YT YouTube2Text

YouTube2Text → Transcripts → CompTIA Security+ Full Course: Incident Response

CompTIA Security+ Full Course: Incident Response — Transcript

by Certify Breakfast · 5,702 words · 866 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00foreign
0:03[Music]
0:16so here we are seconds from disaster
0:20that dreaded moment when we realized
0:22that a security incident has already
0:24happened and the problem now is what do
0:27we do who does what and how do we react
0:30in the best way possible so that we can
0:33also stop the attack from continuing we
0:36can also isolate the affected systems
0:38and then we can also learn something
0:40from what just happened in order to
0:42avoid it in the future
0:44now the size of plus exam doesn't really
0:46require you to go too much in depth in
0:49these incident response procedures this
0:51is more likely uh adequate to the slicer
0:54plus certification and exam but on a
0:57high level note need to understand what
0:58is going on what are the necessary roles
1:01what are the necessary actions and steps
1:02to be taken whenever a security incident
1:06happens
1:07so incident response has a process it's
1:09actually a procedure that needs to be
1:11followed whenever a bad thing happens
1:13whenever a security incident happens and
1:16just like with any procedure that needs
1:17to be followed in moments of high level
1:20of stress and critical moments it does
1:23need some really clear instructions and
1:27really clear steps to be taken so that
1:30everybody knows exactly what they need
1:31to do what are we doing right now and
1:34what's the end game what's the target
1:36what are we after and one of these
1:38structured documents has been published
1:40for a while by nist the National
1:43Institute of Standards and technology
1:44and it can be found for free on the
1:47internet as special publication
1:50800-61. officially this one is called
1:52computer security incident handling
1:54guide and this document does outline
1:56some major steps when dealing with
1:59incident response starting with
2:01preparation which is not actually part
2:03of the instant response itself because
2:05this is something that it should happen
2:06long before the security incident has
2:09happened so preparation means making
2:12sure that your networks your systems
2:13even your people are secure so you're
2:16taking all the necessary steps in order
2:17to increase your security posture so
2:20that when an incident hits its impact is
2:22going to be as as low as possible it
2:25also implies that you need to train your
2:28users so that everybody knows what to do
2:30you also need to train your users in
2:31order to avoid potential security
2:33incidents and also testing of existing
2:36security response and incident response
2:39procedures is part of the preparation
2:41phase so it's not just enough to have
2:43them in place you have to make sure that
2:45everybody is aware of them and that they
2:48are up to date
2:49next in line comes the identification of
2:52the incident because a security incident
2:54is only a security incident if it
2:57affects in some way the security posture
2:59of a system or of your company as a
3:01whole
3:02there are a lot of incidents out there
3:03which are not secured incidents so it
3:05all starts with a report it starts with
3:08a complaint perhaps reported to the IG
3:11Department by a regular user it can
3:13start by identifying alerts generated by
3:16one of your your devices and this is
3:19where everything starts this is a sort
3:21of a triage phase where we analyze what
3:24happened and then we decide is this a
3:25security incident or not and if it is
3:27then we're going to start notifying the
3:29right people and taking the right steps
3:32like for example taking steps to contain
3:35that security incident make sure it
3:37doesn't affect more than it already has
3:40so if you're facing a malware that is
3:42spreading over the network make sure
3:43that you you isolate somehow the uh the
3:46affected workstations you could do this
3:48at layer 2 using vlans you could do this
3:50at layer 3 using routing you could do
3:52this simply by disconnecting network
3:54cables
3:55sometimes disconnecting it with network
3:56cables even though it's extremely
3:58efficient it might not be the best idea
4:00whenever an attack is ongoing because if
4:04it's an ongoing attack then it means
4:06that there is a live connection between
4:08some compromised host in your in your
4:10network and an attacker's workstation
4:13somewhere outside or even inside a
4:15company you should be able to identify
4:17this connection and to be able to figure
4:18out who is at the end of it and perhaps
4:21what are their intentions if you just
4:23start disconnecting everything and
4:24unplugging all the network and perhaps
4:26even the power cables you're pretty much
4:28left in the dark you don't know what
4:30happened and there's no way for you to
4:32find out how to protect against that
4:34incident in the future once containment
4:37has been successfully implemented of
4:39course eradication has to take place
4:41that is eliminating the malicious
4:44effects of that data breach of that
4:46attack of that secured incident from
