CISSP Cheat Sheet Series

Domain 7: Security Operations

Incident Scene
Assign ID to the scene • Incident environment protection • ID and possible
sources of evidence • Collect evidence • Avoid or minimize evidence
contamination
Locard’s
Exchange
Principle

In a crime the suspected person leaves something and takes
something. The leftovers can be used to identify the suspect.

Live EvidencePrimaryEvidence• Most reliable and used by trial• Original documents–Eg. Legal contracts• No copies or duplicates

SecondaryEvidence• Less powerful and reliable than primary evidence.
• Eg. Copies of originals, witness oral evidence.
• If primary evidence is available secondary of the same content
is not valid.

Direct Evidence
Conclusive
Evidence
Corroborative
Evidence
Hearsay
Evidence

Can prove without a backup support.
• Eg. witness testimony by his/her own 5 senses.
• Cannot contradict, conditional evidence, no other supportive
evidence requires• Cannot be used to directly prove a fact
• Use as substantiate for other evidence

Preserve Availability • Authorization and Integrity • Redundancy and Fault Tolerance •Backup and Recovery Systems • Identity and Access Management• Hierarchical Storage Management (HSM): continuous online
backup system Using optical storage.
• Media History: Media usage log• Media Labeling and Storage: safe store of media after labelingsequentially• Environment: Temperature and heat Eg. Magnetic media

Sanitizing andDisposing ofData• Data Purging: degaussing Archived data not usable forforensics• Data Clearing: Cannot recover using keyboard• Remanence: Data left in media deleted

Network andResourceManagement• Redundant hardware• Fault-tolerant technologies• Service Level Agreements (SLA’s)• MTBF and MTTR
• Single Point of Failure (SPOF)

Incident
Response steps

1. Detect • 2. Respond • 3. Report • 4. Recover • 5. Remediate • 6.
ReviewChangeManagement• Changes should be formally requested• Analyze requests against goals to ensure validity• Cost and effort estimation before approval• Identify the change steps after approval• Incremental testing during implementation• Complete documentation

Threats andPreventativeMeasures• Clipping levels: Deﬁne a baseline for normal user errors,• Modiﬁcation from Standards Eg. DDOS
• Unusual patterns or events• Unscheduled reboots: Eg. Hardware or operating system issue• Input/output Controls

Intrusion Detection & Prevention Systems (IDS &IPS)
IDS (IntrusionDetection System)
IPS (IntrusionPrevention System)

Automated inspection of logs and real-time system events
to detect intrusion attempts and system failures. IDSs are aneffective method of detecting many DoS and DDoS attacks.

Monitor and analyze the internals of a computing system,
including its network connection points. Eg. Mainframe
computerNIDS(Network-based IDS)

Hardware based device or software applications used tomonitor and analyse network activity, speciﬁcally scanningfor malicious activities and policy violations.

Hierarchical Recovery
Types
1. Manual
2. Automatic Recovery

Types of System Failure• System reboot• Emergency restart• System cold start

Data Destruction and Reuse
Object reuse

Use after initial use

Data remanence

Remaining data after erasure Format magnetic media 7times (orange book

Clearing

Overwriting media to be reused

Purging

Degaussing or overwriting to be removed

Destruction

Complete destruction, preferably by burning

Disaster Recovery Planning

Other recoveryissues

1. Discovery

Reliable

Consistent facts. Evidence not tampered or modiﬁed.

2. Protection

Relevant

Reasonable facts, with proof of crimes, acts and methods used,
event documentation

3. Recording

Evidence obtained lawfully

5. Analysis

Permissible

Interviewing and Interrogation
Interviewing Collect facts to determine matters of the incident.
Obtain a confession by evidence retrieval method.
Interrogation• The Process: Prepare questions and topics, summarize information
Opinion Rule Witnesses test only the facts of the case, not used as evidence.
ExpertWitnesses

Network Analysis
Use of existing controls to inspect a security breach incident. Eg. IDS/IPS, ﬁrewalllogs• Software Analysis: Forensic investigation of applications which was running while
the incident happened.
• Hardware/ Embedded Device Analysis: Eg. review of Personal computers &Smartphones

Governing Laws
• Common law - USA, UK Australia, Canada• Civil law - Europe, South America• Islamic and other Religious laws – Middle East, Africa, Indonesia, USA
The 3 Branches of Law

