Post Tes Keamanan Siber

Post Test Keamanan Siber (Cyber Security Post Test)

Incident Response

• A set of procedures to respond to and manage cyber security incidents
• Goals:
  • Minimize damage and downtime
  • Contain and eradicate the incident
  • Restore systems and data
  • Conduct post-incident activities (lessons learned, reporting)
• Incident response team (IRT) roles:
  • Incident manager
  • Technical leads
  • Communication specialist
  • Legal and HR representatives

Security Information

• Collection, monitoring, and analysis of security-related data from various sources
• Types of security information:
  • Logs (system, application, network)
  • Alerts (IDS, antivirus, firewall)
  • Vulnerability scan results
  • Threat intelligence feeds
• Security information and event management (SIEM) systems:
  • Centralize and analyze security data
  • Provide real-time alerts and incident response

Vulnerability Assessment

• Identification, classification, and prioritization of vulnerabilities in systems and applications
• Types of vulnerability assessments:
  • Network-based (e.g., Nessus, OpenVAS)
  • Host-based (e.g., OS and application scans)
  • Application-based (e.g., web application scans)
• Vulnerability assessment methods:
  • Automated scanning
  • Manual testing
  • Code reviews

Compliance and Governance

• Ensuring cyber security practices align with laws, regulations, and industry standards
• Compliance frameworks:
  • HIPAA (Health Insurance Portability and Accountability Act)
  • PCI-DSS (Payment Card Industry Data Security Standard)
  • ISO 27001 (International Organization for Standardization)
• Governance structures:
  • Cyber security policies
  • Roles and responsibilities
  • Incident response plans

Threat Intelligence

• Collection, analysis, and dissemination of threat-related data to improve cyber security
• Threat intelligence types:
  • Strategic (high-level, threat landscape)
  • Tactical (short-term, specific threats)
  • Operational (threat response, incident handling)
• Threat intelligence sources:
  • Open-source intelligence (OSINT)
  • Human intelligence (HUMINT)
  • Signal intelligence (SIGINT)
  • Intelligence from security vendors and partners

Tanggapan Insiden Keamanan Siber

• Proses dan prosedur untuk menghadapi dan mengelola insiden keamanan siber
• Tujuan:
  • Meminimalkan kerusakan dan downtime
  • Mengandung dan menghapus insiden
  • Memulihkan sistem dan data
  • Melakukan kegiatan post-insiden (pelajaran yang dipetik, pelaporan)

Informasi Keamanan

• Pengumpulan, pemantauan, dan analisis data keamanan terkait dari berbagai sumber
• Jenis informasi keamanan:
  • Log (sistem, aplikasi, jaringan)
  • Peringatan (IDS, antivirus, firewall)
  • Hasil pemindaian vulnerabilitas
  • Feed intelijen ancaman
• Sistem manajemen informasi dan keamanan (SIEM):
  • Mengumpulkan dan menganalisis data keamanan
  • Menyediakan peringatan waktu nyata dan respons insiden

Penilaian Kerentanan

• Identifikasi, klasifikasi, dan prioritas kerentanan dalam sistem dan aplikasi
• Jenis penilaian kerentanan:
  • Berbasis jaringan (misalnya Nessus, OpenVAS)
  • Berbasis host (misalnya pemindaian OS dan aplikasi)
  • Berbasis aplikasi (misalnya pemindaian aplikasi web)
• Metode penilaian kerentanan:
  • Pemindaian otomatis
  • Pengujian manual
  • Review kode

Kesesuaian dan Tata Kelola

• Memastikan praktik keamanan siber sesuai dengan hukum, peraturan, dan standar industri
• Kerangka kerja kesesuaian:
  • HIPAA (Undang-Undang Portabilitas dan Akuntabilitas Asuransi Kesehatan)
  • PCI-DSS (Standar Keamanan Data Kartu Pembayaran Industri)
  • ISO 27001 (Organisasi Internasional untuk Standardisasi)
• Struktur tata kelola:
  • Kebijakan keamanan siber
  • Peran dan tanggung jawab
  • Rencana tanggap insiden

Intelijen Ancaman

• Pengumpulan, analisis, dan diseminasi data ancaman terkait untuk meningkatkan keamanan siber
• Jenis intelijen ancaman:
  • Strategis (tidak langsung, peta ancaman)
  • Taktis (jangka pendek, ancaman spesifik)
  • Operasional (tanggapan ancaman, penanganan insiden)
• Sumber intelijen ancaman:
  • Intelijen sumber terbuka (OSINT)
  • Intelijen manusia (HUMINT)
  • Intelijen sinyal (SIGINT)
  • Intelijen dari vendor dan mitra keamanan

Menguji pengetahuan tentang respons terhadap insiden keamanan siber, termasuk tujuan dan peran tim respons insiden.