4:49your network part of the elimination
4:51process might be required to re-image
4:54reinstall operating systems or
4:56reconfigure devices that have been
4:58affected and of course this
4:59reconfiguration and reinstallation
5:01should be augmented by an update your
5:05security policies an update of the
5:07affected software so make sure you're
5:09patching everything perhaps you've just
5:11ignored for some time some security
5:13updates and that's exactly what exposed
5:16you to a potential attack and erasing
5:19all the traces of malware might prove
5:22difficult sometimes this is why you
5:24might have to rely on some processes
5:26such as security arrays where you simply
5:29completely erase anything that can store
5:31data inside of a system including disks
5:34and ssds and in caches and everything
5:36else that can store data or disk
5:38sanitization in the recovery phase we're
5:41trying to come back to the functional
5:44state that we had before the attack
5:46happened that is we're trying to bring
5:48back the affected systems into
5:49production
5:50now if we had to clean up after the
5:54actual attack then those systems might
5:56require a restore from a backup or a
6:00rebuild of their functionality or a
6:02reconfiguration of their functionality
6:04and finally lessons learned it's very
6:07important to understand what happened to
6:09document what happened so that somebody
6:11else along the line in the future is
6:13going to be able to avoid the same type
6:15of incident it also pays to understand
6:18where were the flaws that actually allow
6:21this incident to happen and it's not
6:23just a a game of pointing fingers here
6:25and throwing blame it's about figuring
6:27out where your weaknesses are in order
6:30to fix them as soon as possible as part
6:32of the response coordination a lot of
6:34departments are going to be involved in
6:36a security incident especially because
6:37most departments are going to be
6:39affected by that security incident but
6:41there are different levels at which each
6:44and every one of them becomes involved
6:46in this process starting with senior
6:47leadership even though they might not
6:49understand exactly what happen at a
6:51technical level and why that security
6:52incident got to happen in the first
6:54place they are still the number one
6:57decision point so whenever we need to
6:59make a big decision such as I don't know
7:02disconnect all the entire data center
7:03from the Internet or isolate the
7:06affected systems or notify the affected
7:08parties that have been affected by the
7:11the data breach that we we just faced
7:13everything that requires high-level
7:15decisions needs to involve senior
7:17leadership
7:18legal team can also have a have
7:21something to say here because more often
7:23than not these data breaches especially
7:26if they are accompanied by the loss of
7:29confidential information personally
7:31identifiable information Financial
7:32Health Information
7:33there are going to be legal consequences
7:36following that's data breach also
7:38depending on local legislation you might
7:41have to notify affected parties as soon
7:44as possible about your data breach so
7:46don't keep it Hush Hush don't keep it
7:48under the rug uh because at some point
7:51everybody is going to know about it and
7:53the sooner the better the it and
7:55networking teams are definitely going to
7:57be involved because those are going to
7:59be the ones that actually Implement
8:00those decisions taken by senior
8:02leadership now these are the people that
8:05are going to first of all try to contain
8:08the incident then they're the ones that
8:10eradicate any traces of the uh of the
8:13malware or the or any artifacts left
8:15over by the security incident and
8:17they're also the one ones that are going
8:19to have to put those affected system
8:21back into production
8:23also HR is going to be involved whenever
8:26the author of The attacker of the data
8:29breach is proven to be an Insider threat
8:31so it's one of your colleagues tough
8:34luck
8:35and marketing or public relations this
8:38department is going to have a pretty bad
8:41day when tasked with informing the
8:45affected clients the public the the
8:50markets the news websites they're going
8:53to take care of publishing an official
8:55message about what happened and they'd
8:58better do it before the Press finds out
9:01about the fact that you've just gotten
9:03breached also if a data breach affects
9:06in some way the uh trustworthiness of
9:09your company your reputation again
9:12marketing and PR are going to have a lot
9:14of work to do in taking care of your
9:17reputation in front of your customers
9:20as far as communication goes during an
9:22incident response situation that's going
9:25to be critical communication is key in
9:27many places in life but also especially
9:29in in a during an incident response
9:31phase so communication is going to start
9:33with the computer security incident
9:36Response Team those are the the people
9:39especially trained to know exactly what
9:42to do in case of a security incident is
9:44going to happen so they are going to be
9:46the ones that actually work as a single
