Lab #9 - Assessment Worksheet Investigating and Responding to Security Incidents
ID: 3732854 • Letter: L
Question
Lab #9 - Assessment Worksheet
Investigating and Responding to Security Incidents
Course Name and Number: ______________________________________________________________
Student Name: ________________________________________________________________ Instructor Name: ________________________________________________________________
Lab Due Date: ________________________________________________________________
Lab Assessment Questions & Answers
1. When you are notified that a user’s workstation or system is acting strangely and log files indicate system compromise, what is the first thing you should do to the workstation or system and why?
2. When an antivirus program identifies a virus and quarantines this file, has the malware been eradicated?
3. What is the SANS Institute’s six-step incident handling process?
4. What is the risk of starting to contain an incident prior to completing the identification process?
5. Why is it a good idea to have a security policy that defines the incident response process in your organization?
6. The post-mortem, lessons learned step is the last in the incident response process. Why is this the most important step in the process?
Explanation / Answer
The Answer is as follows :
1) The first thing you should do is to review every security account in the system and all of the connected systems because you are looking for any account that shouldn't be there or can't be explained.
2) The computer is eradicated of that particular virus and any malicious software at that particular time but this does not mean that another virus or malicious software can infect the computer at a later time.
3) Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned.
4) There is very little risk if any.
5) The Incident response team is responsible for receiving, reviewing, and responding to computer security incident reports and activity.
6) There should regularly be a follow-up meeting to discuss the incident and make suggestions to improve the incident handling plan. Focus on preventing future occurrences of the incident that have recenty happened.
Related Questions
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.