Reading Time: 1 minute Map the organization stakeholders against the NIST IR categories (C2M2, NIST.SP800-61 r2) Implementing Cisco Cybersecurity Operations (210-255) The best I could find for this topic were the stakeholders defined by the Cybersecurity Capability Maturity Model (C2M2) documentation as listed below. Decision makers (executives) who control the allocation of resources and the management of risk in […]
Reading Time: 2 minutes Map elements to these steps of analysis based on the NIST.SP800-61 r2 Implementing Cisco Cybersecurity Operations (210-255) NIST.SP800-61 r2 defines an Incident Response Life Cycle as shown above. For the SECOPS test, it is necessary to know some of the common elements of the steps in the Incident Response Life Cycle. Preparation Gather Useful Information […]
Reading Time: 1 minute Describe the elements that should be included in an incident response plan as stated in NIST.SP800-61 r2 Implementing Cisco Cybersecurity Operations (210-255) NIST’s SP 800-61 was developed to help organizations formulate incident response plans. It can be found here. Each organization’s incident response plan will be different. There are some key elements that occur in […]
Reading Time: 1 minute Interpret a provided intrusion event and host profile to calculate the impact flag generated by Firepower Management Center (FMC) Implementing Cisco Cybersecurity Operations (210-255) The firepower management console (FMC) presents information about the incidents and hosts. Impact flag 1 indicates an incident against a host that is vulnerable to the attack. Impact flag 2 indicates […]
Reading Time: 1 minute Compare and contrast impact and no impact for these items: False Positive, False Negative, True Positive, True Negative Implementing Cisco Cybersecurity Operations (210-255) Security analysts must work to minimize both false positives and false negatives. False positives take up time to determine that the detection is not a problem. False negatives let malicious activity succeed […]
Reading Time: 2 minutes Map the provided events to these source technologies: NetFlow, IDS / IPS, Firewall, Network application control, Proxy logs, Antivirus Implementing Cisco Cybersecurity Operations (210-255) NetFlow NetFlow (or IPFIX) data will contain the standard 5-tuple of information: source IP address, destination IP address, source port, destination port, and the protocol. IDS/IPS Intrusion Detection or Protection Systems […]
Reading Time: 2 minutes Interpret common artifact elements from an event to identify an alert Implementing Cisco Cybersecurity Operations (210-255) IP Address (source/destination) IP address artifacts are useful to help identify both the attacker and the victim in a cybersecurity incident. IP address information can also help with tracking an attacker when they pivot through other systems. Client and […]
Reading Time: 1 minute Extract files from a TCP stream when given a PCAP file and Wireshark Implementing Cisco Cybersecurity Operations (210-255) For this example, I made a sample pcapng file using Wireshark. I did a wget of a graphics file from my website. Go to File>Export Objects>HTTP (works the same with the other protocols listed) 2. Choose the […]
Reading Time: 3 minutes Identify these key elements in an intrusion from a given PCAP file : Source address, Destination address, Source port, Destination port, Protocols, and Payloads Implementing Cisco Cybersecurity Operations (210-255) PCAP files are a way of storing packet data captured using a packet sniffer like Wireshark. The Wireshark website has dozens of example packet captures that […]
Reading Time: 1 minute Identify the elements from a NetFlow v5 record from a security event Implementing Cisco Cybersecurity Operations (210-255) When it comes to Netflow, the 5-tuple is king. Be sure to know the 5-tuple. Source IP Address Destination IP Address Source Port Destination Port Protocol 10.1.1.2 192.168.1.3 23343 443 TCP 10.1.3.3 192.168.3.2 43232 53 UDP 192.168.4.5 172.16.3.2 […]
© Ben Story 2019.
© Pack IT Forwarding 2019. Powered by WordPress