9:48point of contact so whoever needs to
9:51interact with the team that takes care
9:55of the internet response it's going to
9:56actually interact with the csirt now
9:59there are also going to be the ones that
10:01report back to Scenery management and to
10:03affected parties what is the current
10:05status and how bad the data breach
10:08actually was
10:09as far as communication goes internally
10:11between internal teams out of bad
10:14communication is recommended that is
10:16because when you don't know exactly the
10:18extent of a security breach or of a
10:20security incident perhaps the internal
10:22communication channels that you are
10:24normally using are like email like
10:27instant messaging like some some
10:28collaboration software that might have
10:30in your company those might be
10:32compromised and for once it means that
10:37those me those communication methods
10:40might not be trustworthy anymore and
10:42second if the attacker has managed to
10:45compromise those communication channels
10:46then you might be informing the attacker
10:50by using them you might be informing the
10:52attacker as to what is the development
10:55of the incident response process and you
10:58don't want to give away your defenses
11:01you don't want to tell the attacker what
11:03you're about to do before you're
11:04actually doing it especially if the
11:06attack is still ongoing another reason
11:08why your normal communication channels
11:10might be compromised is because you
11:13don't know exactly if the threat if the
11:15attacker that is the author of the of
11:17the data breach is an outsider or an
11:20Insider if it's an Insider then the risk
11:22is much higher for that person to have
11:24compromised some internal communication
11:26application that you're using in your
11:27company what I mean by out of Van
11:29communication here could be anything I
11:31mean you could just fall back to instant
11:33messaging link over your mobile phones
11:36like WhatsApp or or telegram or iMessage
11:39or whatever you have at your disposal
11:40that is not part of the Network that has
11:43just been breached and stakeholder
11:45involvement of course this is also part
11:47of a communication plan just like we
11:48said a couple of minutes ago you need to
11:50notify all the affected parties you know
11:53your business partners your your
11:55customers other branches perhaps might
11:58have been affected they need to know
11:59about this as soon as possible and also
12:02you need to control how this
12:03communication is going to flow you don't
12:05want people to find out about your
12:06breach before you get a chance to
12:08actually communicate what happened in an
12:11informed and coherent manner so
12:14officially you should have something
12:15called an instant response plan now this
12:17could be a document or multiple
12:18documents developed by the team dealing
12:21with security incidents and it might
12:24also be custom tailored depending on the
12:27type of incident so you might have a
12:28specific instant response plan for a
12:30data breach you might have one for
12:31enough service attack you might have one
12:33for a natural disaster perhaps so you
12:36might have different response plans
12:37according to the type of incident that
12:39you are facing the actual list of steps
12:42to be taken has the name of a standard
12:45operating procedure an sop sometimes
12:48it's called A A playbook sometimes it's
12:50called a running book it's just a list
12:51of steps to be taken so that when
12:54everybody is so stressed and people are
12:56running around
12:57aimlessly not knowing what to do there
13:00is a a document somewhere hopefully you
13:02know what it is that's going to help you
13:05identify what exactly are the next steps
13:07and who is responsible for what
13:09and this is the response plan not only
13:11includes the necessary steps to be taken
13:13it also mentions the people responsible
13:16for taking those steps and it also
13:18mentions any available resources that
13:20you might have at your disposal not
13:22Financial Resources necessarily but I.T
13:25resources perhaps and selecting those
13:27resources or allocating those resources
13:29in an efficient manner depending on the
13:32type of incident requires you to First
13:34classify the incident
13:36and the incident is most likely going to
13:39be as bad as the value of the resources
13:43affected by it
13:45so we can assess the affected Resources
13:47by a number of factors for example by
13:50the value of the data being held by
13:53those systems or by the value of the
13:55data that was just part of a data breach
13:57another prioritization Factor might be
14:00if the affected systems imply some sort
14:03of downtime so is the attack going to
14:05affect the availability of our systems
14:07or is it just going to affect the the
14:10performance of some systems or is it
14:12going to Simply put down the entire
14:13business another decision factor is how
14:16visible is this incident going to be
14:19from the outside in other words the
14:21Optics of the incident that publicity
14:24right so how is this going to be
14:26received by the media by the by the
