Module 5-3,5-4

target all machines that require an update, are not a partof an exemption

IPS monitors for suspicious activity, which compares against a known threatdatabase or a baseline of normal activity

the ability to create andmanage reports.

collecting inventory metadata&sends that data to the designatedPrimary Site;maintain storage and file repository

include eradication of the security risk,reviewing and reporting on what happened;

MECM uses collections to targetworkstations and servers when it comes to deploying Applications and Software Updates

The 690 NSS/AMAC verifies compliance percentages via vulnerability scans

base communication squadron;ensure McAfee EndpointProducts are applied to client systems in adherence to DISA standards

used for large-scale deployments and provides a central point of administration

backbone of the ESS suite for the client

assessment of critical servers;vulnerable to attacks if not adequately tested/not generated from a tested machine image

triaging alerts from your endpoint security tools to determine which threats are real or thepriority to address

identify out-of-date software versions, applicable patches/system upgrades

placed on the network to look for anomalousnetwork activity;scan network packets at the router/host-level

continuous process of identifying, prioritizing, remediating, & reporting onsecurity vulnerabilities in systems

is a flexible, commercial-off-the-shelf (COTS)-based app to enhance the security posture of operational networks

aims to reduce the risk on systems and applications due to out-of-date codebases;scan computer/mobile devices

first phase of incident response planning and arguably the most crucial inprotecting our digital assets

NOS is responsible for patching vulnerabilities on servers, network infrastructure,boundary devices

DoD info system used to record,track& disseminate critical vulnerabilityinfo throughout the DoD Enterprise network.

identification of system components responsible foreach vulnerability, and the root cause of the vulnerability

Focuses on identifying the organizations essential activities,mission,business process, and system levels

assessment of policies&practices to preventunauthorized access to private/public networks &network-accessible resources

They will authorize NOS personnel to test software and OS updates

responsible for monitoring client health/assisting the NOSs w remediation of vulnerabilities that cant be remediated

e identifying of security vulnerabilities in web applications andtheir source code by automated scans on the front-end

provides configuration information of the client and available client actions

protect the endpoint from unauthorized device insertions

on demand scan;scan all files and folders

Java-based app that is used in conjunction w/the SCAPCompliance Checker scan

comprehensive STIG compliance tool that provides security monitoring, DISA STIG-specific audit logsreal-time monitoring

local to a host,may need to be monitored for malicious activity that pertains tospecific applications;signature based

draft a comprehensive list of an application’svulnerabilities

contain programs, software, updatesand even operating system images for client downloads.

security analystsassigning a rank or severity score to each vulnerability

provide ESS configurations, updates, and MasterSource Repository;point of contact for operating units for ESS

closing of security gaps;determine the most effective path for remediation/mitigation of each vulnerability

2 primary methods of detection are

actively defends&blocks unwanted/malicious communicationsfrom getting in;typically placed “in-band” with your network

a platform used by the Air Force tomonitor and maintain the thousands of systems across the Air Force Network

house the MECM database, data for its connectedsites, and distribute global data between them;boundaries are defined

access protection;blocks based on a pre-determined criteria

IDS identifies an activity as acceptable when the activity is actually an attack;most dangerous

o evaluating the people who enable the cybersecurity program

l execute vulnerability remediation to reduce AFIN risk through theimplementation of approved countermeasures

MECM reporting feature&define it as a series ofpowerful servers that maintain vast records of the thousands of computers

Vulnerabilities identified on devices that cannot be managed by NOSs are theresponsibility of the system owner/ADMIN

Incident response (IR) is a process, not an isolated event

types of requests that an application might receive

performs configuration scans of servers,network devices&databases to test for specific policy settings;vulnerab scanner

IDS identifies an activity as acceptable behavior and the activity is actuallyacceptable;ignoring acceptable behavior

support a faster pace of system updating and patch management for our network connectedWindows devices

task NOSs w Priority/Emergency vulnerability remediation actions;direct actions for NOS to cease enterprise-level patch.

automated compliance scanning tool that leverages the STIGs&OS-specific baselines toanalyze&report on the security confi

primary point of contact between themachine configuration manager client and the site server

vulnerability assessment evaluates if the system is susceptible to any knownvulnerabilities

function provided in ESS to monitor and report on subnets, usinglayer 2 traffic, for undefended machines

inconvenience at best and can cause significant issues;cannot be adjucidated

responsible for maintaining the security posture of the Department of DefenseInformation Network (DoDIN

focuses on maintaining an ongoing situational awareness about thesecurity posture of the system and the organization

What are the "contributing factors"

can monitor incoming/outgoing and local traffic;tools used for scanning network traffic

provides real-time detection of network anomalies and is scalable

open-source,multi-platform,lightweight IDS;comprehensive and accurate in successfully logging malicious network activity

a comprehensive security management solution that runs on networkcomputers to identify and stop threats automatically

responsible for identifying the information systems controlled by a (PMO) within their respective AOR

suite of centrally managed Defensive Cyber Operations (DCO) tools that provide means for the denial of adversary actions

assessing security controls applicable to the system&determine if the controls for implementation are implemented correc

provide system&network admins w/ proactive tools that can beused to identify vulnerabi before an adversary can find them

monitoring,detecting, alerting, and reporting on security events;identify unknown and suspected threats

aka heuristic-based or behavior-based detection first identifies normaloperation or normal behavior

automated systems that monitor and analyze network traffic&generate "alerts";send notif. to admins about suspicious act

this tool operates at the App Layer of the OSI model;signature analysis; both a signature&anomaly-based detection system

Vulne. Assessment&Mitigation tool are intended for cybersecurity professionalsresponsible for auditing computer networks

detection process is handled in 2 phases which are

employs firewall policies to configure IP address communication

goal of the vulnerability remediation/mitigation process is to mitigatethe risks associated with vulnerabilities

determine what software updates are required by theConfiguration Manager clients. This role is supported at all sites

target all systems, unless stated otherwise by the taskingauthority

The assessment of databases or big data systems for vulnerabilities&misconfigurations

aka definition-based use a database of known vulnerabilities orattack patterns.

monitor and maintain the health and operations of the ESS suites;support for base communication;daily ops of the ESS

Keeping your network safe from intrusion is one of the most vital parts of system and networkadministration and security

e IDS identifies an activity as an attack and the activity is actually anattack.

a vulnerability assessment is a systematic review of security weaknesses in aninformation system.

responsible for remediating assets that are supported by a weapons system orprogram management office

software packages used on information systems/networks to scan looking for weaknesses like open port exploitationss

to ensure that the proper security controls and processesare in place

Monitor network in real-time,looking for new hosts, apps&newvulnerabilities w/out requiring the need for active scann.

designed to evaluate the command’s emphasis on compliance with the IA controls that are in place

describes how to minimize network-based attacks & prevent system access when the attacker isinterfacing with the system

mainly a HIDS package;used as an alalytical utility to process data collected by snort

the process of managing softwareupdates

Most organizations use 2 types of IDS Host Intrusion Detection Systems and Network Intrusion Detection Syst

a stop-gap measure to resolve vulnerabilities until a new full release of the softwarebecomes available

tool automatically identifiesconfiguration vulnerabilities threatening the security of the DoD's computer system

a DISA-led formal inspection designed toincrease accountability and the security posture of DoD Information Networks

categorized based on the impact due to a lossof CIA of the information or system

creates pre-configured operating system images that are compliant with allapplicable TCNOs and STIG

A base’s network may be secure, but well-documented procedures will helpensure it stays that way.