Teams responsible for DR implementation - Salvage team - Workon normal /primary site to make suitable for normal operations• Interfacing with other groups• Fraud and Crime: Eg. vandalism, looting• Financial disbursement• Documenting the Plan - Required documentation• Activation and recovery procedures• Plan management• HR involvement• Costs• Internal /external communications• Detailed plans by team members• Legislative: Statutory law - Make the laws
• Executive: Administrative law - Enforce the laws
• Juridical: Interpret the laws
• Criminal law –violate government laws result incommonly imprisonment• Civil law – Wrong act against individual or organization
which results in a damage or loss. Result in ﬁnancial
penalties.
• Administrative/Regulatory law – how the industries,
organizations and oﬃcers should act. Punishments canbe imprisonment or ﬁnancial penalties

Categories of law

Uniform Computer
Information
Transactions Act(UCITA)

Common framework for the conduct of computer-related
business transactions. A federal law Eg. Use of software
licensingComputer Crime Laws
3 types of harm

• Unauthorized intrusion• Unauthorized alteration or destruction• Malicious code

Admissible evidence• Relevant, suﬃcient, reliable, does not have to betangible

Hearsay• Second hand data not admissible in court

Enticement• Is the legal action of luring an intruder, like in ahoneypot

Entrapment• Is the illegal act of inducing a crime, the individual had
no intent of committing the crime at ﬁrst

Data Loss Prevention (DLP)
Scans data for keywords and data patterns. Protects before an incident occurs.
Network-bas
ed DLP

Data in motion. Scans all outbound data looking for anomalies. Placein edge of the network to scan all outgoing data.

Endpoint-bas Data in use. Scans all internal end-user workstations, servers anded DLPdevices.

Digital Data States
Data at Rest
Data inMotion

Data that is stored on a device or a backup medium.
Data that is currently travelling across a network or on a device's
RAM ready to be read, updated, or processed.
Data that is being inputted, processed, used or altered.

Backup Types
Full

All ﬁles backed up, archive bit and modify bit will be deleted

Incremental

Backup ﬁles changed after last full backup, archive bit deleted.

Differential

Only modiﬁed ﬁles are backed up, do not delete archive bit.
Need last full backup and last incremental backup for a fullrestore.

Redundant servers

Eg. RAID, adding disks for increased fault tolerance.

Server clustering

Set of servers that process traﬃc simultaneously.

Disaster Recovery Test
Desk Check
Table-top exercise

4. Collection and identiﬁcation
6. Storage, preservation, transportation

Review contents of the plan
Disaster recovery team members gather and roleplay adisaster scenario

Simulation test

More intense than a roleplay, all support and tech staff meetand practice against disaster simulations

Parallel tests

Personnel are taken to an alternative site and commence
operations of critical systems, while original site continues
operatingFull-implementation Personnel are taken to an alternative site and commence
tests
operations of all systems, main site is shut down

Conﬁguration Management (CM)An ITILv2 and an ITSM process that tracks all of the individual Conﬁguration Items(CI)
Conﬁguration
Items (CI)

Version: state of the CI, Conﬁguration - collection of component
CI’s that makes another CI

Building

Assembling a component with component CI’s Build list

Artifacts

Recovery procedures. Eg. system restart. Should be accessedby authorized users from authorized terminals.

7. Present in court

Incident Response

8. Return to owner

Digital EvidenceSix principles to guide digital evidence
technicians

Can be used as evidence.

A IDS with additional caabilities to stop intrusions.

HIDS(Host-based IDS)

Disasterrecoveryprocess

Validity can be acceptable.

Data in Use

Firewalls

Evidence Lifecycle

Suﬃcient• Something heard by the witness where another person told

Asset Management

Storage
ManagementIssues

Characteristics of Evidence

Lifecycle

Response Capability • Incident response and handling •Recovery • FeedbackMitigation

Limit the impact of an incident.

Root Cause Analysis (RCA)• All general forensic and procedural
principles apply.

Fault tree analysis (FTA) Top down deductive failure analysis using boolean logic.

• Upon seizure, all actions should notchange the data.

Failure mode andeffects analysis (FMEA)• All people accessing the data shouldbe trained

Pareto Analysis

Looks at the predominant likely causes to deal with themﬁrst.

Cause mapping

Connects individual cause-and-effect relationships to giveinsights into the system of causes within an issue.

• All actions performed on the data
should be fully documented andaccessible.
• Anyone that possesses evidence isresponsible for all actions taken with it
while in their possession.
• Any agency that possesses evidence
is is responsible for compliance withthese principles.

Media Analysis
Part of computer forensic analysis
used for identiﬁcation and extractionof information from storage media.
Eg. Magnetic media, Optical media,
Memory (e.g., RAM)

Admissible Evidence
Relevant to the incident. The evidence
must be obtained legally.

Review of as many components, assemblies, andsubsystems as possible to identify potential failuremodes.

Disaster Recovery Methods
Hot SiteA real-time mirror of your system and network activity
running in sync. Allows for minimum disruption anddowntime.

