CISA Exam Prep Domain 5 - 2019
CISA Exam Prep Domain 5 - 2019
DOMAIN 5
1
ON THE CISA EXAM
Domain 1: Auditing
Domain 5: Information Systems
Protection of Process, 21%
Information Assets,
27%
Domain 2:
Governance and
Management of IT,
Domain 4: 17%
Information Systems
Operations and
Business Resilience,
23%
Domain 3: Information
Systems Acquisition,
Development and
Implementation, 12%
DOMAIN 5 OBJECTIVES
2
DOMAIN 5 TOPICS
INFORMATION ASSET
SECURITY AND CONTROL
3
ENSURE CONFIDENTIALITY, INTEGRITY
AND AVAILABILITY
Confidentiality
Security
Integrity Availability
4
AUDITING THE INFORMATION SECURITY MANAGEMENT
FRAMEWORK
Reviewing Written Policies, Procedures New IT Users
and Standards
Data Users
Formal Security Awareness and
Training Documented Authorizations
Security Administrator
PRIVACY PRINCIPLES
10
10
5
PRIVACY PRINCIPLES GOOD PRACTICE
Privacy should be considered from the outset and be built in by design. It should be
systematically built into policies, standards and procedures from the beginning.
Private data should be collected fairly in an open, transparent manner. Only the data
required for the purpose should be collected in the first instance.
Private data should be kept securely throughout their life cycle.
Private data should only be used and/or disclosed for the purpose for which they were
collected.
Private data should be accurate, complete and up to date.
Private data should be deleted when they are no longer required.
11
11
12
12
6
IS AUDIT TO ASSURE COMPLIANCE
PRIVACY POLICY, LAWS AND OTHER
REGULATIONS
Identify and understand compliance requirements
regarding privacy from laws, regulations and contract
agreements. Depending on the assignment, IS auditors
may need to seek legal or expert opinion on these.
13
13
14
14
7
PHYSICAL ACCESS AND ENVIRONMENTAL
CONTROLS
15
15
16
8
SECURITY CONTROLS
An effective control is one that prevents, detects, and/or contains an incident and enables
recovery from an event.
Controls can be:
Proactive
• Safeguards Reactive
• Controls that attempt to • Countermeasures
prevent an incident
• Controls that allow the
detection, containment and
recovery from an incident
17
18
18
9
PHYSICAL ACCESS ISSUES
Unauthorized entry
Damage, vandalism or theft to equipment or
documents
Copying or viewing of sensitive or copyrighted
information
Alteration of sensitive equipment and information
Public disclosure of sensitive information
Abuse of data processing resources
Blackmail
Embezzlement
19
20
20
10
PHYSICAL ACCESS AUDIT
21
The test should include all paths of physical entry, as well as the following locations:
• Computer and printer rooms
• UPS/generator
• Operator consoles
• Computer storage rooms
• Communication equipment
• Offsite backup storage facility
• Media storage
22
11
ENVIRONMENTAL EXPOSURES
Power failure
• Total failure (blackout)
• Severely reduced voltage (brownout)
• Sags, spikes and surges
• Electromagnetic interference (EMI)
Water damage/flooding
Manmade concerns
• Terrorist threats/attacks
• Vandalism
• Equipment failure
23
ENVIRONMENTAL CONTROLS
Environmental exposures should be afforded the same level of protection as other types
of exposures. Possible controls include:
Fireproof and
Strategically
Fire suppression fire-resistant Electrical surge
located computer
systems building and office protectors
rooms
materials
Documented and
Uninterruptible
Power leads from Emergency tested BCPs and
power supply/
two substations power-off switch emergency
generator
evacuation plans
24
12
ENVIRONMENTAL CONTROL AUDIT
The IS auditor should first establish the environmental risk by assessing the location of
the data center.
