Threat Intelligence and Reconnaissance
This phase of the Cyber Kill Chain involves gathering information about a target before launching an attack.
What is reconnaissance?
This type of log records successful and failed log attempts on a system.
What is an authentication log?
This system score rates the vulnerabilities based on severity from 0 to 10.
What is the Common Vulnerability Scoring System (CVSS)?
The first step in the incident response lifecycle.
What is preparation?
This federal regulation requires healthcare organizations to protect patient data.
What is HIPAA?
This intelligence-gathering technique involves passively collecting data without direct interaction with a target system
What is open-source intelligence (OSINT)?
A SIEM system primarily helps security teams do these two things.
What are collect and correlate security logs?
A CVSS score of 9.8 is categorized under this severity level.
What is critical?
This type of malware encrypts a victims files and demands payment.
What is ransomeware?
PCI-DSS compliance is required for companies handling this type of data.
What is credit card data?
The MITRE ATT&CK framework maps out these two primary components of cyber adversaries.
What are tactics and techniques?
A security team sees an increase in anomalous outbound traffic at 3 AM. What type of alert should they investigate?
What is a behavioral anomaly alert?
This process involves finding and fixing security flaws in software before an attacker can exploit them.
What is patch management?
This forensic artifact tracts system and user activity in a Windows enviroment.
What are event logs?
This risk assessment methodology prioritizes threats based on likelihood and impact.
What is a quantitative risk assessment?
This type of cyber threat actor is typically well-funded, highly skilled, and operates on behalf of nation-states.
What is an Advanced Persistent Threat (APT)?
This cybersecurity practice continuously analyzes network traffic for threats in real time.
What is network Security monitoring (NSM)?
This Diamond Model consists of four core elements: Adversary, Capability, Infrastructure and the fourth element.
What is Victim?
In digital forensics, this process ensures evidences remains unchanged from collection to courtroom.
What is chain of custody?
This type of security control is designed to detect and respond to threats in real time.
What is a detective control?
In the Cyber Kill Chain, this phase involves the attacker establishing a foothold inside the network, often using malware or backdoors.
What is exploitation?
The term for a cyber attack that manipulates DNS queries to redirect users to malicious sites.
What is DNS spoofing?
This exploit class abuses memory corruption to execute arbitrary code on a vulnerable system.
What is buffer overflow?
The command nmap -sS -sU -Pn uses these two protocols and disables this feature to identify open ports while evading detection.
What are TCP SYN, UDP and ICMP ping?
The concept of reducing risk to an acceptable level rather than eliminating it completely.
What is risk mitigation?