Cold Site

An alternative workspace with power and HVAC setup, but
no hardware. All recovery efforts will be technician heavy.

Warm Site

A middle-ground solution which includes skeletal hardware,
software and connectivity to restore critical functionality.

Service Bureau

Contract with a service bureau to provide backup services.

Multiple centers /sites

Process between multiple data centers

Rolling / mobile sites Mobile homes or HVAC trucks.
• Hot site RTO: 5 minutes or hours• Warm site RTO: 1-2 days
• Mobile site RTO: 3-5 days
• Cold site RTO: 1 to 2 weeks

Recovery Time
Objectives (RTOs)

RAID, SAN, & NAS
RAID

Redundant Array of Independent / Inexpensive Disks

Digital Forensics

Disk Mirroring

Writing the same data across multiple hard disks, slower asdata is written twice, doubles up on storage requirements

Five rules of evidence:
Be authentic • Be accurate • Be complete• Be convincing • Admissible

Disk Striping

Writes data across multiple disks simultaneously, provides
higher write speed.

RAID 0• Writes ﬁles in stripes across multiple disks without using
parity information• 2 or more disks required• Fast reading and writing but no redundancy

Types:
Operational • Criminal • Civil • eDiscovery

RAID 1

Security Incident andEvent Management(SIEM)• Creates identical copies of drives - has redundancy• Space is effectively utilized, since half will be given toanother disk
• Expensive

RAID 3

Byte level data striping across multiple

RAID 4Block level data striping across multiple

RAID 5

Data and parity Information is striped together across alldrives

Log review automating
Real‐time analysis of events occurringon systems

RAID 0+1

Stripes data across available drives and mirrors to a seperate
set of disks

Investigation - To
Determine Suspects

Transaction Redundancy
Implementations
Electronic Vaulting • Remote Journaling• Database shadowing

System Hardening" • Uninstall unnecessary applications• Disable unnecessary services• Deny unwanted ports• External storage device restriction• Monitoring and Reporting• Vulnerability Management System• IDP/IPS: Attack signature engine
should be updated regularly

System Recovery
1. Rebooting system in single usermode, recovery console
2. Recovering all ﬁle systems active
before crash
3. Restore missing / damaged ﬁles
4. Recover security and access
controls

BCP Plan Development• Computing: strategy to protect - hardware, software, communication links, applications, data
Deﬁne the continuity • Facilities: use of primary or alternate/remote site buildings
strategy• People: operational and management• Supplies and equipment
Roles andresponsibilities• BCP committee: senior staff, business units, information systems, security administrator, oﬃcials from alldepartments

Physical security• CCTV• Fences-Small mesh and high gauge• Alarms• Intrusion detection: electromechanical, photoelectric, passive infrared, acoustical detection• Motion: wave pattern motion detectors, proximity detector• Locks: warded lock, combination lock, cipher lock, device lock, preset / ordinary door lock, programmablelocks, raking lock
• Audit trails: date and time stamps, successful/unsuccessful attempts, who attempted, who
granted/modiﬁed access controls• Security access cards: Photo ID card, swipe cards, smartcards• Wireless proximity cards: user activated or system sensing ﬁeld powered device

RAID 1+0 (RAID 10)

Each drive in a set is mirrored to an equivalent drive inanother set

Storage Area
Network (SAN)

Typically use Fibre Channel and iSCSI. High speed blick levelstorage.

Network-Attached
Storage (NAS)

Typically an NFS server, ﬁle-level computer data storage
server connected to a computer network.

Disaster Recovery Terminology & Concepts
MTTF

Mean Time To Failure

MTTR

Mean Time To RepairMTBF

Mean Time Between Failures, MTTF + MTTR

Transaction Redundancy
Implementations

Electronic Vaulting • Remote Journaling • Databaseshadowing

Business Continuity Planning
Business Continuity
Plan (BCP)

Concerns the preservation and recovery of business in theevent ofoutages to normal business operations.

Business Impact
Analysis (BIA)

The process of assessing the impact of an IT disruption.
BIA is part of BCP

Disaster Recovery Plan(DRP)

A framework of steps and actions that need to be taken
to achieve business continuity and disaster recoverygoals.
End Goal – Revert back to normal operations - planningand development must be done before the disaster - BIA
should be complete

Business Continuity
Steps

1. Scope and plan initiation
2. BIA - assess impact of disruptive processes
3. Business Continuity Plan development - Use BIA todevelop BCP Testing
4. Plan approval and implementation - management
approval

Trusted Recovery
Breach Conﬁrmation

Conﬁrm security breach not happen during system failure.

Failure Preparation

Backup critical information to enable recovery

System Recovery

After a failure of operating system or application, thesystem should work enough to have the system in asecure state