In addition, the IS auditor should verify that the following safeguards are in place:
• Water and smoke detectors
• Strategic and visible location of handheld fire extinguishers
• Fire suppression system documentation and inspection by fire department
• UPS/generator test reports
• Electrical surge protectors
• Documentation of fireproof building materials, use of redundant power lines and wiring located in
fire-resistant panels
• Documented and tested emergency evacuation plans and BCPs
• Humidity and temperature controls
25
ACTIVITY
The directory of facility operations has asked the IS audit team to perform a gap
analysis of the current policies and procedures at the headquarters building that
also houses the primary data center. You find that policies and procedures are
currently focused on operations and maintenance contracting activities.
What is an example of an environmental exposure that controls should be in
place to mitigate?
What would be a means to perform penetration testing of physical controls?
26
13
DISCUSSION QUESTION
27
DISCUSSION QUESTION
28
14
IDENTITY AND ACCESS MANAGEMENT
29
29
SECURITY OBJECTIVES
30
15
SYSTEM ACCESS PERMISSION
System access permission generally refers to a technical privilege, such as the ability to
read, create, modify or delete a file or data; execute a program; or open or use an
external connection.
System access to computerized information resources is established, managed and
controlled at the physical and/or logical level.
31
32
16
INFORMATION SECURITY AND EXTERNAL PARTIES
33
33
THIRD-PARTY ACCESS
34
17
THIRD-PARTY ACCESS RECOMMENDED
CONTRACT TERMS
Compliance with the organization’s information security
policy
35
Security roles and responsibilities of employees, contractors and third-party users should
be defined and documented in accordance with the organization’s information security
policy.
Screening
• All candidates for employment, contractors or third-party users should be subject to background
verification checks.
36
18
LOGICAL ACCESS
37
37
Data leakage
• Involves siphoning or leaking information out of the
computer.
Computer shutdown
• Initiated through terminals or personal computers
connected directly (online) or remotely (via the Internet)
to the computer.
38
38
19
PATHS OF LOGICAL ACCESS
Direct path
Local network
Remote access
39
39
ACTIVITY
40
20
DISCUSSION QUESTION
41
DISCUSSION QUESTION
42
21
ACCESS CONTROL SOFTWARE
Access control software is used to prevent the unauthorized access and modification to
an organization’s sensitive data and the use of system critical functions.
Access controls must be applied across all layers of an organization’s IS architecture,
including networks, platforms or OSs, databases and application systems.
Each access control usually includes:
• Identification and authentication
• Access authorization
• Verification of specific information resources
• Logging and reporting of user activities
43
44
22
ACCESS CONTROL TYPES
45
Logical access identification and authentication (I&A) is the process of establishing and
proving a user’s identity.
For most systems, I&A is the first line of defense because it prevents unauthorized
people (or unauthorized processes) from entering a computer system or accessing an
information asset.
46
23
IDENTIFICATION AND AUTHENTICATION (CONT’D)
47
AUTHENTICATION METHODS
Authentication Methods
Logon IDs and Passwords
Tokens
Biometrics
48
24
AUTHORIZATION
Authorization refers to the access rules that specify who can access what.
Access control is often based on least privilege, which refers to the granting to users of
only those accesses required to perform their duties.
The IS auditor needs to know what can be done with the access and what is restricted.
The IS auditor must review access control lists (ACLs). An ACL is a register of users who
have permission to use a particular system and the types of access permitted.
49
AUTHORIZATION ISSUES
Risks Controls
• Denial of service • Policy and standards
• Malicious third parties • Proper authorizations
• Misconfigured • Identification and
communications software authentication mechanisms
• Misconfigured devices on the • Encryption tools and
corporate computing techniques such as use of a
infrastructure VPN
• Host systems not secured • System and network
appropriately management
• Physical security issues over
remote users’ computers
50
25
SYSTEM LOGS
Audit trail records should be protected by strong access controls to help prevent
unauthorized access.
The IS auditor should ensure that the logs cannot be tampered with, or altered, without
leaving an audit trail.
