ECIH flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Security incident

An adverse event that actually or potentially compromises the confidentiality, integrity, or availability of information assets and requires a coordinated response.

Event versus incident

An event is any observable occurrence in a system or network, while an incident is an event that negatively affects security and warrants investigation and response.

Incident response goal

To contain damage, restore normal operations quickly, preserve evidence, protect sensitive data, meet legal obligations, and reduce the likelihood of recurrence.

Preparation phase

The incident response phase that establishes policies, roles, communication plans, tools, training, and access to evidence so the team can respond effectively before an incident occurs.

Containment

The incident response phase that limits the spread and impact of an incident using short-term measures such as isolation and long-term measures such as segmentation or credential changes.

Eradication

The incident response phase that removes the root cause of an incident, including malware, compromised accounts, unauthorized access, and vulnerable configurations, before recovery begins.

Lessons learned

A post-incident review that documents what happened, response effectiveness, gaps, and corrective actions to improve future incident handling and prevention.

First responder priorities

Safety of people, preservation of evidence, containment of the incident, and documentation of actions, in that order, before deeper technical investigation begins.

Volatile evidence order

Collect registers and cache first, then RAM, swap, network connections, running processes, and finally disk, because more volatile data disappears fastest after shutdown.

Chain of custody

A documented record of who collected, handled, transferred, and stored evidence, when, and why, used to prove evidence integrity in legal or disciplinary proceedings.

Ransomware response rule

Isolate affected hosts, preserve evidence, identify the strain, restore from validated backups, and avoid paying unless authorized, since payment does not guarantee recovery.

Static malware analysis

Examining a malware sample without executing it by reviewing hashes, strings, headers, imports, and code structure to identify capabilities and family.

Dynamic malware analysis

Executing malware in an isolated sandbox while monitoring file, registry, network, and process activity to observe its behavior safely.

Rootkit

Malware that hides its presence by modifying operating system structures or firmware, often requiring memory analysis or offline scanning to detect.

Email header analysis

Reviewing Received, Return-Path, Message-ID, and authentication results such as SPF, DKIM, and DMARC to trace origin and verify sender legitimacy.

Business email compromise

A fraud scheme where an attacker impersonates an executive or trusted partner to trick employees into transferring funds or disclosing sensitive information.

Phishing containment

Block the sender and malicious URLs, purge matching messages from mailboxes, reset compromised credentials, and warn users who received the message.

Network flow analysis

Reviewing metadata such as source, destination, port, and byte counts from NetFlow or IPFIX to detect scanning, beaconing, and data exfiltration without full packet capture.

DNS tunneling indicator

Unusually long or high-volume DNS queries to a single domain may indicate data exfiltration or command-and-control traffic hidden in DNS.

Network containment

Limiting incident spread by segmenting networks, blocking malicious IPs or domains, disabling switch ports, and applying firewall or ACL rules.

Beaconing

Regular, periodic network connections from a host to an external server, often indicating malware command-and-control check-ins.

SQL injection

An attack that inserts malicious SQL statements into input fields to manipulate a database, bypass authentication, or extract sensitive data.

Cross-site scripting

An attack that injects malicious scripts into web pages viewed by other users, enabling session theft, defacement, or redirection.

Web application firewall

A security control that inspects HTTP traffic and blocks requests matching attack signatures or anomalous patterns, providing temporary containment during web incidents.

Shared responsibility model

A cloud security principle dividing duties between the provider, which secures the cloud infrastructure, and the customer, which secures data, identities, and configurations.

Cloud audit logs

Provider-generated records such as AWS CloudTrail, Azure Activity Log, and GCP Cloud Audit Logs that document API calls and administrative actions for investigation.

Cloud containment

Responding to cloud incidents by revoking access keys, disabling accounts, isolating instances, applying security groups, and preserving snapshots and logs.

Insider threat

A risk originating from a person with authorized access who intentionally or negligently misuses that access to harm the organization or its data.

User behavior analytics

Monitoring and baselining user activity to detect anomalies such as unusual access times, mass downloads, or privilege changes that may indicate insider activity.

Endpoint detection and response

A security tool that continuously monitors endpoints, records process and network activity, and enables investigation, containment, and remediation of host-based threats.

Sysmon

A Windows system service that logs detailed process creation, network connections, file changes, and registry events for endpoint detection and forensic analysis.

Host isolation

An endpoint containment action that cuts a compromised host off from the network while preserving its state for investigation and preventing further spread.