Cybersecurity Security Operations and Defensive Security Syllabus

What does TTP stand for and what does each component describe?

TTP = Tactics, Techniques, and Procedures. Tactics are the adversary's high-level goals (the 'why'), Techniques are the general methods (the 'how'), and Procedures are the specific step-by-step implementations used by an actor.

What is the MITRE ATT&CK framework and how is it organized?

MITRE ATT&CK is a globally accessible knowledge base of adversary behavior organized as a matrix of Tactics (columns, e.g., Initial Access, Execution, Persistence) and the Techniques/Sub-techniques (cells) used to achieve each tactic.

How does the MITRE ATT&CK framework differ from the Cyber Kill Chain?

The Cyber Kill Chain (Lockheed Martin) is a linear 7-stage model of an intrusion's progression, while ATT&CK is a non-linear matrix cataloging specific real-world techniques mapped to tactics, offering far more granular behavioral detail.

What do STIX and TAXII stand for and what is each used for?

STIX (Structured Threat Information eXpression) is a standardized language/format for describing threat intelligence; TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol used to share STIX data between systems.

What is a threat feed and what is the risk of relying solely on open-source (OSINT) feeds?

A threat feed is a continuously updated stream of threat indicators (IPs, hashes, domains). OSINT feeds can be noisy, contain stale/false-positive data, and lack context, potentially causing alert fatigue or blocking legitimate traffic if used without validation.

List the phases of the incident response lifecycle according to NIST SP 800-61.

1) Preparation, 2) Detection and Analysis, 3) Containment, Eradication, and Recovery, 4) Post-Incident Activity (lessons learned).

List the six phases of the SANS incident response process.

1) Preparation, 2) Identification, 3) Containment, 4) Eradication, 5) Recovery, 6) Lessons Learned (PICERL).

What is the difference between short-term and long-term containment in incident response?

Short-term containment quickly limits damage (e.g., isolating a host, blocking an IP) without altering evidence; long-term containment applies temporary hardening fixes so systems can be used while a permanent fix/rebuild is prepared.

What is the difference between eradication and recovery in the IR lifecycle?

Eradication removes the threat and its artifacts (malware, backdoors, compromised accounts) from the environment; recovery restores affected systems to normal operation and validates they are clean and functioning.

What does CSIRT stand for and what is its function?

CSIRT = Computer Security Incident Response Team—a designated group responsible for receiving, analyzing, and responding to computer security incidents within an organization.

What is an incident response playbook and why is it valuable?

A playbook is a predefined, step-by-step procedure for responding to a specific incident type (e.g., ransomware, phishing). It ensures consistent, fast, and repeatable response, reducing errors and decision time under pressure.

In an incident response team, what is the role of the communications/PR and legal members?

Communications/PR manages internal and external messaging to stakeholders, customers, and media; legal advises on regulatory/breach-notification obligations, evidence handling, liability, and law-enforcement engagement.

Define chain of custody in digital forensics.

Chain of custody is the documented, chronological record showing the seizure, control, transfer, analysis, and disposition of evidence—who handled it, when, why, and how—preserving its integrity and admissibility in court.

What key details must a chain of custody record contain?

A description of the evidence, and for each transfer: date/time, the individuals releasing and receiving it, their signatures, the reason/purpose, and storage location—an unbroken trail with no gaps.

What is the general order of volatility, from most to least volatile, in digital forensics?

1) CPU registers and cache, 2) RAM (memory), routing/ARP tables, kernel stats, 3) temporary/swap files, 4) disk (persistent storage), 5) remote logging/monitoring data, 6) physical/archival media and backups.

Why does the order of volatility dictate the sequence of evidence collection?

The most volatile data (e.g., RAM, registers) is lost when a system loses power or state changes; collecting it first maximizes the chance of capturing critical evidence before it disappears.

What is the difference between disk forensics and memory forensics?

Disk forensics analyzes persistent storage (files, deleted data, file-system metadata, slack space); memory (RAM) forensics analyzes volatile data such as running processes, network connections, injected code, and encryption keys not written to disk.

Why can memory forensics reveal threats that disk forensics cannot?

Fileless/in-memory malware, injected code, decrypted data, and live network connections exist only in RAM and may never touch disk, so they are only observable through memory capture and analysis.

What is a memory dump and name a common tool used to analyze it.

A memory dump is a captured copy of a system's RAM contents. Common analysis tools include the Volatility Framework and Rekall.

What is 'file slack' (slack space) in disk forensics?

Slack space is the unused portion of a disk cluster between the end of a file's actual data and the end of the allocated cluster; it can contain remnants of previously stored data useful as evidence.

What is network forensics and what is a key challenge unique to it?

Network forensics captures and analyzes network traffic to investigate incidents. A key challenge is that traffic is highly volatile and transient—if not captured live, it is lost, unlike data on disk.

What special considerations apply to mobile device forensics?

Mobile forensics must handle proprietary OSes/file systems, encryption, cloud-synced data, radio isolation (Faraday bags to prevent remote wipe), and varied acquisition methods (logical, file-system, physical) tied to specific device/OS versions.

Why should a mobile device be placed in a Faraday bag during seizure?

A Faraday bag blocks all radio signals (cellular, Wi-Fi, Bluetooth), preventing remote wiping, remote locking, or data tampering while preserving the device's evidentiary state.

What is evidence acquisition and why is a forensic (bit-for-bit) image preferred over a file copy?

Acquisition is the process of collecting a copy of digital evidence. A forensic image is an exact bit-for-bit duplicate that captures deleted files, slack space, and metadata—unlike a logical file copy, which captures only active files.

What is a write blocker and why is it essential during evidence acquisition?

A write blocker is a hardware or software device that permits reading from a storage device while preventing any writes to it, ensuring the original evidence is not altered during imaging and preserving its integrity.

How are cryptographic hashes used to verify the integrity of a forensic image?

A hash (e.g., SHA-256) is computed of the original media and the acquired image; if the two hashes match, it proves the image is an unaltered, exact copy. Any later change to the evidence would produce a different hash value.

What is the difference between imaging a live (running) system and a powered-off system?

Live acquisition captures volatile data (RAM, active connections) but slightly alters system state; dead/static acquisition images a powered-off disk for maximum integrity but loses all volatile memory data.

What are two common metrics used to measure SOC/IR effectiveness, and what do they represent?

MTTD (Mean Time to Detect): average time to identify an incident. MTTR (Mean Time to Respond/Remediate): average time from detection to containment/resolution. Lower values indicate a more effective SOC.

How is Mean Time to Detect (MTTD) calculated?

$$\text{MTTD} = \frac{\text{Total time to detect all incidents}}{\text{Number of incidents}}$$ It is the average elapsed time between the start of an incident and its detection.

What is the difference between a security 'event,' an 'alert,' and an 'incident'?

An event is any observable occurrence in a system; an alert is an event (or correlation) flagged as potentially suspicious for review; an incident is a confirmed event or series of events that violates security policy or causes harm.

What is a false positive versus a false negative in security detection, and which is generally more dangerous?

A false positive is a benign event wrongly flagged as malicious (causes alert fatigue); a false negative is a real threat that goes undetected. False negatives are generally more dangerous because an actual attack succeeds unnoticed.