When reviewing or performing security access follow-up, the IS auditor should look for:
• Patterns or trends that indicate abuse of access privileges, such as concentration on a sensitive
application
• Violations (such as attempting computer file access that is not authorized) and/or use of incorrect
passwords
51
To provide security authorizations for the files and facilities When a user changes
listed previously, logical access control mechanisms use job roles within an
organization, often
access authorization tables, also referred to as access control
their old access rights
lists (ACLs) or access control tables. ACLs refer to a register are not removed
of: before adding their
• Users (including groups, machines, processes) who have new required
permission to use a particular system resource accesses.
• The types of access permitted Without removing the
old access rights,
there could be a
potential SoD issue.
52
52
26
LOGICAL ACCESS SECURITY ADMINISTRATION
Software controls over access to the computer, data files and remote access to the network should be implemented.
The physical control environment should be as secure as possible, with additions such as lockable terminals and a
locked computer room.
Access from remote locations via modems and laptops to other microcomputers should be controlled appropriately.
Opportunities for unauthorized people to gain knowledge of the system should be limited by implementing controls
over access to system documentation and manuals.
Controls should exist for data transmitted from remote locations such as sales in one location that update accounts
receivable files at another location. The sending location should transmit control information, such as transaction
control totals, to enable the receiving location to verify the update of its files. When practical, central monitoring
should ensure that all remotely processed data have been received completely and updated accurately.
When replicated files exist at multiple locations, controls should ensure that all files used are correct and current and,
when data are used to produce financial information, that no duplication arises.
53
53
54
54
27
AUDIT LOGGING IN MONITORING SYSTEM ACCESS
Access Rights to System Logs Tools for Audit Trail (Logs) IS Audit Review
Access rights to system logs for security Analysis The IS auditor should ensure that the logs
administrators to perform the previous Audit reduction tools cannot be tampered with, or altered,
activities should be strictly controlled. without leaving an audit trail.
Trend/variance-detection tools
A periodic review of system-generated logs When reviewing or performing security
can detect security problems, including Attack-signature-detection tools access follow-up, the IS auditor should
attempts to exceed access authority or SIEM systems look for:
gain system access during unusual hours. • Patterns or trends that indicate abuse of access
privileges, such as concentration on a sensitive
application
• Violations (such as attempting computer file
access that is not authorized) and/or use of
incorrect passwords
55
55
Obtain a general understanding of the security risk facing information processing, through a review
of relevant documentation, inquiry, observation, risk assessment and evaluation techniques.
Document and evaluate controls over potential access paths into the system to assess their
adequacy, efficiency and effectiveness by reviewing appropriate hardware and software security
features and identifying any deficiencies or redundancies.
Test controls over access paths to determine whether they are functioning and effective by applying
appropriate audit techniques.
Evaluate the access control environment to determine if the control objectives are achieved by
analyzing test results and other audit evidence.
Evaluate the security environment to assess its adequacy by reviewing written policies, observing
practices and procedures, and comparing them with appropriate security standards or practices and
procedures used by other organizations.
56
56
28
AUDITING LOGICAL ACCESS PROCESS
Reviewing Reviewing
Assessing and
Familiarization Interviewing Reports from Application
Documenting
with the IT Systems Access Systems
the Access
Environment Personnel Control Operations
Paths
Software Manual
57
57
DATA LEAKAGE
58
29
DLP SOLUTIONS
Data at rest
Data in motion
Data in use
Policy creation and management
Directory services integration
Workflow management
Backup and restore
Reporting
DLP risk, limitations and considerations
59
60
60
30
THE OPEN SYSTEMS INTERCONNECTION (OSI) MODEL
The OSI model defines groups of functionality required for network computers into layers, described
as follows:
2. Data link layer—Divides data into frames that can be transmitted by the physical layer
3. Network layer—Translates network addresses and routes data from sender to receiver
4. Transport layer—Ensures that data are transferred reliably in the correct sequence
7. Application layer—Mediates between software applications and other layers of network services
61
61
62
62
31
ASSOCIATED LAN RISKS
63
64
64
32
NETWORK INFRASTRUCTURE SECURITY
The IS auditor should be familiar with risk and exposures related to network
infrastructure.