14:28customers by our clients how bad is this
14:31going to affect our reputation the scope
14:33generally means the number of affected
14:35systems how large of a data breach are
14:37we talking about how many systems have
14:39been affected because depending on the
14:41number of the systems and the types of
14:43the systems it's going to require are
14:45more or less effort for recovery
14:48and to bring them back into a working
14:50state
14:51time to detection this is an interesting
14:54one what exactly do we mean by this well
14:56the idea here is that in many cases real
14:59successful data breaches and real
15:01successful attacks on on companies that
15:05are aimed to steal some data to
15:07introduce some backdoors or some
15:10vulnerabilities in some code
15:12those attacks sometimes go unnoticed and
15:16I don't mean go unnoticed until the next
15:19business day they might go unnoticed for
15:21months
15:22so you might be
15:24in a security incident without even
15:26knowing about it you might Discover at
15:28some point a back door in one of your
15:30servers that has been there for a year
15:33if you discover something like this it's
15:35obviously going to become sky high
15:37priority to fix that one in front of any
15:40other security breach that you might be
15:43detecting at the same time
15:45recovery time is also an important
15:47factor when deciding where to allocate
15:49resources you might have some systems
15:51that you can easily just replace or
15:53bring back into into working States or
15:56we might have some some systems that are
15:58going to take days or weeks before they
16:01become usable again and of course during
16:04that time ask yourself is the business
16:06going to be able to function without
16:08those systems or am I going to be facing
16:11even more attacks or even I'm going to
16:13expose myself with even more
16:15vulnerabilities due to the fact that I'm
16:17unable to use those systems that perhaps
16:19were even involved in the protection of
16:21our Network
16:23now over time there have been introduced
16:26many methods for describing the stages
16:28of an attack these these descriptive
16:30stages have been introduced in order to
16:33better try to understand at which stage
16:36we currently are in an attack what we
16:38can do at that stage or what is the end
16:40purpose of an attack that has just been
16:42detected and many people have tried to
16:45abstract the these in in some papers in
16:48some Frameworks in order to create some
16:51sort of a theoretical model that should
16:53match pretty much all attacks out there
16:55now the degree to which they managed to
16:58create a valid model is up for
17:00discussion of course but we do have a
17:02couple of models that are worth
17:04mentioning because they're pretty close
17:05to to real life for example Lockheed
17:08modern Corporation you find something
17:10called the Cyber kill chain or the
17:12intrusion kill chain in this white paper
17:15right here now this skill chain defines
17:17the phases for common attacks but
17:19applies mainly to those conducted by ABT
17:21groups advanced persistent and threats
17:23now the same document also talks in
17:25details about iocs indicators of
17:28compromised methods to mitigate those
17:31attacks uh reconstructing attacks after
17:33they already happened and some details
17:36about campaign analysis that is to
17:38determine whether the attack is part of
17:40a larger campaign that targets multiple
17:42individuals or multiple companies or is
17:44it something that is strongly focused on
17:47your single company so it's a very
17:48targeted type of an attack and the best
17:51way to view this in a graphical manner
17:52no less is by visiting the actual
17:54website of Lockheed Martin that's a
17:56little cyber kill chain right here you
17:58can see it's focused on APD threats a
18:01stands for advanced means targeted
18:03coordinated purposeful persistent
18:06this type of an attack that can last for
18:08weeks for months so it's a type of
18:10attack that opens up a Communication
18:12channel for long-term interaction
18:14between the attacker and the victim and
18:16a threat which is the actual person or
18:18the entity that has intent opportunity
18:20and the capability to conduct this
18:22attack the phases defined by Lockheed
18:25Martin start with reconnaissance with
18:27reconnaissance we're talking about an
18:28attacker who is trying to gather as much
18:30information as possible of other
18:32potential victims it might be using open
18:34source intelligence it might be using
18:36active reconnaissance tools like active
18:38scanning trying to hit the firewalls
18:40trying to hit the email service trying
18:42to hit any publicly available Services
18:43just to see if there are any weaknesses
18:45in there and try to discover as much as
18:47possible about the internal structure
18:50internal design of that of that Network
18:52next comes the weaponization phase and
18:56with the weaponization we are coupling
18:58or connecting a specific exploit with a
19:02specific vulnerability so once we have
19:04found a vulnerability that can exploit
19:06we are choosing an exploit for it and we
19:09are building we're wrapping it up and
19:11ready to be delivered to the victim
19:13system which actually happens in the
19:15delivery phase with delivery phase we
19:17are tricking the victim into either
19:20sticking a USB stick into their their
19:22computer clicking a link downloading
19:24some piece of malware installing some
19:26sort of a back door we could be using
19:28social engineering here we could be
19:30using other Advanced Tools in order to
19:33get and gain a foothold and to deliver
19:35that malicious payload to the victim's
19:37computer
19:38finally we've got exploitation so
19:41assuming that the victim has managed to
19:43introduce that
19:45malware into the network and or into the
19:47system uh that's when the malware starts
19:49exploiting a specific vulnerability by
19:52installing a back door by propagating to
19:54different systems or by simply acting on
19:56objectives as in trying to steal the
19:59data that we were after or trying to
20:01perform a denial of service attack
20:03installation of malware is a phase that
20:05is relevant whenever the attack requires
20:07to be persistent so we need to make sure
20:10as an attacker we need to make sure that
20:12we can connect to that compromised
20:14workstation anytime we want in the
20:15future so we can send it commands and
20:17make it do our bidding command and
20:20control phase that's basically the
20:22control Channel between the compromised
20:24host and the attacker's workstation this
20:27is the channel through which the
20:28attacker is going to keep providing
20:29commands and querying that compromise
20:31toast as to its Health in order to make
20:34it do whatever the attacker intends to
20:37do in other words manipulation of the
20:39victim and finally actions and
20:41objectives that is whatever the attacker
20:43intended to do in the first place didn't
20:45want to steal some data did we want to
20:48compromise some data Maybe perform it in
20:50a lot of service attack or maybe just
20:53maybe the initial purpose was to gain
20:55access to gain control of as many
20:58systems as possible so that in the
21:00future those compromised toast might be
21:02used in a coordinated attack so remember
21:04this one remember these phases more than
21:06likely you're going to be asked on the
21:08exam day about the Cyber kill chain
21:10another way to describe attacks and this
21:12one I actually prefer this one
21:14personally is from miter and it's called
21:17the attack framework and yes it is
21:19written ATT Ampersand CK it's the attack
21:23framework in which it's actually not
21:27just a theoretical model but it's
21:29actually a kind of a database it's an
21:31attack Matrix for Enterprise you can see
21:33it right here it's kind of a database of
21:35observed and known and documented
21:38attacks
21:39let me show you how this works this
21:42right here is the monitor attack
21:43framework as you can see it is divided
21:46in a couple of columns in here and all
21:48of these basically describe different
21:49types of attacks now the entire list
21:52here is actually much larger
21:54I just couldn't fit it on on a single
21:56screen here so you can see we have
21:58different uh example of attack methods
22:01regarding gaining initial access or
22:04privilege escalation or credential
22:06access or lateral movement command and
22:09Control Data exfiltration and so on and
22:11so forth and all of these underneath
22:13each of each one of these are going to
22:15find a lot of examples documented from
22:18Real World situations so for example
22:20under credential access I'm going to
22:22find here Brute Force right along with
22:25forged web credentials uh authentication
22:28process modification intercepting
22:30multi-factor authentication or pretty
22:32much anything that was ever hacked in
22:35the world belongs to some sort of a
22:37category in this minor attack framework
22:39let's just see a couple of examples here
22:41in the Brute Force section so if you
22:42click on Brute Force first of all we're
22:44going to see a couple of sub techniques
22:45in here there you go password guessing
22:47cracking spraying and stuffing
22:50and finally we're going to see a couple
22:52of examples here so under procedure
22:54examples and you'll find some ideas in
22:56here with some names these are the
22:58actual name of the malware or if the APT
23:00group that was identified as an author
23:04that performs brute force in an
23:06organized manner in order to gain access
23:09to credentials there you go so many
23:11examples so many examples in here
23:12observed over time on major malware out
23:17there that was specifically designed to
23:18Brute Force authentication credentials
23:20you can also see a couple of mitigation
23:22techniques so this also works as a
23:25database of what to be on the lookout
23:28for and how to protect yourself right
23:30much better than that simple cyber kill
23:32chain this one is actually useful
23:35and methods for detection how do you
23:38detect Brute Force so I will let you
23:40play with this one for just a bit it's
23:42available at
23:44attack.myiter.org it's freely available
23:46and it's a Priceless source of
23:49information regarding everything that is
23:52hackable in this world
23:55so don't ignore this don't ignore this
23:56for the exam and don't ignore it for
23:58your general knowledge I would strongly
24:00recommend to have a look over this stack
24:01framework uh download it by heart of
24:03course but try to understand different
24:05types of techniques presented here it's
24:08probably the single most comprehensive
24:11collection of information about cyber
24:13attacks and it's a great learning tool
24:15for discovering and understanding how
24:17cyber attacks look nowadays and this
24:20entire database is based on real
24:21observations so everything that you see
24:23in here is not just Theory but has been
24:26observed has been documented and used as
24:28an attack technique at least once in
24:30real life next up we have the diamond
24:32model of intrusion analysis now
24:34personally this is not one of my
24:36favorites because it can prove to be a
24:38bit hard to follow and also because it's
24:40a bit limited I know it focuses on on a
24:42single intrusion event now what we see
24:45here in this diamond model is actually
24:46an intrusion event described by the
24:49relationships between four core features
24:52of that event we have the adversary we
24:56have the capabilities of the adversary
24:58we have a victim and we have the
25:01infrastructure that makes the attack
25:02possible and the lines in this model are
25:06the relationships between these Concepts
25:08and they tell us that it's possible for
25:10an analyst to reach the other connected
25:12points given enough information so for
25:14example if we analyze a victim we can
25:17see the capabilities used by the
25:18attacker against that victim so we can
25:20see how the victim was attacked if we
25:22have infrastructure visibility of the
25:25network or of the logs for example then
25:28we draw in more conclusions about how
25:30the capability used in the
25:31infrastructure to compromise the victim
25:34so as an example here we could say that
25:36a connection between the victim and an
25:38attacker's capability is the fact that
25:40the victim was able to discover a piece
25:42of malware on the system now that
25:44malware used the infrastructure because
25:48it actually pointed to a malicious
25:50domain it might have been a malware that
25:52tried to contact a command and control
25:54entity on the internet all right so
25:56that's a that's a connection between the
25:58capability being the malware and the
26:00infrastructure that is available to it
26:02that's the internet and the local
26:03network next up we have the domain part
26:07of the infrastructure that points to an
26:09IP address so we as a security analyst
26:11now we can identify specific IP address
26:14pointing to that source of malware by
26:17looking at the network logs that is the
26:19connection between the infrastructure
26:20and the victim we could potentially
26:22identify multiple victims in the same
26:24network we could potentially identify
26:25multiple workstations that are now part
26:27of a botnet that have been infected by
26:29the same malware simply by looking at
26:30the logs and the affected workstations
26:33that's a connection between the
26:35infrastructure and the victims
26:37and finally by analyzing the IP address
26:40pointing the commander control we are
26:43able to pinpoint the location of the
26:45adversary now we might not know exactly
26:47their name and date of birth but we know
26:50that the IP address that we detected is
26:53the root of all evil so that's one
26:55domain that should be probably
26:56blacklisted and all traffic should be
26:58filtered whenever other workstations
27:01perhaps infected workstations will
27:03attempt to communicate over that command
27:05control Channel and well after
27:08discussing the Cyber kill chain after
27:10discussing the miter attack framework
27:11this kind of sounds very oversimplified
27:14right kind of like too easy to be true
27:17too easy to be to be useful it actually
27:19does include a bit more information that
27:22information is considered a meta feature
27:25of the diamond model I know all this
27:28terminology here kind of doesn't help it
27:30looks like it attempts to to over
27:32complicate things I've already said that
27:34I don't like this model but bear with me
27:37here for one more minute now as part of
27:39these meta features we could add another
27:42set of details of this event such as for
27:45example an event timestamp when did the
27:48event happen in security event happened
27:49in which phase was the event in was it
27:53during reconnaissance was it doing
27:54weaponization and so on a result was the
27:58event successful or not did it
28:01compromise any part of confidentiality
28:03integrity and availability was it just a
28:05failed attempt a direction was it
28:08initiated by the victim so somebody
28:10tricked the victim into installing
28:12malware by themselves or it came from
28:15the outside or was it somehow
28:16bi-directional a method what exactly was
28:19the attack was phishing was it an
28:22exploit was it a malicious link was it a
28:24cross-site scripting was it a denial of
28:26service attack depending on the type of
28:28the attack and finally the resources
28:30required to complete the event like
28:34reconnaissance information that might
28:35have been required password hashes that
28:37the attacker might have gained in the
28:39meantime the presence of a vulnerability
28:41that's high on the list probably
28:43anything that the attacker needs to
28:45assume or gather before conducting the
28:48attack and all these features then are
28:51being assigned a confidence level which
28:53of course is based on a assumption well
28:56incident response planning looks good on
28:58paper but you have to make sure
29:01periodically that the people can
29:02actually put it into practice that they
29:04can apply it whenever hits the fan
29:08so testing your incident response plan
29:11requires you to perform a set of
29:13exercises now these exercises depending
29:16on how much money and time you have at
29:18your disposal might range from something
29:20as simple as a tabletop exercise which
29:22is kind of similar to a board game just
29:24by using a couple flashcards just by
29:26using a theoretical scenario people just
29:28gather together and discuss so if this
29:32happens this is what I would do this is
29:33what you would do this is what we all do
29:36and we all laugh and then go to lunch
29:38not very efficient but it's better than
29:41nothing next up we would have a walk
29:44through now I walk through it very
29:46similar to a tabletop exercise but it
29:49requires the participants to actually
29:51demonstrate their skills like performing
29:54a scan you know analyzing a piece of
29:56malware playing with some isolated
29:59environments uh that would simulate
30:02somehow the environment that has been
30:04breached in general all these
30:06environments are just sandboxes or just
30:08virtual machines that are there for
30:10testing purposes so it's kind of a
30:11tabletop exercise but with a bit more
30:13Hands-On practice
30:15finally we have simulations now with the
30:17simulation this is this requires a lot
30:19of time a lot of money a lot of
30:21involvement in uh in a simulation we
30:24actually divide people into two teams we
30:25have the red team that simulates the
30:27attack we have the blue team that
30:28simulates the defense team right and we
30:31also have a white team that works as
30:33some sort of a control or Arbiter of the
30:37entire game right uh we are simulating a
30:39real Attack perhaps on a on a limited
30:41set of resources perhaps on a on a test
30:43environment but we are actually
30:46attacking those resources right so uh
30:49Blue Team and Red Team of course they're
30:51both part of the same company but uh
30:53they have to learn to play together and
30:55to learn from this exercise how to
30:57better protect against somebody who
31:01doesn't do this for fun
31:03now you shouldn't confuse incident
31:04response with the generic term of
31:07business continuity the incident
31:08response is just focused on a security
31:10incident now on the other hand we also
31:12have a couple of different approaches
31:14two different types of incidents that
31:17might happen to our building to our
31:19business to our systems IIT systems so
31:22for example we have a disaster recovery
31:24plan which can be considered a special
31:27type of incident where the entire
31:29business is affected it might be a
31:31natural disaster it might be due to a
31:33war a to a civil unrest regardless of
31:37the reason usually a disaster recovery
31:40plan is going to include all the
31:41necessary resources and instructions for
31:44relocating the entire business to some
31:46other secondary site business continuity
31:49planning on the other hand is a document
31:53or a procedure that instructs how to be
31:57able to keep the business going even in
32:00a situation where the the entire
32:03business affected by a disaster or by a
32:05security incident so for example if a if
32:07a server or an ID resource is made
32:10unusable due to one of these incidents
32:13above then the business continuity to
32:15plan should provide some sort of an
32:17alternative or methods for providing
32:20some sort of a failover onto a secondary
32:23system that can still keep the business
32:25going and finally continuity of
32:27operations plan this is a type of plan
32:30that is mostly associated with
32:32government facilities and by its
32:34definition it refers to a situation in
32:37which the entire organization needs a
32:41backup plan to work without any kind of
32:44I.T support so that's continuity of
32:47operations plan also also written in a
32:50shorthand notation as Coop so those are
32:53the phases of incident response in a
32:55very very high level overview of the
32:57people and the resources and the steps
32:59involved in dealing with a security
33:00incident now I hope you found this
33:02informative and you useful like And
33:04subscribe if you enjoyed this and see
33:07you on the next video
33:08[Music]

About this transcript

This page contains the full transcript of CompTIA Security+ Full Course: Incident Response by Certify Breakfast, generated from the public captions YouTube serves with the video. The transcript has 5,702 words across 866 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.