CompTIA Security+ Study Guide (SY0-401) Chapter 12: Disaster Recovery and Incident Response

Chapter 12: Disaster Recovery and Incident Response Given a scenario, implement basic forensic procedures. Summarize common incident response procedures. Summarize risk management best practices. Explain the proper use of penetration testing versus vulnerability scanning.

Business Continuity Business continuity planning (BCP) is the process of implementing policies, controls and procedures to counteract the effects of losses, outages, or failures of critical business processes Critical business functions(CBF) Two key components of BCP: business impact analysis (BIA) risk assessment

Storage Mechanisms Working copy backups Onsite storage are partial or full backups that are kept at the computer center for immediate recovery purposes Onsite storage usually refers to a location on the site of the computer center that is used to store information locally

Chapter 12: Disaster Recovery and Incident Response is the ability to recover system operations after a disaster Backups are duplicate copies of key information, ideally stored in a location other than the one where the information is currently stored

Backup Plan Issues A disaster-recovery plan helps an organization respond effectively when a disaster occurs Understanding Backup Plan Issues Database Systems User Files Applications

Knowing Backup Types Full Backup is a complete, comprehensive backup of all files on a disk or server Incremental Backup is a partial backup that stores only the information that has been changed since the last full or the last incremental backup Differential Backup backs up any files that have been altered since the last full backup; it makes duplicate copies of files that haven’t changed since the last differential backup

Developing a Backup Plan Grandfather, Father, Son method Grandfather, Father, Son method is based on the philosophy that a full backup should occur at regular intervals, such as monthly or weekly Full Archival method works on the assumption that any information created on any system is stored forever Backup Server method establishes a server with large amounts of disk space whose sole purpose is to back up data

Chapter 12: Disaster Recovery and Incident Response Recovering a System Backout vs. Backup alternate or backup sites Hot Site Warm Site

Chapter 12: Disaster Recovery and Incident Response Incident response plan (IRP) outlines what steps are needed and who is responsible for deciding how to handle a situation Incident is the occurrence of any event that endangers a system or network Incident response encompasses forensics and refers to the process of identifying, investigating, repairing, documenting, and adjusting procedures to prevent another incident

Incident Response Process Step One: Identifying the Incident Incident identification Step Two: Investigating the Incident Step Three: Repairing the Damage Step Four: Documenting and Reporting the Response Step Five: Adjusting Procedures

Forensics from the Security+ Perspective Act in Order of Volatility Capture System Image Document Network Traffic and Logs Capture Video Record Time Offset Take Hashes Capture Screenshots Talk to Witnesses Track Man Hours and Expenses

Chapter 12: Disaster Recovery and Incident Response Succession planning outlines those internal to the organization who have the ability to step into positions when they open Tabletop Exercises Simulate disaster Reinforcing Vendor Support Software vendors and hardware vendors are necessary elements in the process of building systems and applications

Service-Level Agreements Service-level agreement (SLA) is an agreement between you or your company and a provider, typically a technical support provider Recovery Time Objectives (RTO) is the maximum amount of time that a process or service is allowed to be down and the consequences still considered acceptable Mean Time between Failures (MTBF) is the measure of the anticipated incidence of failure for a system or component Mean time to restore (MTTR) is the measurement of how long it takes to repair a system or component once a failure occurs

Code Escrow Agreements refers to the storage and conditions of release of source code provided by a vendor Example: a code escrow agreement would stipulate how source code would be made available to customers in the event of a vendor’s bankruptcy

Penetration Testing Penetration testing Steps in penetration testing: the goal of penetration testing is to simulate an attack and look for holes that exist in order to be able to fix them Steps in penetration testing: Verify a Threat Exists Bypass Security Controls Actively Test Security Controls

Ethical Hacking Black Box White Box Gray Box the administrator acts as if they have no prior knowledge of the network White Box occasionally referred to as full disclosure testing Gray Box also known as partial disclosure testing.

Vulnerability Scanning involves looking for weaknesses in networks, computers, or even applications Five major tasks: Passively Testing Security Controls Interpreting Results Identifying Vulnerability Identifying Lack of Security Controls Identifying Common Misconfigurations