Network control functions should:
• Be performed by trained professionals, and duties should be rotated on a regular basis.
• Maintain an audit trail of all operator activities.
• Restrict operator access from performing certain functions.
• Periodically review audit trails to detect unauthorized activities.
• Document standards and protocols.
• Analyze workload balance, response time and system efficiency.
• Encrypt data, where appropriate, to protect messages from disclosure during transmission.
65
VIRTUALIZATION
Advantages Disadvantages
• Decreased server hardware costs. • Inadequate host configuration could create
• Shared processing capacity and storage vulnerabilities that affect not only the host,
space. but also the guests.
• Decreased physical footprint. • Data could leak between guests.
• Multiple versions of the same OS. • Insecure protocols for remote access could
result in exposure of administrative
credentials.
66
33
CLIENT-SERVER SECURITY
67
68
34
WIRELESS SECURITY
69
INTERNET SECURITY
The IS auditor must understand the risk and security factors needed to ensure that
proper controls are in place when a company connects to the Internet.
Network attacks involve probing for network information.
• Examples of passive attacks include network analysis, eavesdropping and traffic analysis.
70
35
INTERNET SECURITY (CONT’D)
Once enough network information has been gathered, an intruder can launch an actual
attack against a targeted system to gain control.
• Examples of active attacks include denial of service (DoS), phishing, unauthorized access, packet
replay, brute force attacks and email spoofing.
The IS auditor should have a good understanding of the following types of firewalls:
• Packet filtering
• Application firewall systems
• Stateful inspections
71
72
36
FIREWALLS
73
73
FIREWALL FEATURES
There are different types of firewalls, but most of them enable organizations to:
• Filter ingoing and outgoing traffic
• Can block access to particular sites on the Internet
• Limit traffic on an organization’s public services segment to relevant addresses and ports
• Prevent certain users from accessing certain servers or services
• Monitor and record communications between an internal and an external network in order to
investigate network penetrations or detect internal subversion
• Encrypt packets sent between different locations within an organization by creating a Virtual
Private Network (VPN) over the Internet (i.e., IPSec, VPN tunnels)
74
74
37
FIREWALL TECHNOLOGIES
• Packet Filters
• Stateful Inspection
• Application Proxy
• Next Generation Firewall
75
75
76
76
38
PACKET-FILTERING FIREWALLS
Advantages
Disadvantages
77
77
• The attacker defines the route the IP packet takes such that it
Source routing will bypass the firewall.
• This type of attack centers around the routing that an IP
specification packet must take when it traverses the Internet from the
source host to the destination host.
78
78
39
APPLICATION FIREWALL SYSTEMS
Application firewall systems allow information to flow between systems but do not allow the direct exchange
of packets.
Application-level gateways—Systems that analyze packets through a set of proxies—one for each service.
• The implementation of multiple proxies impacts network performance, so when network performance is a
concern, a circuit-level gateway may be a better choice.
Circuit-level gateways—Systems that use one proxy server for all services.
• These are more efficient and also operate at the application level.
• TCP and UDP sessions are validated, typically through a single, general-purpose proxy before opening a
connection.
79
79
APPLICATION FIREWALLS
Advantages
Disadvantages
80
80
40
STATEFUL INSPECTION SYSTEMS
Also referred to as dynamic packet filtering, a stateful inspection system tracks the
destination IP address of each packet that leaves the organization’s internal network.
The stateful system maps the source IP address of an incoming packet with a list of
destination IP addresses that is maintained and updated.
When a response to a packet is received, its record is referenced to determine whether
the incoming message was made in response to a request that the organization sent out.
This approach prevents any attack initiated and originated by an outsider.
