Cisco CyberOps Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CIA triad

Confidentiality ensures data is accessible only to authorized parties; Integrity ensures data is accurate and unaltered; Availability ensures data and systems are accessible when needed.

NIST IR life cycle

Four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; Post-Incident Activity. Provides a structured framework for handling security incidents.

SOC Tier 1

First-line analysts who monitor alerts, perform initial triage, validate incidents, and escalate confirmed threats to Tier 2. Focus on volume and speed.

MTTD and MTTR

Mean Time To Detect (average time to identify an incident) and Mean Time To Respond (average time to contain or remediate). Lower values indicate a more effective SOC.

Chain of custody

Documented record of who handled evidence, when, where, and why. Ensures evidence integrity for legal or disciplinary proceedings; use hashing and write blockers.

GDPR breach notification

Requires organizations to notify supervisory authorities within 72 hours of becoming aware of a personal data breach, unless unlikely to result in risk to individuals.

Cyber Kill Chain

Lockheed Martin model with seven phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives. Used to map attacker progression.

MITRE ATT&CK

Knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations. Used for threat modeling, detection engineering, and gap analysis.

False positive

A benign event incorrectly flagged as malicious by a detection system. High false positive rates cause alert fatigue and reduce SOC efficiency.

False negative

A malicious event that a detection system fails to identify. Represents a missed threat and is more dangerous than a false positive because it allows attacker activity to continue undetected.

IOC vs IOA

Indicators of Compromise are artifacts (hash, IP, domain) suggesting a breach already occurred. Indicators of Attack are behaviors or TTPs indicating an active attack in progress.

YARA rule

Pattern-matching rule used to identify malware based on textual or binary strings, hex patterns, and conditions. Commonly used in file scanning and memory forensics.

Sigma rule

Vendor-agnostic detection rule format that can be converted into SIEM queries (Splunk, Elastic, QRadar). Enables portable detection logic across platforms.

DNS tunneling

Technique that encodes data within DNS queries and responses to exfiltrate information or establish command and control. Detected via long, high-entropy subdomains and unusual query volumes.

Order of volatility

RFC 3227 guideline for evidence collection: collect most volatile data first (CPU registers, RAM, network state, processes) before less volatile data (disk, logs, backups).

Containment

Incident response phase that limits the spread of an incident. Methods include network isolation, endpoint containment via EDR, account disablement, and perimeter blocking of IOCs.

Eradication

Phase following containment where the root cause is removed: malware deleted, vulnerabilities patched, credentials reset, and compromised systems rebuilt.

Windows Event ID 4624

Logs a successful logon event. Includes logon type (interactive, network, remote), account name, and source IP. Critical for detecting lateral movement and unauthorized access.

Windows Event ID 4688

Records process creation. Includes process name, command line, parent process, and user. Essential for detecting malicious execution and building process trees.

Volatility

Open-source memory forensics framework. Plugins such as pslist, netscan, malfind, and hashdump extract processes, network connections, injected code, and credentials from RAM captures.

Timeline analysis

Forensic technique that normalizes timestamps from multiple sources (host, network, application logs) into a single chronological view to reconstruct attacker activity.

Lessons learned

Post-incident review meeting that identifies root cause, evaluates response effectiveness, and produces recommendations to update playbooks, detection rules, and controls.

Threat hunting loop

Iterative process: hypothesis generation, data collection, analysis, validation, and automation of new detections. Aims to find threats that evade existing controls.

Pyramid of Pain

Model ranking indicators by how much difficulty they cause adversaries when blocked. TTPs at the top are hardest to change; hash values at the bottom are trivial to change.

TLP

Traffic Light Protocol for information sharing: RED (limited, named recipients), AMBER (limited distribution), GREEN (community), CLEAR (public). Controls how threat intelligence is shared.

STIX/TAXII

STIX is a structured language for describing cyber threat intelligence; TAXII is a transport protocol for exchanging STIX data between systems and communities.

Strategic threat intelligence

High-level intelligence focused on trends, risks, and geopolitical context for executives and decision-makers. Informs long-term security strategy and investment.

Tactical threat intelligence

Operational-level intelligence about specific threats, including IOCs (IPs, domains, hashes) and TTPs, used by SOC analysts to detect and block attacks.

SOAR

Security Orchestration, Automation, and Response platform. Integrates security tools, automates workflows, and manages incident response playbooks to improve SOC efficiency.

Playbook

Predefined, automated workflow that guides response to a specific incident type (e.g., phishing, malware). Defines steps, tools, and decision points for consistent handling.

Orchestration vs automation

Orchestration coordinates multiple tools and processes into a unified workflow; automation executes repetitive tasks without human intervention. Orchestration often includes automation.

Human-in-the-loop

Design pattern where high-impact automated actions (account disable, host isolation) require analyst approval, while low-risk enrichment tasks run fully automated.