BCA Cyber Security Incident Response Life Cycle — practice questions

1. Section 2.1 defines three related terms in sequence, and the first is the broadest. 2. "An event is any observable occurrence in a system or network." The examples given are deliberately mundane: a user connecting to a file share, a server receiving a request for a web page, a user sending email, a firewall blocking a connection attempt. 3. So an event carries no judgement about whether anything bad happened. Most events are entirely ordinary. 4. An occurrence with a negative consequence is the definition of an *adverse event*, the next term up, with examples such as system crashes and packet floods. 5. A violation, or an imminent threat of a violation, of security policy is the definition of a computer security *incident*, the narrowest of the three. _Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 2.1 "Events and Incidents"_

1. Section 3.2.2 splits the signs of an incident into two categories and defines both in adjacent sentences. 2. "A precursor is a sign that an incident may occur in the future." 3. "An indicator is a sign that an incident may have occurred or may be occurring now." 4. So the whole distinction is tense: a precursor points forward, an indicator points at the present or the recent past. 5. The practical value of a precursor is stated in the same section: if one is detected, "the organization may have an opportunity to prevent the incident by altering its security posture", or at minimum to watch the target more closely. 6. A false positive is a different idea again, defined in the sources table as an alert indicating malicious activity "when in fact there has been none". _Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 3.2.2 "Signs of an Incident"_

1. Ask what the sign tells you about timing, because that is what separates the two categories. 2. An antivirus alert that a host *is infected* reports a state that already exists so it is a sign that an incident "may have occurred or may be occurring now". That is the definition of an indicator. 3. Section 3.2.2 lists this example almost word for word: "Antivirus software alerts when it detects that a host is infected with malware." 4. A precursor would have to point forward, like the guide's own examples: web server log entries showing a vulnerability scanner in use, an announcement of a new exploit against the organization's mail server, or a group threatening to attack. 5. A false positive is possible for any alert, but it is a judgement about accuracy rather than a category of sign. The guide notes indicators must still be evaluated, since some "could happen for several reasons other than a security incident, including human error". 6. A network flow is a source of signs, defined as "a particular communication session occurring between hosts", not a sign itself. _Source: NIST SP 800-61 Rev. 2 "Computer Security Incident Handling Guide" (Aug 2012), section 3.2.2 "Signs of an Incident"_