Question: Instructions : Watch the archived webinar shown below and answer the questions listed below. Your answers should be complete, but brief. NOTE: Glossary at the

Instructions:

Watch the archived webinar shown below and answer the questions listed below. Your answers should be complete, but brief. NOTE: Glossary at the end. NOTE: The webinar gets technical after slide 21stick with it. Focus on high-level, cursory understanding after that.

https://www.fireeye.com/blog/threat-research/2014/02/qa-webinar-followup-fresh-prints-malware-network-danger.html

Fresh Prints of Mal-ware: A Lively Analysis of Live Response

Original Date: August 29, 2013 ET

What questions does live response answer?

What are the stated benefits of live response? (early/later in webinar not on all one slide)

In the case study involving 10,000 systems and 30 compromised systems, how did live response help focus investigative efforts on 6 systems needing analysis? What do you think happens with other 24 systems?

When is live response NOT a good idea?

What are the basic steps to perform live response?

What are the challenges when collecting data during triage?

Why do you think What data did the attacker take? is the most frequent question clients ask live response and forensics experts?

What are some conceptual, general approaches incident responders use identify whether data was stolen and/or what data was stolen?

Why is it important to determine what lateral movement occurred?

List and briefly explain the keys to live response success outlined at the end of the webinar.

Glossary:

Backdoor: A hidden way for the bad guy to get back into a system

C2: Command and control

Compromised: Hacked

Domain controller: A server on a Windows network that authenticates users logging in

Ephemeral: Transient; does not persist

Event log (EVT log): System log on Windows that logs user, system, and application activity

Hostname: Computer name (not IP address) (e.g. BBlaptop)

Live response: Analyzing a computer while its running

Metadata: Data about data (date/time stamp of a file, rather than the content of the file)

Move laterally (lateral move, LR): Bad guy jumps to another system from one compromised system

PW dump: A program that will copy the password file on a system

RAR file: Compressed file, or archive of files (RAR format, rather than .ZIP or some other compression)

Registry: A set of files on a Windows system that stores A TON of system info

Script: Program that is quickly written, doesnt need to be compiled, and automates tasks

Shell: Command prompt interface to the operating system

Slack space: Space at the end of a file that contains data of the file that used to be stored there

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer

Step: 1 Unlock blur-text-image

Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock

Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!

The discussion of live respnose is posted below. anythe question based on the live response... Watch the archived webinar shown below and answer the questions listed below. Your answers should be...

The data you need for Part 2 is provided in the following Excel file. Be sure to use this file and do not enter anything manually from the case or use other sources for the data. Assignment Details...

A STUDENT GUIDE TO INTRODUCTORY & FOUNDATION LEVEL CASE STUDY ASSIGNMENTS Using the 8 Step American Management Association (AMA) Problem Solving and Case Analysis Process Sally Armstrong, May 2005....

LST2BSL Introduction to Business Law and Ethics Common Law Assignment INSTRUCTIONS 1. This assignment is worth 20% of your final mark for this subject. 2. All questions must be answered. 3. With...

I hope you can answer this question and find the reference below the question. Thank you Topic: Conducting personal job interviews using the STAR model 1- Design a two-hour training work plan for 10...

BCJ 3801, Criminal Evidence and Legal Issues Course Syllabus Course Description Presents an examination of the laws governing proof of facts evidence presentation in trials and common law. Students...

Responsibility Center Presentation Imagine you have been selected by your manager to present a training session to a group of new employees. The new hires do not have accounting backgrounds and have...

Candidate Instructions Purpose of this Assessment task This assessment task is designed to test your skills in communicating with influence as required by the unit BSBLDR513 Communicate with...

i need this by early morning. His mother later remarried--a fellow named MacAdam--and Johnny grew up in his stepfather's home with his mother, stepfather, sisters, brothers, and the stepfather's...

The instruction for my assignment is in my attachment. This is a tax return project. So, anyone who is an expert in tax accounting please help me. I have provided details and pointers for all of you...

V12 V3 2) Consider the flow of combustion gases, through a normal turbine stage such that the flow angle at the exit of the rotor is the same as that entering the stator, and ai = as. The inlet total...

Consider the idea behind Fig. 4-21, but now for a disk with a mean seek time of 6 msec, a rotational rate of 15,000 rpm, and 1,048,576 bytes per track. What are the data rates for block sizes of 1...

which model within cybersecurity focuses on confidentiality integrity and availabilility

5. Develop a scenario comparing two PH programs and involving the use of a CBA.

2. Develop a persuasive topic and thesis

1. Define the goals of persuasive speaking

4. Explain three forms of rhetorical proof: ethos, logos, and pathos