CySA+
  • Introduction
  • Exam Objectives
    • Quiz
      • Threat and Vulnerability Management Competency
        • Questions
  • 1.0 Threat and Vulnerability Management
    • 1.1 Explain the importance of threat data and intelligence
      • Page 1
      • Intelligence Sources
      • Confidence Levels
      • Indicator Management
        • Trusted Automated eXchange of Indicator Information (TAXII)
        • OpenIoC
      • Threat classification
        • Known threat vs. unknown threat
        • Zero-day
        • Advanced persistent threat
      • Open-source intelligence
      • Proprietary / closed-source intelligence
      • Timeliness, Relevancy, Accuracy
    • 1.2 Given a scenario, utilise threat intelligence to support organisational security
    • 1.3 Given a scenario, perform vulnerability management activities
    • 1.4 Given a scenario, analyse the output from common vulnerability assessment tools
    • 1.5 Explain the threats and vulnerabilities associated with specialised technology
    • 1.6 Explain the threats and vulnerabilities associated with operating in the cloud
    • 1.7 Given a scenario, implement controls to mitigate attacks and software vulnerabilities
  • 2.0 Software and Systems Security
    • 2.2 Explain software assurance best practices
    • 2.1 Given a scenario, apply security solutions for infrastructure management
    • 2.3 Explain hardware assurance best practices
Powered by GitBook
On this page
  1. 1.0 Threat and Vulnerability Management

1.1 Explain the importance of threat data and intelligence

  • Intelligence sources:

  • Open-source intelligence: publicly available information

  • Proprietary/closed-source intelligence: info with restricted access (e.g. police record)

  • Timeliness: tim ely receipt/operationalisation (impact > intelligence cost)

  • Relevancy: mustaddress a threat and allow for effective action; usable delivery format

  • Accuracy: must save organisations more in success than errors/mistakes

  • Confidence levels

  • Indicator management:

    • STIX: describes cyber threat information (motivation, abilities, capabilities, response)

    • TAXII: describes how threat info (STIX) can be shared (hub-and-spoke; source/subscriber; peer-to-peer); discovery, collection management, inbox, poll

    • OpenIOC: standard format for defining/recording/sharing artifacts

  • Threat classification:

    • Known threat vs unknown threat: external/removable media, attrition, web, email, impersonation, improper usage, equipment loss/theft etc.

    • Zero-day: unknown vulnerabilities that have no patches

    • APT: skilled attackers supported by extremely large resources

  • Threat actors:

    • Nation-state: geopolitically motivated groups with dedicated resources/personnel, extensive planning & coordination

    • Hacktivist: ideologically motivated groups that rely on widely available tools

    • Organised crime: profit-driven groups that target PII, credit cards etc.

    • Insider threat:

      • Intentional: disgruntled or profit-driven employee stealing/damaging/exposing systems

      • Unintentional: personal negligence/poor security practices

  • Intelligence cycle:

    • Requirements: determine exact customer requirements (IRs), how it should be collected

    • Collection: gather data from wide array of desired/reliable/timely sources

    • Analysis: raw info + other sources => intelligence; assess importance/accuracy/reliability

    • Dissemination: timely conveyance of intelligence in appropriate format to customers

    • Feedback: solicit feedback from customer, refine existing IRs

  • Commodity malware: widely available paid/free malware used by many threat actors

  • Information sharing and analysis communities:

    • Healthcare: H-ISAC, Healthcare Ready

    • Financial: FS-ISAC

    • Aviation: A-ISAC

    • Government: EI-ISAC (elections), DIB-ISAC (defense), NEI (nuclear)

    • Critical infrastructure: E-ISAC (electricity), ONG-ISAC (oil & gas), PT-ISAC (public transit)

PreviousQuestionsNextPage 1

Last updated 2 years ago