81
Advantages
Disadvantages
• Complex to administer
82
82
41
STATELESS VS. STATEFUL FIREWALLS
Stateless filtering does not keep the state of ongoing TCP connection sessions.
• This contrasts with the action of stateful systems, which keep track of TCP connections.
The stateless system has no memory of what source port numbers a session’s client
selected.
• Stateless firewalls are quicker, but less sophisticated than stateful firewalls.
Because UDP traffic is stateless, applications that require UDP to operate from the
Internet into a corporate network should be:
• Used sparingly
• Implemented with alternate controls
83
FIREWALL IMPLEMENTATIONS
84
42
FIREWALL IMPLEMENTATIONS (CONTINUED)
85
86
43
FIREWALL ISSUES
Monitoring
Configuration errors
demands
Vulnerability to
application-based
Policy maintenance
and input-based
attacks
87
87
FIREWALL PLATFORMS
88
44
NEXT GENERATION FIREWALLS (NGFW)
NGFWs are firewalls aimed at addressing two key limitations found in earlier firewalls:
• The firewall’s inability to inspect packet payload
• The firewall’s inability to distinguish between types of web traffic
An NGFW is an adaptive network security system capable of detecting and blocking
sophisticated attacks.
89
90
90
45
DEVELOPMENT AND AUTHORIZATION
OF NETWORK CHANGES
The IS auditor can test this change control by:
• Sampling recent change requests, looking for
appropriate authorization and matching the request to
the actual network device
• Matching recent network changes, such as new
telecommunication lines, to added terminals and
authorized change requests
91
91
SHADOW IT
92
92
46
SHADOW IT CONTROLS
93
93
ACTIVITY
94
47
ACTIVITY
95
DATA CLASSIFICATION
96
96
48
DATA CLASSIFICATION
97
The information owner should decide on the appropriate classification, based on the
organization’s data classification and handling policy.
Data classification should define:
• The importance of the information asset
• The information asset owner
• The process for granting access
• The person responsible for approving the access rights and access levels
• The extent and depth of security controls
Data classification must also take into account legal, regulatory, contractual and internal
requirements for maintaining privacy, confidentiality, integrity and availability.
98
49
ACTIVITY
99
DISCUSSION QUESTION
100
50
DISCUSSION QUESTION
101
102
102
51
ENCRYPTION
103
Encryption algorithm
• A mathematically based function that encrypts/decrypts data
Encryption key
• A piece of information that is used by the encryption algorithm to make the encryption or
decryption process unique
Key length
• A predetermined length for the key; the longer the key, the more difficult it is to compromise
104
52
ENCRYPTION SCHEMES
105
106
53
DIGITAL SIGNATURE SCHEMES
107
DISCUSSION QUESTION
108
54
PUBLIC KEY INFRASTRUCTURE
109
109
Public key infrastructure (PKI) allows a trusted third party to issue, maintain and revoke
public key certificates.
ELEMENTS OF PKI
A digital certificate is composed
Digital of a public key and identifying
Certificates information about the owner of
the public key.
The CA is an authority in a
network that issues and An RA is an authority in a
manages security Certificate Registration network that verifies user
credentials and public keys requests for a digital
for message signature
Authority (CA) Authority (RA) certificate and tells the CA to
verification or encryption. issue it.
110
110
55
WEB-BASED COMMUNICATIONS TECHNOLOGIES
111
111
VOIP SECURITY
The key to securing VoIP is to use the security mechanisms such as those deployed in
data networks (e.g., firewalls, encryption) to emulate the security level currently used by
public switched telephone network (PSTN) network users.
OS patches and virus signature updates must be promptly applied to prevent a potential
system outage. To enhance the protection of the telephone system and data traffic, the
VoIP infrastructure should be segregated using virtual local area networks (VLANs).
Any connections between these two infrastructures should be protected using firewalls
that can interpret VoIP protocols.
