mod 4

process of analyzing logs from separate systems in order to determine if events are related

air force computer was incorrectly configured/ did not follow established policy

powerful and affordable network monitoring software enabling you to quickly detect, diagnose, and resolve network perf,

records events logged by programs

Some problems are intermittent. Generally, intermittent problems are more difficult to solve.

monitor your applications & their supporting infrastructure;running on-premises, in cloud, or in a hybrid environment.

list standard configurations;may contain a troubleshooting section, list error messages &solutions/provide links to onli

process of combining logs together;different formats from different systems work together

records events logged by the system components

In IT terms, an incident is anything that compromises: confidentiality, integrity, availability

unauthorized person gained root-level access/privileges on an Air Force system or network device

While implementing your action plan, have you learned new facts?• What is the next most likely probable cause?

lets you monitor system events;maintains logs about computerprogram, security, and system events

Your first step would be to check to see that the network cable is plugged in

SIEM tools are esentially log mannagement solutions with added utilities for real-time analysis,alerting,correlation

It can immediately occur at startup or aftera computer has been working for a time;common problem

introduction of information classififed above the level a network system

This ensures that even if a data packet is intercepted, it is unreadable to the attacker

user has network plugged in & IP settings are properly configured;look at networking devices;network reside between user

primary entities that record suspicious, unauthorized network,information systems access and activity.

a computer is having issues accessing websited and shared drives

Primary detection tool is

determine if issue is hardware/software related;rank possible causes by likelihood

approach of trading suspected bad components for known good.

occurs when a higher classification level of data is placed on a lowerclassification level system/device

unauthorized individuals gaining full or limited access to a network

Did your action plan work? Were the results unexpected? Can new facts be gathered?

looks at patterns in order to differentiate normal and abnormal activities

if video is working, you may encounter error messages displayed on the screen;messages occur before windows loads

higher classification level of data is transferred to a lower classificationlevel system via messaging systems;email

Air Force computer/information system/network was incorrectly configured

multi-vendor flow and analysis tool designed to proactively reduce network downtime

Replace the component you suspect to be broken with something that you know is working;supply of working equip. to pull

You would also validate that their NIC is enabled and their IP settings are correc

one of the primary network operations duties is to MONITOR SYSTEMS

isolate the problem by using context clues, error messages, and personal experience

incident inlude: attempted entry, unauthorized entry & attacks on an information system

Problems caused by the hard drive can stem from several possibilities including hardware and software

These tools are usually available for download from a manufacturer’s site.

Commonly a result of short circuiting; electrical spikes, power surges

different categories of information have different handling requirements

records security events such as valid and invalid logon attempts

includes detection of network scanning, multiple connection attemptsto a network device from an unknown entity, etc.

logs consist of a header, a description of the event (based on the event type), and optional data.

unable to access a website while using Internet Explorer; internet browser is the problem;issue w/ user Operating System

open ports on an Air force computer

hostile code successfully infected an Air Force computer

any defect that can leave a system open to attack

aids in diagnosing and understanding network communication problems

use of Air Force computer was denied due to an overwhelming volume of unauthorized network traffic

An unauthorized person gained user- level privileges on an Air Force computer/information system/networkdevice

An incident may also involve a violation of law.

Make changes one at a time;Attempt actions with the least customer impact first

not necessarily a malicious act, but it is a common method gathering information about a network before an actual attack

check to see if network cable is plugged in

powerful, scalable infrastructure monitoring & management platfomr used by federal government to simplify ID admin

is employed to collect, aggregate, and apply pattern matching to the volumes of data'review and use info from logs

When no actual messages are being sent, the channel can be masked by sending dummytraffic that looks like encrypted traf

How can you prove or disprove your most likely problem causes;Gather necessary tools to address problem

unauthorized person gained root-level access

Air Force computer/information system/network was denied due to an overwhelming volume of unauthorized network traffic.