Security + Chapter 13 Disaster Recovery And Incident Response

Front 1

Business Continuity Planning (BCP)

Back 1

The process of implementing policies, controls,
and procedures to counteract the effects of losses, outages, or failures of critical business
processes.

Front 2

Critical Business Functions
(CBF)

Back 2

Processes or systems that must be made operational immediately when an outage occurs.

 

The business can’t function without them

Front 3

Two Key Components of BCP

Back 3

1. Business Impact Analysis (BIA)

2. Risk Assessment

Front 4

Business Impact Analysis (BIA)

Back 4

Concerned with evaluating the processes.

 

Focuses on the impact a loss would have on the organization.

Front 5

Risk Assessment

Back 5

Concerned with evaluating the risk or likelihood of a loss.

Front 6

Identifying Critical Functions

Back 6

“What functions are necessary to continue operations until full service can be restored?”

Front 7

Prioritizing Critical Business Functions

Back 7

When business is continued after an event, operations must be prioritized as to essential and nonessential functions.

Front 8

Calculating a Time Frame for Critical Systems Loss

Back 8

How long can the organization survive
without a critical function?

 

This dictates the contingencies that must be
made to minimize losses from exceeding the allowable period.

Front 9

Estimating the Tangible and Intangible Impact on the Organization

Back 9

Tangible nature, such as lost production
and lost sales.

 

Intangible losses will also be a factor such as customers lose faith in your service?

Front 10

Utilities

Back 10

Electricity, water, and natural gas are key aspects of business continuity.

 

Natural disasters and weather considerations. 

Front 11

High Availability

Back 11

The process of keeping services and systems operational during an outage.

 

The goal is to have key services available
99.999 percent of the time (also known as five nines availability).

Front 12

Redundancy

Back 12

Refers to systems that are either duplicated or that fail over to other systems in the
event of a malfunction.

Front 13

Fail-over

Back 13

The process of reconstructing a system or switching over to other systems when a failure is detected.

Front 14

Fault Tolerance

Back 14

The ability of a system to sustain operations in the event of a component failure.

 

This capability involves over-engineering systems by adding redundant components and subsystems.

Front 15

Uninterruptible Power Supply (UPS)

Back 15

Allow you to continue to function in the absence of power for only a short duration.

 

Along with surge protection—UPS should accompany everyserver and workstation.

Front 16

Redundant Array of Independent Disks

Back 16

Technology that uses multiple disks to
provide fault tolerance.

Front 17

RAID Level 0

Back 17

Disk striping.

 

It uses multiple drives and maps them together as a single physical drive.

 

Primarily for performance, not for fault tolerance.

 

If any drive in a RAID 0 array fails, the entire logical drive becomes unusable.

Front 18

RAID Level 1

Back 18

Disk mirroring.

 

Provides 100 percent redundancy
because everything is stored on two disks.

Front 19

RAID Level 3

Back 19

Disk striping with a parity disk.

 

Implement fault tolerance by using striping (RAID 0) in conjunction with a separate disk that stores parity information.

 

Common in older systems, and it’s supported by most Unix systems.

Front 20

Parity Information

Back 20

A value based on the value of the data stored in each disk location.

 

This system ensures that the data can be recovered in the event of a failure.

Front 21

RAID Level 5

Back 21

Disk striping with parity.

 

The parity information is spread across all the disks in the array instead of being limited to a
single disk, as in RAID 3.

Front 22

Disaster Recovery

Back 22

Ability to recover system operations after a disaster.

 

A key aspect of disaster-recovery planning is designing a comprehensive backup plan that includes backup storage, procedures, and maintenance.

Front 23

Backups

Back 23

Duplicate copies of key information, ideally stored in a location other than the one where the information is currently stored.

Front 24

Working Copies

Back 24

Shadow copies—are partial or full backups that are kept at the computer center for immediate recovery purposes.

 

Most recent backups that have been made.

Front 25

Onsite Storage

Back 25

Location on the site of the computer
center that is used to store information locally.

 

Storage containers are available that
allow computer cartridges, tapes, and other backup media to be stored in a reasonably
protected environment in the building.

Front 26

Offsite Storage

Back 26

A location away from the computer center where paper copies and backup media are kept.

Front 27

Disaster-Recovery Plan

Back 27

Helps an organization respond effectively when a disaster occurs.

 

Disasters may include system failure, network failure, infrastructure failure, and
natural disaster.

Front 28

Database Systems

Back 28

Provide the ability to globally back up
data or certain sections of the database without difficulty.

 

Larger-scale database systems
also provide transaction auditing and data-recovery capabilities.

Front 29

User Files

Back 29

Word processing documents, spreadsheets, and other user fi les are extremely valuable to an organization.

Front 30

Applications

Back 30

Word processors, transaction systems, and other programs usually don’t change on a frequent basis.

Front 31

Full Backup

Back 31

A complete, comprehensive backup of all fi les on a disk or server.

 

A full backup can be a time-consuming process on a large system.

Front 32

Incremental Backup

Back 32

Partial backup that stores only the information
that has been changed since the last full or the last incremental backup.

Front 33

Differential Backup

Back 33

Backs up any files that have been altered since the last full backup; it makes duplicate copies of files that haven’t changed since the last differential backup.

Front 34

3 Models of Backup Plans

Back 34

1. Grandfather, Father, Son Method

2. Full Archival Method

3. Backup Server Method

Front 35

Grandfather, Father, Son Method

Back 35

Full backup should occur at regular intervals, such as monthly or weekly.

 

Most recent backup after the full backup is the son. As newer backups are made, the son becomes the father, and the father, in turn, becomes the grandfather.