112
112
56
EMAIL SECURITY
113
113
PEER-TO-PEER COMPUTING
114
114
57
INSTANT MESSAGING
115
115
SOCIAL MEDIA
116
116
58
CLOUD COMPUTING SERVICE MODELS
117
117
118
118
59
CLOUD COMPUTING ESSENTIAL CHARACTERISTICS
119
119
120
120
60
IS AUDITOR AND CLOUD COMPUTING
121
121
VIRTUALIZED ENVIRONMENTS
122
122
61
VIRTUALIZED ENVIRONMENTS
Bare metal/native virtualization occurs when the hypervisor runs directly on the
underlying hardware, without a host OS.
Hosted virtualization occurs when the hypervisor runs on top of the host OS (Windows,
Linux or MacOS). The hosted virtualization architectures usually have an additional layer
of software (the virtualization application) running in the guest OS that provides utilities to
control the virtualization while in the guest OS, such as the ability to share files with the
host OS.
Containerization: Containers include the application and all of its dependencies but
share the kernel with other containers. They run as an isolated process in user space on
the host operating system.
123
123
VIRTUALIZATION RISK
Virtualization
products rarely have
The following types of high-level risk are representative of the hypervisor access
majority of virtualized systems in use: controls: Therefore,
anyone who can
Rootkits launch an
• Improper configuration application on the
• Guest tools host OS can run the
hypervisor.
• Snapshot/images
The only access
control is whether
someone can log
into the host OS.
124
124
62
VIRTUALIZATION TYPICAL CONTROLS
125
126
126
63
MOBILE COMPUTING
127
The following controls will reduce the risk of disclosure of sensitive data stored on mobile
devices:
Virus
Device Physical
Tagging Data storage detection and
registration security
control
Acceptable
Encryption Compliance Approval Due care
use policy
Secure
Remote wipe BYOD
remote
and lock agreement
support
128
64
BYOD SECURITY AND CONTROL
ISSUES
Protection of sensitive data and intellectual
property
Protection of networks to which BYOD devices
connect
Responsibility and accountability for the device
and information contained on it
Removal of the organization’s data from
employee-owned devices upon termination of
employment or loss of the device
Malware protection
129
129
BYOD RISKS
130
130
65
INTERNET ACCESS ON MOBILE DEVICES RISKS
131
131
132
132
66
INTERNET OF THINGS RISK
• Device vulnerabilities
Technical risk: • Device updates
• Device management
133
133
134
134
67
SECURITY AWARENESS TRAINING AND
PROGRAMS
135
135
An active security awareness program can greatly reduce risk by addressing the
behavioral element of security through education and consistent application of
awareness techniques.
All employees of an organization and third-party users must receive appropriate training
and regular updates on the importance of security policies, standards and procedures in
the organization.
In addition, all personnel must be trained in their specific responsibilities related to
information security.
136
68
DISCUSSION QUESTION
137
138
138
69
FRAUD RISK FACTORS
Motivation
Fraud
Risk
Factors
Rationalization Opportunity
139
139
COMPUTER CRIMES
Financial loss
Legal repercussions
Loss of credibility or competitive edge
Blackmail/industrial espionage/organized crime
Disclosure of confidential, sensitive or embarrassing
information
Sabotage
140
140
70
COMPUTER CRIMES
It is important that the IS auditor knows and understands the differences between
computer crime and computer abuse to support risk analysis methodologies and related
control practices. Examples of computer crimes include:
Malware,
Denial of
Hacking viruses and Fraud
service (DoS)
worms
Network
Packet replay Masquerading Eavesdropping
analysis
141
MALWARE CONTROLS
System Management
monitoring vs Procedural
target attacks Controls
Anti-malware
Software Technical
Implementation Controls
Strategies
142
142
71
SECURITY TESTING TOOLS AND TECHNIQUES
143
143
• The IS auditor can use sample cards and keys to attempt to gain access
Terminal cards and beyond what is authorized.
keys
• The IS auditor should follow up on any unsuccessful attempted violations.
