Which of the following is true about confidence levels in the intrusion analysis Diamond model quizlet?

Recommended textbook solutions

Human Resource Management

15th EditionJohn David Jackson, Patricia Meglich, Robert Mathis, Sean Valentine

249 solutions

Information Technology Project Management: Providing Measurable Organizational Value

5th EditionJack T. Marchewka

346 solutions

Human Resource Management

15th EditionJohn David Jackson, Patricia Meglich, Robert Mathis, Sean Valentine

249 solutions

Operations Management: Sustainability and Supply Chain Management

12th EditionBarry Render, Chuck Munson, Jay Heizer

1,698 solutions

Establishing a hypothesis. A hypothesis is needed to test and should have actionable results based on the threat that the hypothesis considers.

Profiling threat actors and activities. This helps ensure that you have considered who may be a threat, and why, as well as what their typical actions and processes are.

Threat hunting tactics. These are key to success in threat hunting activities. The skills, techniques, and procedures are where action meets analysis. This step includes executable process analysis, which the CySA+ exam outline specifically mentions.

Reducing the attack surface area. This allows resources to be focused on the remaining surface area, making protection more manageable.

Bundling critical assets into groups and protection zones. This helps with managing attack surface area, threat hunting, and response activities, since each asset doesn't need to be individually assessed or managed as a unique item.

Attack vectors must be understood, assessed, and addressed based on analysis of threat actors and their techniques as well as the surface area that threat actors can target.

Integrated intelligence combines multiple intelligence sources to provide a better view of threats.

Improving detection capabilities. This is a continuous process as threats improve their techniques and technology. If you do not improve your detection capabilities, new threats will bypass existing capabilities over time.

what is the following list an example of?

unauthorized software & files, suspicious emails, suspicious registry & file system changes, unknown port & protocol usage, excessive bandwidth usage, rogue hardware, service disruption & defacement, suspicious or unauthorized account usage

Lack of training: Untrained staff may be susceptible to malicious activity such as phishing emails and vishing phone calls

Data retention: Data backups are a preventative measure taken by most organizations. However, they can become unwieldy and difficult to maintain. Be sure to implement strong security measures for stored data.

Unpatched systems: Systems may be vulnerable to known exploits when unpatched.

Weak passwords: Threat actors have access to tables of many thousand common passwords. Users who utilize weak passwords make their systems vulnerable.

Default credentials: Hardware and appliances often come with a default username and password. When the username and/or password is unchanged, attackers can easily gain access to network infrastructure.

Open ports: Scanning tools used by threat actors will find any opening possible into a system or device. If open ports are not protected, attackers can gain access to a system.

Default programs: Most systems come preconfigured to run default programs. Some of these programs may have known vulnerabilities that can be exploited.

A) Reliable: No doubt of authenticity, trustworthiness, or competency; has a history of complete reliability.

B) Usually Reliable: Minor doubt about authenticity, trustworthiness, or competency; has a history of valid information most of the time.

C) Fairly Reliable: Doubt of authenticity, trustworthiness, or competency, but has provided valid information in the past.

D) Not Usually Reliable: Significant doubt about authenticity, trustworthiness, or competency, but has provided valid information in the past.

E) Unreliable: Lacking in authenticity, trustworthiness, or competency; history of invalid information.

F) Cannot Be Judged: No basis exists for evaluating the reliability of the source.

Which answer best describes the purpose of CVE quizlet?

Which type of hacker usually targets government agencies corporations or other entities they are protesting?

Which team is responsible for defending the network against attacks in a risk training scenario?

Which two factors do you need to account for when correlating an event timeline using a SIEM?