 

This backup is stored in an offsite facility for a period of one year.

Front 36

Full Archival Method

Back 36

All full backups, all incremental backups, and any other backups are permanently kept somewhere.

 

Any information created on any system is stored forever.

Front 37

Backup Server Method

Back 37

Establishes a server with large amounts
of disk space whose sole purpose is to back up data.

Front 38

Recovering a System

Back 38

This process includes making sure hardware is functioning, restoring or installing the operating systems, restoring or installing applications, and restoring data files.

Front 39

Backout vs. Backup

Back 39

A backout is a reversion from a change that had negative consequences.

 

Uninstalling service packs, hotfi xes, and patches, they can also include reversing a migration, using previous fi rmware, and so on.

Front 40

Alternate Sites

Back 40

You can lease or purchase a facility
that is available on short notice for the purpose of restoring network or systems operations.

Front 41

Hot Site

Back 41

A location that can provide operations within hours of a failure.

 

Site would have servers, networks, and telecommunications equipment in place to reestablish service in a short time.

Front 42

Warm Site

Back 42

Provides some of the capabilities of a hot site, but it requires the customer to do more work to become operational.

Front 43

Cold Site

Back 43

A facility that isn’t immediately ready to use.

 

The organization using it must bring along its equipment and network.

 

Site provides a place for operations to resume, but it doesn’t provide the infrastructure to support those operations.

Front 44

Incident Response Policies

Back 44

Define how an organization will respond to an incident.

 

Policies may involve third parties, and they need to be comprehensive.

Front 45

Incident

Back 45

Any attempt to violate a security policy, a successful penetration, a compromise of a system, or any unauthorized access to information.

Front 46

Incident Response

Back 46

Encompasses forensics and refers to the process of identifying, investigating, repairing, documenting, and adjusting procedures to prevent another incident.

Front 47

Forensics

Back 47

The process of identifying what has occurred on a system by examining the data trail.

 

It involves an analysis of evidence found in computers and on digital storage media.

Front 48

Incident Response Plan (IRP)

Back 48

Outlines what steps are needed and who is responsible for deciding how to handle a situation.

Front 49

5 Step Incident Response Process

Back 49

1. Identifying the Incident

2. Investigating the Incident

3. Repairing the Damage

4. Documenting and Reporting the Response

5. Adjusting Procedures

Front 50

Identifying The Incident

Back 50

When a suspected incident pops up, first responders are those who must ascertain
whether it truly is an incident or a false alarm.

 

Escalation, involves consulting policies, consulting appropriate management, and determining how best to conduct an investigation into the incident.

Front 51

Investigating The Incident

Back 51

Involves searching logs, fi les, and any other sources of data about the nature and scope of the incident.

Front 52

Repairing The Damage

Back 52

After a problem has been identified, what steps will you take to restore service?

 

How to restore access to resources that have been compromised.

Front 53

Documenting and Reporting The Response

Back 53

Document the steps you take to identify, detect, and repair the system or network.

Front 54

Adjusting Procedures

Back 54

After an incident has been successfully managed, it’s a worthwhile step to revisit the procedures and policies in place in your organization to determine what changes, if any, need to be made.

Front 55

Forensics from the Security+ Perspective

Back 55

Act in Order of Volatility

Capture System Image

Document Network Traffic and Logs

Capture Video

Record Time Offset

Take Hashes

Capture Screenshots

Talk to Witnesses

Track Man Hours and Expenses

Front 56

Act in Order of Volatility

Back 56

When dealing with multiple issues, address them in order of volatility (OOV); always deal with the most volatile first.

Front 57

Capture System Image

Back 57

A system image is a snapshot of what exists.

Front 58

Document Network Traffic and Logs

Back 58

Look at network traffic and logs to see what information you can find there.

Front 59

Capture Video

Back 59

Capture any relevant video you can. 

Front 60

Record Time Offset

Back 60

It is quite common for workstation times to be off slightly from actual time, and that can happen with servers as well.

 

Record the time offset on each affected machine during the investigation.

Front 61

Take Hashes

Back 61

Collect as much data as possible to be able to illustrate the situation, and hashes must not be left out of the equation.

Front 62

Capture Screenshots

Back 62

Capture all relevant screenshots for later analysis.

Front 63

 Talk to Witnesses

Back 63

It is important to talk to as many witnesses to what happened as possible and as soon as possible.

Front 64

Track Man Hours and Expenses

Back 64

Track total man-hours and expenses associated with the investigation and be prepared to justify them if necessary to superiors, a court, or insurance agents.

Front 65

Succession Planning

Back 65

Outlines those internal to the organization who have the ability to step into positions when they open.

Front 66

Reinforcing Vendor Support

Back 66

Software vendors and hardware vendors are necessary elements in the process of building
systems and applications.

Front 67

Service-Level Agreements (SLA)

Back 67

Is an agreement between you or your company and a service provider, typically a technical support provider.

 

Stipulate the performance you can expect
or demand by outlining the expectations a vendor has agreed to meet.

Front 68

Recovery Time Objectives

Back 68

The maximum amount of time that a process or service is allowed to be down and the consequences still considered acceptable.

Front 69

Mean Time Between Failures

Back 69

The measure of the anticipated incidence of failure for a system or component.

 

Anticipated lifetime.

Front 70

Mean Time to Restore

Back 70

How long it takes to repair a system or component once a failure occurs (this is often also referenced as mean time to repair).

Front 71

Code Escrow Agreements

Back 71

Storage and conditions of release of source code provided by a vendor.

 

Stipulate how source code would be made available to customers in the event of a vendor’s bankruptcy.