• The IS auditor can inventory terminals to look for incorrectly logged, missing
Terminal identification or additional terminals.
144
72
SECURITY TESTING TECHNIQUES (CONT’D)
Computer access • The IS auditor should work with the system software analyst to determine if
controls all access is on a need-to-know basis.
Computer access • The IS auditor should attempt to access computer transactions or data for
violations logging and which access is not authorized. The unsuccessful attempts should be
reporting identified on security reports.
Follow-up access • The IS auditor should select a sample of security reports and look for
violations evidence of follow-up and investigation of access violations.
Bypassing security • The IS auditor should work with the system software analyst, network
and compensating manager, operations manager and security administrator to determine ways
controls to bypass security.
145
PENETRATION TESTING
Reporting
146
73
TYPES OF PENETRATION TESTS
External testing Refers to attacks and control circumvention attempts on the target’s network
perimeter from outside the target’s system
Internal testing Refers to attacks and control circumvention attempts on the target from within the
perimeter
Blind Refers to the condition of testing when the penetration tester is provided with limited
testing or no knowledge of the target’s information systems
Double Refers to an extension of blind testing, because the administrator and security staff at
blind the target are also not aware of the test
testing
Targeted testing Refers to attacks and control circumvention attempts on the target, while both the
target’s IT team and penetration testers are aware of the testing activities
147
THREAT INTELLIGENCE
148
148
74
DISCUSSION QUESTION
149
150
150
75
INTRUSION DETECTION SYSTEMS
Categories
• Network-based IDSs
• Host-based IDSs
A combination of
Types signature- and
• Signature-based statistical-based
models provides
• Statistical-based
better protection.
• Neural networks
Policy
• Terminate the access
• Trace the access
151
151
Honeypots
• High-interaction
• Low-interaction
IPSs prevent the
intended victim
Honeynet – a set of linked honeypots hosts from being
affected by the
A full review of all network system vulnerabilities should occur attacks.
to determine whether the threats to confidentiality, integrity
and availability have been identified.
Review:
• Security policies and procedures
• Access controls
• Network configuration (firewalls and segmentation)
152
152
76
SECURITY INFORMATION AND EVENT
MANAGEMENT
SEM systems automatically aggregate and correlate
security event log data across multiple security
devices.
Security information and event management (SIEM)
systems take the SEM capabilities and combine
them with the historical analysis and reporting
features of security information management (SIM)
systems.
A SOC consists of an organized team created to
improve the security posture of an organization and
to respond to cybersecurity incidents.
153
153
DISCUSSION QUESTION
154
77
INCIDENT RESPONSE MANAGEMENT
155
155
156
156
78
EVIDENCE COLLECTION AND FORENSICS
157
157
COMPUTER FORENSICS
158
79
PROTECTION OF EVIDENCE AND
CHAIN OF CUSTODY
The evidence of a computer crime exists in the form
of log files, file time stamps, contents of memory,
etc.
• Make a copy or more image of the attacked system.
• Memory content should also be dumped to a file before
rebooting the system.
• Preserve the chain of custody.
159
159
DISCUSSION QUESTION
160
80
DISCUSSION QUESTION
161
PRACTICE QUESTIONS
162
81
PRACTICE QUESTION
163
163
PRACTICE QUESTION
164
164
82
PRACTICE QUESTION
165
165
PRACTICE QUESTION
166
166
83
PRACTICE QUESTION
167
167
PRACTICE QUESTION
168
168
84
PRACTICE QUESTION
169
169
PRACTICE QUESTION
170
170
85
PRACTICE QUESTION
171
171
PRACTICE QUESTION
172
172
86
PRACTICE QUESTION
173
173
PRACTICE QUESTION
174
174
87
PRACTICE QUESTION
175
175
DOMAIN 5 REVIEW
176
88
THANK YOU
177
89