chunk of data sent across a network. It has three sections: header, payload, and footer.

Signup and view all the flashcards

Packet Header

The first part of a network packet that contains information about the packet, like its destination and source addresses, and the type of data it carries.

Signup and view all the flashcards

Router Forensics

Examining router configurations and logs to understand network activity and identify potential security incidents.

Signup and view all the flashcards

Capture Packets

Using specialized software to intercept and store network data packets for later analysis.

Signup and view all the flashcards

Analyze Packets

Examining captured network packets to identify patterns, unusual activity, or security threats.

Signup and view all the flashcards

32-bit processing

A type of computer architecture that can address up to 4,294,967,295 bytes of memory and is limited to 4 GB of RAM. It is commonly referred to as x86.

Signup and view all the flashcards

64-bit processing

A type of architecture that can address a much larger memory space, up to 18,446,744,073,709,551,616 bytes. It is commonly referred to as x64.

Signup and view all the flashcards

BIOS (Basic Input/Output System)

The firmware that initiates the boot process and controls basic hardware functions during startup. It performs the Power-On Self-Test (POST) and reads the Master Boot Record (MBR).

Signup and view all the flashcards

Master Boot Record (MBR)

A special sector on the hard drive that contains the boot loader and information about disk partitions. It helps the computer locate the operating system.

Signup and view all the flashcards

Boot Loader

A program that loads the operating system kernel into memory. It is responsible for switching between 32-bit and 64-bit processing modes.

Signup and view all the flashcards

Volatile Memory Analysis

A forensic technique used to examine the contents of computer memory. It involves collecting a memory dump, computing a hash for integrity, and analyzing the contents in an isolated environment.

Signup and view all the flashcards

Stack Memory

A region of memory used for storing local variables and function call information. It operates on a LIFO (Last-In, First-Out) principle.

Signup and view all the flashcards

Heap Memory

A region of memory where data can be allocated and deallocated dynamically. This means data can persist beyond function calls.

Signup and view all the flashcards

Windows Swap File (pagefile.sys)

A temporary file on the hard disk that acts as an extension of RAM. It stores data that is not currently being used by active programs, allowing for quick access when needed.

Signup and view all the flashcards

Windows Log Files

Files that record events and activities happening on a Windows system. They can be viewed using Event Viewer and provide valuable information for troubleshooting and security analysis.

Signup and view all the flashcards

DLL Injection

A malware technique that involves injecting a malicious DLL into a legitimate running process, often by modifying system registry keys to include the malicious DLL in the process's load order.

Signup and view all the flashcards

Process Hollowing

A technique where malware creates a process in a suspended state, then replaces its memory space with its own malicious code, effectively hijacking the legitimate process without crashing it.

Signup and view all the flashcards

Dumpit

A command-line tool used for capturing memory snapshots, saving them as .raw files, enabling forensic analysis of the memory state.

Signup and view all the flashcards

RAM Capturer

A tool with a graphical user interface for capturing memory, offering a more user-friendly approach compared to Dumpit.

Signup and view all the flashcards

Volatility

A free and powerful memory analysis tool that enables deep examination of captured memory images, providing insights into malware behavior, process activity, and system state.

Signup and view all the flashcards

Pslist

A Volatility command that lists all running processes within the captured memory image, providing information like process ID, name, and memory usage.

Signup and view all the flashcards

Hollowfind

A Volatility command specifically designed to identify processes that have been hollowed, allowing you to detect malware that has hijacked legitimate processes.

Signup and view all the flashcards

Moddump

A Volatility command used for dumping kernel driver information from the captured memory image, aiding in analyzing system level activities and potential malware presence.

Signup and view all the flashcards

Study Notes

Incident Response: Disaster Recovery Plan

  • Disaster recovery plans are in place to respond to various events like fires, floods, hurricanes, tornadoes, hard drive failures, network outages, malware infections, data theft, or data deletion.
  • Business Continuity Plans (BCP) aim to keep organizations functioning as optimally as possible until full recovery is achieved.
  • Incident Response Plans (IRP) focus on handling specific incidents.
  • Disaster Recovery Plans (DRP) concentrate on restoring normal operations to full functionality.

