Module 5-3,5-4

creates pre-configured operating system images that are compliant with allapplicable TCNOs and STIG

a stop-gap measure to resolve vulnerabilities until a new full release of the softwarebecomes available

collecting inventory metadata&sends that data to the designatedPrimary Site;maintain storage and file repository

task NOSs w Priority/Emergency vulnerability remediation actions;direct actions for NOS to cease enterprise-level patch.

is a flexible, commercial-off-the-shelf (COTS)-based app to enhance the security posture of operational networks

Vulne. Assessment&Mitigation tool are intended for cybersecurity professionalsresponsible for auditing computer networks

assessment of policies&practices to preventunauthorized access to private/public networks &network-accessible resources

target all machines that require an update, are not a partof an exemption

Keeping your network safe from intrusion is one of the most vital parts of system and networkadministration and security

IDS identifies an activity as acceptable behavior and the activity is actuallyacceptable;ignoring acceptable behavior

local to a host,may need to be monitored for malicious activity that pertains tospecific applications;signature based

o evaluating the people who enable the cybersecurity program

Most organizations use 2 types of IDS Host Intrusion Detection Systems and Network Intrusion Detection Syst

responsible for remediating assets that are supported by a weapons system orprogram management office

a DISA-led formal inspection designed toincrease accountability and the security posture of DoD Information Networks

first phase of incident response planning and arguably the most crucial inprotecting our digital assets

provides configuration information of the client and available client actions

security analystsassigning a rank or severity score to each vulnerability

categorized based on the impact due to a lossof CIA of the information or system

aka heuristic-based or behavior-based detection first identifies normaloperation or normal behavior

this tool operates at the App Layer of the OSI model;signature analysis; both a signature&anomaly-based detection system

monitor and maintain the health and operations of the ESS suites;support for base communication;daily ops of the ESS

target all systems, unless stated otherwise by the taskingauthority

The 690 NSS/AMAC verifies compliance percentages via vulnerability scans

triaging alerts from your endpoint security tools to determine which threats are real or thepriority to address

The assessment of databases or big data systems for vulnerabilities&misconfigurations

provide system&network admins w/ proactive tools that can beused to identify vulnerabi before an adversary can find them

tool automatically identifiesconfiguration vulnerabilities threatening the security of the DoD's computer system

Vulnerabilities identified on devices that cannot be managed by NOSs are theresponsibility of the system owner/ADMIN

Incident response (IR) is a process, not an isolated event

software packages used on information systems/networks to scan looking for weaknesses like open port exploitationss

A base’s network may be secure, but well-documented procedures will helpensure it stays that way.

house the MECM database, data for its connectedsites, and distribute global data between them;boundaries are defined

actively defends&blocks unwanted/malicious communicationsfrom getting in;typically placed “in-band” with your network

primary point of contact between themachine configuration manager client and the site server

NOS is responsible for patching vulnerabilities on servers, network infrastructure,boundary devices

goal of the vulnerability remediation/mitigation process is to mitigatethe risks associated with vulnerabilities

a comprehensive security management solution that runs on networkcomputers to identify and stop threats automatically

base communication squadron;ensure McAfee EndpointProducts are applied to client systems in adherence to DISA standards

to ensure that the proper security controls and processesare in place

They will authorize NOS personnel to test software and OS updates

DoD info system used to record,track& disseminate critical vulnerabilityinfo throughout the DoD Enterprise network.

inconvenience at best and can cause significant issues;cannot be adjucidated

responsible for monitoring client health/assisting the NOSs w remediation of vulnerabilities that cant be remediated

designed to evaluate the command’s emphasis on compliance with the IA controls that are in place

detection process is handled in 2 phases which are

closing of security gaps;determine the most effective path for remediation/mitigation of each vulnerability

mainly a HIDS package;used as an alalytical utility to process data collected by snort

identification of system components responsible foreach vulnerability, and the root cause of the vulnerability

vulnerability assessment evaluates if the system is susceptible to any knownvulnerabilities

continuous process of identifying, prioritizing, remediating, & reporting onsecurity vulnerabilities in systems

e identifying of security vulnerabilities in web applications andtheir source code by automated scans on the front-end

automated compliance scanning tool that leverages the STIGs&OS-specific baselines toanalyze&report on the security confi

2 primary methods of detection are

the process of managing softwareupdates

on demand scan;scan all files and folders

monitoring,detecting, alerting, and reporting on security events;identify unknown and suspected threats

employs firewall policies to configure IP address communication

function provided in ESS to monitor and report on subnets, usinglayer 2 traffic, for undefended machines

IDS identifies an activity as acceptable when the activity is actually an attack;most dangerous

aka definition-based use a database of known vulnerabilities orattack patterns.

e IDS identifies an activity as an attack and the activity is actually anattack.

a vulnerability assessment is a systematic review of security weaknesses in aninformation system.

comprehensive STIG compliance tool that provides security monitoring, DISA STIG-specific audit logsreal-time monitoring

provides real-time detection of network anomalies and is scalable

MECM uses collections to targetworkstations and servers when it comes to deploying Applications and Software Updates

describes how to minimize network-based attacks & prevent system access when the attacker isinterfacing with the system

Monitor network in real-time,looking for new hosts, apps&newvulnerabilities w/out requiring the need for active scann.

assessment of critical servers;vulnerable to attacks if not adequately tested/not generated from a tested machine image

assessing security controls applicable to the system&determine if the controls for implementation are implemented correc

aims to reduce the risk on systems and applications due to out-of-date codebases;scan computer/mobile devices

focuses on maintaining an ongoing situational awareness about thesecurity posture of the system and the organization

used for large-scale deployments and provides a central point of administration

backbone of the ESS suite for the client

What are the "contributing factors"

performs configuration scans of servers,network devices&databases to test for specific policy settings;vulnerab scanner

Java-based app that is used in conjunction w/the SCAPCompliance Checker scan

placed on the network to look for anomalousnetwork activity;scan network packets at the router/host-level

determine what software updates are required by theConfiguration Manager clients. This role is supported at all sites

MECM reporting feature&define it as a series ofpowerful servers that maintain vast records of the thousands of computers

open-source,multi-platform,lightweight IDS;comprehensive and accurate in successfully logging malicious network activity

support a faster pace of system updating and patch management for our network connectedWindows devices

can monitor incoming/outgoing and local traffic;tools used for scanning network traffic

a platform used by the Air Force tomonitor and maintain the thousands of systems across the Air Force Network

protect the endpoint from unauthorized device insertions

responsible for identifying the information systems controlled by a (PMO) within their respective AOR

the ability to create andmanage reports.

draft a comprehensive list of an application’svulnerabilities

responsible for maintaining the security posture of the Department of DefenseInformation Network (DoDIN

identify out-of-date software versions, applicable patches/system upgrades

provide ESS configurations, updates, and MasterSource Repository;point of contact for operating units for ESS

Focuses on identifying the organizations essential activities,mission,business process, and system levels

types of requests that an application might receive

IPS monitors for suspicious activity, which compares against a known threatdatabase or a baseline of normal activity

access protection;blocks based on a pre-determined criteria

suite of centrally managed Defensive Cyber Operations (DCO) tools that provide means for the denial of adversary actions

contain programs, software, updatesand even operating system images for client downloads.

l execute vulnerability remediation to reduce AFIN risk through theimplementation of approved countermeasures

automated systems that monitor and analyze network traffic&generate "alerts";send notif. to admins about suspicious act

include eradication of the security risk,reviewing and reporting on what happened;