Question 23 what is the initial fundamental technique that Mako a security engineer in her company’s IT department should begin with one developing a security monitoring system to detect abnormal network, activity, ideas, alarms cover, or base lines
Added by Ariel W.
Step 1
This includes identifying what types of abnormal network activities need to be detected, such as unauthorized access, data exfiltration, or malware infections. Show more…
Show all steps
Your feedback will help us improve your experience
Akash M and 59 other AP CS educators are ready to help you.
Ask a new question
Labs
Want to see this concept in action?
Explore this concept interactively to see how it behaves as you change inputs.
Key Concepts
Recommended Videos
Cybersecurity System monitoring and the use of network traffic log files are extremely important for gauging baseline performance and observing events. Why does identifying abnormal behavior first require having a baseline? What can a log file show that lends insight into abnormal behavior?
Akash M.
Scenario You work for a PR and marketing company that handles highly sensitive information for its high-profile clients. Client records are stored in a database and file system hosted on your private corporate network. As well as client records, this includes media such as photos and videos. Most remote client communications and data transfers take place using a one-to-one encrypted messaging app, but you also accommodate some clients who prefer to use email. A high percentage of your staff work remotely, accessing data and services over a VPN. You are reviewing your security procedures in the light of some high-profile hacks of celebrity data. At this point, you want to understand the attack surface and attack vectors by which your private network could be compromised. 1. What remote access methods could an attacker exploit? 2. Focusing on email, think of how email is processed as it is sent by a remote user and received by your company. What are the attack vectors against the company's email servers? How can these be related to adversary capability, assuming the levels to be advanced (most capable), developed, and augmented (least capable)? 3. What comes next in the chain of processing incoming email, and what attack vectors can adversaries exploit? 4. What countermeasures can be deployed for each email attack vector?
Supreeta N.
On a Thursday afternoon, a network intrusion detection sensor records vulnerability scanning activity directed at internal hosts that is being generated by an internal IP address. Because the intrusion detection analyst is unaware of any authorized, scheduled vulnerability scanning activity, she reports the activity to the incident response team. When the team begins the analysis, it discovers that the activity has stopped and that there is no longer a host using the IP address. The following are additional questions for this scenario: 1. What data sources might contain information regarding the identity of the vulnerability scanning host? 2. How would the team identify who had been performing the vulnerability scans? 3. How would the handling of this incident differ if the vulnerability scanning were directed at the organization's most critical hosts? 4. How would the handling of this incident differ if the vulnerability scanning were directed at external hosts? 5. How would the handling of this incident differ if the internal IP address was associated with the organization's wireless guest network? 6. How would the handling of this incident differ if the physical security staff discovered that someone had broken into the facility half an hour before the vulnerability scanning occurred?
Recommended Textbooks
Computer Science and Information Technology
Introduction to Programming Using Python
Computer Science - An Overview
Watch the video solution with this free unlock.
EMAIL
PASSWORD