Federal Standards for BCPs

  • ISO 27001: A broad standard for information security management systems, including business continuity management.
  • NIST 800-34: A guide for contingency planning in information technology systems, outlining a seven-step process for BCP/DRP projects (policy statement, business impact analysis, preventative controls, contingency strategies).

Business Impact Analysis (BIA)

  • BIA is a process where the disaster recovery team considers potential disasters and their impact on the organization.
  • BIA identifies critical systems, priority of response, and maximum tolerable downtime (MTD).
  • Maximum Tolerable Downtime (MTD) is the maximum amount of time a system or organization can be down before recovery is impossible.
  • Mean Time To Repair (MTTR) is the average time to repair an item.
  • Mean Time To Failure (MTTF) is the amount of time on average before a system fails during normal use.
  • Recovery Point Objective (RPO): Tied to backups, determines the amount of data loss allowed.
  • Annualized Loss Expectancy (ALE): Calculated by multiplying Single Loss Expectancy (SLE) and Annualized Rate of Occurrence (ARO)
  • Single Loss Expectancy (SLE): calculated by multiplying Asset Value (AV) and Exposure Factor (EF).

Types of Backups

  • Full Backup: All changes since the last full backup
  • Differential Backup: All changes since the last full backup
  • Incremental Backup: Changes made since the last backup
  • Hierarchical Storage Management: Continuous backup system.

Describing a Computer Incident

  • CVSS Score Metrics: Scoring system for measuring computer incidents.
  • Damage Potential: Measures the severity of damage from an attack, ranging from no damage to severe destruction.
  • Reproducibility: Measures how easily the attack can be reproduced (difficult to impossible).
  • Exploitability: Measures the difficulty in launching the attack (e.g., requiring advanced skills or readily available tools).
  • Affected Users: Determines the number of users affected by the incident (e.g., individual user, many users).
  • Discoverability: Measures how easily the threat is discovered.

Incident Response Process

  • Detection: Identifying affected systems.
  • Containment: Limiting the incident's spread.
  • Eradication: Removing the threat.
  • Recovery: Returning to business as usual.
  • Follow-up: Evaluating and improving future responses.

Windows Forensics

  • 32-bit vs. 64-bit processing: Differences in memory addressing capacity.
  • Boot Process: BIOS, POST, MBR, etc.
  • Volatile Data: Analyzing running memory.
  • Volatile memory analysis: analysis of running memory.

Types of Memory

  • Stack: Allocated based on last-in, first-out.
  • Heap: Area where programs allocate memory dynamically.
  • Memory Address Register (MAR): Holds memory addresses.
  • Memory Data Register (MDR): Holds memory data in transit.

Linux Forensics

  • Linux file systems and logs.
  • Forensically interesting directories.
  • Important shell commands: ls, cp, mkdir, cd, rm, rmdir

Linux Shells

  • Bourne shell (sh)
  • Bourne-again shell (Bash)
  • C shell (csh)
  • Korn shell (ksh).

Network Forensics

  • Understanding Network Packets (Header, Payload, Footer)
  • Packet Analysis
  • Capturing Packets
  • Conducting router forensics
  • Firewall logs
  • Common Ports: FTP(20,21), SSH(22), Telnet(23), SMTP(25), DNS(53),HTTP(80),POP3(110).
  • Router Commands: show version, show running-config, show stacks, show interfaces to analyze the router's information.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Related Documents

Forensics Final Notes PDF

Description

This quiz explores key concepts of disaster recovery and business continuity planning. It covers the distinctions between Business Continuity Plans (BCP), Incident Response Plans (IRP), and Disaster Recovery Plans (DRP), along with relevant federal standards like ISO 27001 and NIST 800-34. Test your understanding of the principles involved in ensuring organizational resilience during crises.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser