CISSP DOMAIN 7 Summary

Hi team welcome to my session on coffee with prop and today podcast we're going to cover domain 7 security operations A quick warning before I start this domain 7 If you have a security operation experience it is highly highly recommend to do a lot of unlearning because I have seen a lot of people fail in See as a big example because of domain 7 Domain 7 security operation is a Second part of domain 1 you can see like that domain 1 talk about strategy and tactical and domain 7 talk about the operations Even I have seen a lot of people who have a great experience in sock hands on on socks they unable to understand the interpretation of domain 7 So in this podcast we're going to cover important pointers that you should know while preparing for domain 7 So this domain actually start with the incident So you should know the thin land difference between the incident event disaster and crisis So event is like a series of activity which is used to meet the business objective incident is basically unplanned activity which went go against the business objective And when it having a concurrence incidence that is called as a disaster And when you're able to manage a disaster it lead to the crisis It is same like I want to start a session at 7 it's a event and I'm able to start the session at 7 It got to live at 10 minutes 15 minutes which is went against the SLA So it become a incident it is happening concurrently it can lead to disaster and there is a possibility I will not able to manage my batch Which lead to the crisis so it's very important you need to know these definitions Now in the entire investigation of incident The most important part is called as evidence because this is how you can able to justify anyone in the court So if you basically hack my server And your IP was logged on my system so with the help of IP IP I can able to trace this as an evidence That okay this guy has commit this So evidence is always dynamic in nature and Example point important point is you need to understand here is that whenever any crimes in happen in the systems the first most important goal here is to Power off sorry remove the network cable then dump the memory and then gracefully shut down the system And whenever we do the investigation we follow one principle which is called as a lock-hard exchange principle Lock-hard exchange principle is always follow this parameter of when crime is committed The preparatory something behind and take something with them Some of the guidelines you need to follow in forensics like you know when you're doing a forensic investigation like any person accessing the evidence must be trained on that all activity related to the Caesar access storage of facial evidence must be fully documented and any agency Who responsible for seizing accessing storing or transferring evidence must be responsible to compliance with the principle In the US there is a dedicated standard was introduced to collect the investigations and all that and that is basically called as a EDR Electronic discovery reference model So any pointer talking about freedom of information act litigation US So you need to take in your mind EDR as answer because electronic discovery is a discovery conducted in a legal proceeding such as government investigations litigations or Freedom of information act request which is ask in a information format Okay, so any pointer talking about government investigations that is a EDR Now whenever talking about evidence collection so data that has been compromised the system that has been compromised data Which is compromise all this collect as an evidence now when you collect an evidence Your hand over the evidence to someone else right so we follow one parameter call as a chain of custody Example probe collected the evidence and I handle the evidence to heartic Heartic basically handle the evidence to Nair Nair handle the evidence to someone else So here what happens we maintain the hash and everything So by this we can ensure who take care of the evidence Who modified the evidence because when you submit the evidence in the court we submit the chain of custody form according to that So that basically help me to track the evidence handling So it's very important to have that particular function Always remember we never do the investigation on the live systems We always make a copy of the systems and we do the investigation on the copy of the system that something is an important practice We have now in the data forensic we have a four step process It's very important for you to know this four step process First is called data collection where you collect all the data Everything then do the data examination second step where you examine what is important what is not so you can cut short the data Then you do the data analysis you know the filter data you will try to correlate how this incident happened and all that and then you prepare the report As I said any system is hacked and you know it is a confirm incident the first thing you have to remove the network cable turn the memory and then Power of the machine and take a ghost copy of the system That is something is part of the requirement. It's very important because you have to follow that Then we have a chain of custody form so chain of custody form is very important here. So it tracked the evidence handling Along with that The formal well document process must be followed and the chain of custody should follow the evidence through the entire life cycle There's one more concept we called as the chain of evidence the sequence in which we obtain the evidence Okay, so in that the timestamp is very important like first IP targeted the firewall at 10 a.m Then from there it went to internal network to multiple systems 11 12 So when you have a document when you capture the logs of the timestamp this concept is called as a chain of evidence the sequence in which you obtain the evidence so that You can able to recreate the evidence So when you obtain the evidence Evidence basically have a five principle then only it is called as a good evidence example like evidence must be authentic It mean you have obtained the evidence directly from the system evidence must be accurate It must be complete and more important it should be convincing and if if it meet convincing criteria It is automatically Adnessable in the code Now when you're talking about evidence, you know, you can also submit the contract To resolve the disputes and that is called as a payroll evidence payroll basically stand for PAR well So it basically stayed when agreement between the parties and put into the written form So example like I'm providing a training and I failed to refuse to deliver training as with the contract So contract can be act in a code to resolve the dispute Along with that If you hear from someone and you state the okay he did this so that is called as a hair say rule so hair say rule is not applicable And then we have a prepondence of the evidence which mean that okay If 51% of the claim evidence state that okay he commit this and all that and this evidence state 51% so They can be liable for that that is basically called as a prepondence of the evidence Okay, so I can give you an example of that uh, let's say example There is a standard of proof where the more convincing evidence has been or um If 51% of evidence support one side that side will be Or win so another important thing is that if any data breach happened If logs and forensic report and it shows company field security You know with the plaintiff in whatever is there so that is basically where we apply the prepondence of the evidence So stronger evidence basically win even if it's not 100% certain So that is basically called as evidence so when you're doing an evidence management and all that okay We do the different type of forensics in the evidence like we do the network analysis where we dump the network data We do media analysis where we recover the data from a damage media Uh, we sometime investigating a software which is part of a software analysis process. Let's say example is If some is infected to the malware Okay, so we are investigating who is the author what is the content and how the content work If uh any intellectual property disputes are there then we identify who is the author what is the content what is available So This is called as a software analysis and in this software analysis process Okay, we do the reverse engineering value we do the malicious code review we have exploit code review all those So it's all those are basically part of our requirement But one of the biggest challenge for the forensic investigation is that doing investigation the hardware embedded devices So hardware embedded devices like you know from device like mobile and all that come from the vendor We can't able to investigate do we have any malware and all that so always remember one thing It is always always challenge for us to do the investigation on the embedded devices And another biggest concern it's come on the kernel level so if the anything is embedded in the kernel it is difficult to investigate Now we have a different type of investigations. We have operational which is also called administrative investigation Then we have a civil we have a criminal and we have a e-discovery Next thing we talk about here is uh ideas and IPS so ideas that alert the organization Okay, but IPS basically block the intuition So when you're talking about ideas and uh, you know IPS they are working on a particular sensor So they so ideas is two type NIDs and HIDs NIDs is something we install on the bottom of the network And HIDs we install on the host level I repeat again NIDs Is basically work on the network level and HIDs work on every host level that is basically an ideas and HIDs So if you're looking for the network level monitoring we use NIDs if you're looking for host level we use HIDs So let's understand the example So there is a one thief who tried to convince and bypass the apartment so there is a mean security guard was there And by which we can able to bypass that Okay, so this is an idea because which monitor the network traffic from where it is coming to where it is going But what on which particular floor is going what kind of a things you're doing on the particular floor particular house The NIDs security guard cannot be able to track so for that for every apartment we install the security guard so same here for every host we install the HIDs So which one is in line mode and IPS, IPS is the inline mode. Ideas doesn't do that. So that's something we need to understand. Second most important thing you need to understand, how the IDS detect the intrusion. So when you document IDS, there's a two way that it can detect the intrusion. One is called signature base, where we check the signature of the packet, compare again the database signature. One disadvantage is that fail to recognize the new attacks. On the other side, we have a second called as a behavior-based IDS, where we maintain the traffic profile and a mulliprofile. And based on that, we basically validate the things. So let's say example is we have a requirement like an anomaly profiles. Okay, so we have created a normal baseline traffic is if any traffic is coming from this to this, or any kind of a traffic is coming on the port number, 80 or 443 and all that. So okay, but if anyone sending traffic on some other ports and all that, we can able to block or we can able to detect, or we normally use to receive 1000 packets, but now we're receiving a 10,000 packet, 20,000 packet, which is against the parameter and all that. So that is basically document under the behavior-based or anomaly-based intrusion. So yes, one disadvantage of the behavior-based detection or herosity or anomaly-based detection is basically, sometimes it detects the false positive also. So that's something you need to remember. One biggest concern with an IDS is that if anyone setting up the encrypted traffic session like HTTP or TLS sessions and all that, if it's encrypted sessions, then we cannot able to inspect that particular traffic default because it's an encrypted traffic. So if you're looking for an alternate of that, then the alternate of that is basically, we can install the SSL offloader, where any connection coming from outside, we can terminate the connection on an IDS, and then on the other side, we can use another session to decrypt and then we can set up a new encryption session. So between this party, we can able to intercept and review the traffic, so that something can be done. Now another important thing when we're talking about the tactics of the IPS, we also use a honey pot to discover the new threats. So honey pot is called as an enticement, always remember. It's tempting a potential crime, it's a legal and ethical, that something is part of our requirement. We also use another concept called SIM. So we have a solution called log management system. So any traffic is coming from outside, all the data, all the logs of all the system go to one server, which is called log server. But the problem with the log server is that, manually we need to correlate, manually we need to relate, manually we need to verify everything, which is the time consuming activity. So to overcome that, we introduce SIM. So SIM is a group of technology, which aggregate the information about access control, system activity to store for analysis and correlation. So all the security related audit logs, when we're talking about, everything will be collected in a one server. That is a one function of the SIM, first it collect. Then what we can do, we can able to normalize the traffic. Normalize mean we convert into the common format, because every system generate a log in different format, at Windows generate in different format, Mac generate in a different format. So normalization has been done. Normalize what it does, it convert into common format. Then once you normalize, then you aggregate. Aggregation is an extra where you aggregate the common IPs and all that. And then you try to correlate the event. And then it provide the information on the interface. So the fastest way you can normalize aggregate correlate, it can provide the visibility. And that is the biggest reason we using SIM. Another important thing in the SIM, you need to properly configure the NTP protocol, because that is used for the time synchronization. So I repeat again, collect the logs. Normalize mean convert the log into common format, then aggregate that common pattern of information. Okay, this is the IP, which, and then we try to correlate how this IP is basically setting up the connections and all that. So we can use that for the investigation. So there's a multiple reason we are using SIM. And so regular compliance, internal accountability, instant response, investigations we have. Another important topic we called as a DLP, data loss prevention. See, we have a firewall, we have an IDS, we have an IPS. These solutions are introduced to monitor the traffic, which is coming from outside to inside. But DLP is a solution, which ensure the data should not leave the organization network in an unauthorized manner. And when it comes to DLP, it basically detect the infiltration of data, or when data is leaving outside by two, three methods. One is called signature base, they check the signature data and compare again the database signatures. Second is called as a labeling base, where we check the label of the data. Example, someone has labeled as a top secret. And we have a DLP rule that no one can able to send data outside the top secret label data. So based on a label, we can detect third, the most effective, but more time consuming is called as a pattern matching. Because in the pattern matching, what happens is, it do the deep inspection of the content. Let's example, we have installed a DLP for financial department. And this is sales team is there. So they're trying to upload some data, which has a credit card number. So now DLP will do the pattern matching, where they do the deep packet inspection and check for this credit card numbers, debit card numbers, pin numbers. So this is kind of a data pattern they do. And based on that, they try to block the things. So that's something is part of our requirement, is it clear? So the most effective is pattern. And most fastest is basically label. That's where data classification is the most important part of the DLP. Because if you classify wrong, according to the DLP and everything will basically block the things. So it's very important how you define the parameter. Another important thing we basically look for is that DLP have a three step process. First, it's discover the data, then we monitor, and then we enforce that something is part of our requirement. Ultimate goal of DLP is to protect the critical business data and interaction property. The next important thing we talk about the configuration management, very, very important. So in configuration management, is a collection of activities, focus on establishing maintaining the integrity of a product and system through the control of process and initializing, changing and monitoring the configuration of those product and system. That is called configuration management. You can see the uniformity state of a configuration, a standard configuration of the enterprise that is called as a configuration management. If you have a configuration management process in place, you can able to bring the uniformity. And if you don't have a configuration management, then what happens is every system runs with different configuration. So tomorrow, if you want to patch, you need to first discover those configuration, and then you need to patch. Imagine during a time of crowd strike, during a time of crowd site, this was the issue happened, right? So during the time of crowd site, we need to first locate the version of the windows which was infected and then we basically replacing a file. Now by having a configuration management practice in place, we know these are the systems running with this configuration. So it is easy for me to deploy. That's where the configuration management is very important. And one more important process closely work with configuration management, is called as a chain management process. So any kind of a modification, the chain management, it need to go through a chain management process. That's where chain management, track the accountability. Ultimate goal of chain management is to track the accountability of the change and maintain the integrity of the change. So if you're preparing for the CSSP, one thing you need to remember is you need to know the process of chain management process, where we have a change request, impact assessment, approval disapprovals, build and test change, notification of the change, implement, validate version and baseline. So it's very important. You need to know the chain management process thoroughly. Then we have a next thing called patch management process. Ultimate goal of patch management is to create a consistent configure environment that is secure against the known vulnerabilities in the operating system and application software. The two important component of the patch management is patch prioritization and scheduling because you need to prioritize the patch based on an urgency and impact. And during a downtime, we can schedule the patch. Now when we're talking about the patch management, now why we have a patch management? Let's take a, let's take an example if everyone is connected on the internet. And we'd let them download update directly from the internet. It is a time consuming activity, actually. So now what happened? We have a patch management server. We install in the enterprise. So we deploy all the patches to patch management server. We then test the patches and then locally, we can deploy the patches with the help of patch management process and release management process. There's another process closely work with patch management processes called as a vulnerability management process and release management process. Now another important thing, we talk about the operation security. So now we are talking about the concept of MSSP, managed service provider. So when we onboard any MSSP, MSSP is the one who going to deploy their solutions and they remotely manage for your enterprise. So when we onboard any MSSP, we have to look for some, you can say, some metrics. There are some following measures before we onboard them. The first is called as a review of governance. We need to check the governance aspects and that can be checked with the help of policies. Second is SLAs. Two important SLAs are required. Mean time to detect and mean time to respond. I think that covers the entire effectiveness of the, the SOC. Third is NDA agreement is there, non disclosure agreement, which can be able to track the things. NDA is basically very important, which protects unauthorized disclosure of information and everything. And insurance bonding in the case of breach and everything, insurance can play a very important role and audit testing is there. Strong contract language is another important element and if you outsourcing any services, regulatory approvals are the another important factor we especially in the case of GDPR and all that. If you're moving data outside the country, So, we have involved lot of inter-border data transfer. So, that's basically demand. that functions. Next concept is called as a threat intel. Threat intel is a data that is collected, process, analyze to understand a threat actor, motive, target and attack behavior. So threat is something very, it's very dynamic in nature. You cannot predict, let's example, you're going for CSSP exam. You cannot predict what is the first question, but that is a threat for you. Okay, what you can work is only your vulnerability or weaknesses. If you can able to patch your weaknesses, then any threat is there. It cannot be materialized effectively. So we used to have a traditional solutions like firewalls and all that. You define your IPs, what you need to block and they will block. But threat intel is something a new concept. You need to predict what can be the IP which can attack your systems, what can be the IP which can exploit your system. We need that kind of a solution which can predict the next move. So let's example, you have a house one, house two and house three. You have one of the strong defense, you have a strong physical security, blah, blah, blah, everything. One day what happened, there's a guy came, he knocked the door, he said, hey, I'm from NGO based on a trust, you open the door and that person has attacked you at 730. Then he went to house two with the same next day, 720, he knocked the door, hey, I'm from NGO, he opened the door, he attacked. Third person know this pattern. So if they knock the door immediately, he called the police. So he predict the threat. Okay, he collected the data from both houses, formed the information and applies intel that okay, 720, next day he will go into knock my door. So same like threat intel work. So threat intel was introduced to predict the TTP technique techniques and procedures. So that we can able to protect the system, we can exploit the system that something is part of our requirement. Is it clear? So when we're talking about TTP, with the TTP, we have a next topic which is called Soar Security Orchestration Automation Response. So it's streamlined your instant response, security operation and threat and vulnerability management. It ingest the multiple source of data. It assists with ingesting external data source and it orchestrating about detection, automation detection, response and automation that something is overall part of the requirement. So fastest way to prioritize, detect, respond, the incident that is basically do with the help of source. So in Soar we have a two things. One is called playbook and one is called runbook. Playbook is a document or checklist that define how to verify the incident and runbook is implemented in the playbook that can be in the automate manner. So fastest way to detect and respond to the incident, we can do with the help of Soar. Now next topic we called as an instant response. So in the instant response step we have seven steps. The first step is detection. Second is response, third is mitigation, fourth is reporting, fifth is recovery, sixth is remediation and seventh is lesson learned. It is very important. You should know each and every step and what is happening each and every step. So first step is detection where you confirm the incident. Second step is called as a response, where once you confirm you respond to the incident by preparing your containment strategy and all that. Then you isolate a system immediately from the network that is basically part of a mitigation. Then you notify this to the regulatory authority management everything that is part of a reporting. Then you remove the virus, restore the system back to the production that is called as a recovery. Then you identify root cause why this happen, how this happened to make sure it should not be repeated again. That is called as remediation. So problem management come into the picture and finally we have a lesson learned. It is same like we detect the COVID, we preparing a strategy respond to the COVID, isolate the person immediately, which is part of mitigation. Then we inform the neighbor, everyone that is called as a reporting. Then we go for 14 days recovery, then we identify how this happened, why this happened and we try to learn the lesson from there. So thin line difference between the problem management and incident management, incident management, ultimate goal is to reduce the impact, where the problem management is concerned with tracking the event. That something is part of a requirement. Another important thing we talk about the recovery strategy. In recovery strategy, we have another topic called as a different type of recovery sites. So we have a redundant center, we have a internal hot side, we have external hot side, we have one side, we have a cold side and we have a mobile site. I highly recommend check my coffee shot. I made dedicatedly coffee shot on the sites, incident management and forensic investigation, which help you to solidify the concepts. So when we talking about the first type of site is called redundant center. These all things are defined based on a BIA. BIA basically help you to prioritize what is important, what is not, and according to that we prepare the recovery strategy. So first is called as a redundant center. Redundant center is basically active active, where both operations, both site have a people process technology data. If one site is down, we can use another site. Second is called as a hot site. Hot side means we have a spare site, it has a people, it has a process, it has a technology, it has a server and data, not updated data, but data, but it is active as a. So either primary site is down, we update the recent data and make it as an operational. So that is basically called as a hot site. Hot site is also two type, build or buy. Third is called as a warm site. Warm site is basically we have a people, we have a process, we have a technology, but you know there's no server. We need to move server in the case of disaster. And then we have a cold site, cold site has nothing, I'm T shell. So that is basically called as a cold site. One more site we have a mobile site, which can be movable from one location to the location. So again based on a BIA, we can decide which site you want to go for it. Then when we looking for the availability, we also look for another important thing, which is called as a redundant components. Redundant component means spare component. Redund component is basically called as a spare component. Okay, so if one component is known, that redundant component is there by which we can able to continue services and they all are connected with the load balancer which offer fault tolerance. And outcome of all these things is called as a resiliency plan to make sure it should continue the service without any downtime. Now when we're talking about raid, you should know in raid, we have a three important features, striping, mirroring and parity. See, we have one disk is divided into partition. Okay, so used to date and the partition by another day, it directly impact the load on that one disk. So we want to distribute the load among the multiple disks. And this is where we introduce a conservative rate where we take the space from two, three disk and form the volume, form the space. So we have a different way to keep the data when it's called striping, when it's called mirroring and third is called parity. First is called striping. Striping is I want to copy data called high. My name is VP prop. It's a text file. So H will be in one disk. I will be in other disk. P will be in one disk. C will be in dust. So data is type across two disassembled aneously. Is it clear? So that is basically called as striping mirroring is basically mean one disk is data and another disk means in the copy of the data that is called as a mirroring. And third is called as a parity, which is basically used for recovery or data. Now what you need to know from example point of view, which can be testable or not, I'm not sure. But I believe this can be very, very important for you to understand. So if the question talking about which offer the highest performance for the video collaboration, video editing, data processing and all that, then answer is rate zero, which have a highest right performance. And if you get a topic around which is offer the highest fault tolerance recovery and everything, then answer is rate five, which providing you the highest fault tolerance. That's something is there. Then we also talking about the electronic voting journaling and remote mirroring. So we have a offsite in which we keep the data that's called offset facility over the networking. We update the data. Electronic voting on a real time we update the data is remote mirroring. Then there is one more service we use is journaling remote journaling. So what happened? This is closely work with electronic voting. So with the electronic voting over the networking, we update the data. Okay, but journaling used to update the transition record parallelly. So if I'm doing any transaction transition ID immediately replicate to the alternate site and associate data will move with the help of electronic voting. So journaling is basically used for keeping the critical files. Journaling is just like journal, you write everyday, right? Now once you basically create a DR plan, you need to test the plan. So we have a different type of testing or DR plan. The first is called read through test. Okay, read through test where we invite everyone in the meeting room and I distribute the plan to everyone. They share their viewpoint about this plan. Okay, but in my company, this guy, my department, this guy left the company, update this details. So that is basically called as a read through test, which is also called as a tabletop. One of the most least expensive, sorry, one of the least expensive method of testing and time and cost is also there. Second is called as a walkthrough of the plan. Walkthrough test mean that, you know, we have operations upwards, we quickly walk through with the plan and everything. Okay, the plan is created, plan is working effectively. Excellent. Now let me have a quick walkthrough about the plan. How the plan is going to be work. Then we have a simulation test, which is called as a fire drill exercise where the people will be evacuated and all that and see how soon they can leave the facility. Does it impact the productivity definitely yes. Next, we have a parallel test. Parallel test is something we'd perform on the alternate site and the best site for testing the parallel testing and all that we use the hot site. Hot set is cost effective. Okay, because we don't need to keep any servers there. We already the servers are there and the most expensive is cold site. Once we done with the parallel test, we got an assurance. Then we perform the full interruption test. Full interruption is something we perform on the primary site. Okay, once we get the clarity and everything, then we perform the full interruption test. So this is our overall plan we have that talking about the function. Ultimate goal of testing the plan is to update the plan. That's the thing because once you test, you find the gap, then you update the plan. So ultimate goal is to update the plan. So then what happens is when we update the plan with the help of the we do the uniformities concerns and everything that something is part of our requirement. So, this is all from ISI do let me know how do you find this spotcuss and are you waiting for the domain 8 do let me know in the comment box. Thank you so much. Bye.