Exam Objectives Fast Track

Security Incidents

• One of the most pertinent strategies you can implement is one of minimizing the number and, of course, the severity of security incidents.

• One of the biggest issues related to security infrastructure is the fact that there is not a great deal of effort put into the possibility that there could be a problem.

• Hackers, also called crackers, are technically proficient people who perform malicious cybercrimes on systems with the purpose of doing harm or causing havoc.

Malware Issues

• A computer virus is a self-replicating computer program that interferes with a computer's hardware, operating system, or application software.

• Viruses are designed to replicate and elude detection. Like any other computer program, a virus must be executed (loaded into the computer's memory) to function, and then the computer must follow the virus's instructions. Those instructions are referred to as the payload of the virus.

• A worm is a self-replicating program that does not alter files but resides in active memory and duplicates itself by means of computer networks.

• A Trojan horse (or Trojan, for short) closely resembles a virus but is actually in a category of its own. The Trojan horse is often referred to as the most elementary form of malicious code.

Incident Response

• Incident response involves identifying and responding to a problem that has occurred.

• When certain incidents occur, you might need to fix the immediate problem as well as investigating the person behind it.

• Because of the importance of evidence, it is essential that its continuity be maintained and documented.

• A chain of custody must be established to show how evidence made it from the crime scene to the courtroom. The chain of custody proves where a piece of evidence was at any given time and who was responsible for it. By documenting this information, you can establish that the integrity of the evidence wasn't compromised.

• Collection is a practice consisting of the identification, processing, and documentation of evidence. When collecting evidence, you start by identifying the evidence that is present and where it is located.