1
00:00:00,090 --> 00:00:01,260
In this section of the course

2
00:00:01,260 --> 00:00:03,180
we're going to cover how to investigate an incident

3
00:00:03,180 --> 00:00:06,060
in the real world as a cybersecurity professional.

4
00:00:06,060 --> 00:00:07,680
Now, as a cybersecurity professional

5
00:00:07,680 --> 00:00:10,590
our job is to gather, analyze, and interpret data

6
00:00:10,590 --> 00:00:12,180
in order to uncover hidden threats

7
00:00:12,180 --> 00:00:14,940
and respond effectively to security incidents.

8
00:00:14,940 --> 00:00:15,773
We're going to be exploring

9
00:00:15,773 --> 00:00:17,550
a comprehensive set of data sources

10
00:00:17,550 --> 00:00:19,410
from dashboards and automated reports.

11
00:00:19,410 --> 00:00:21,240
They're going to provide high level insights,

12
00:00:21,240 --> 00:00:22,950
all the way down to more granular data

13
00:00:22,950 --> 00:00:24,750
obtained through vulnerability scans,

14
00:00:24,750 --> 00:00:26,940
packet captures, and various types of logs,

15
00:00:26,940 --> 00:00:29,340
including firewall logs, application logs,

16
00:00:29,340 --> 00:00:32,490
endpoint logs, operating system specific security logs,

17
00:00:32,490 --> 00:00:33,750
intrusion prevention system,

18
00:00:33,750 --> 00:00:35,400
intrusion detection system logs,

19
00:00:35,400 --> 00:00:36,840
and network logs.

20
00:00:36,840 --> 00:00:38,183
All of these data sources

21
00:00:38,183 --> 00:00:40,560
are going to serve as our foundation for our investigations

22
00:00:40,560 --> 00:00:42,360
and allow us to piece together the puzzle

23
00:00:42,360 --> 00:00:44,670
of cyber incidents and make more informed decisions

24
00:00:44,670 --> 00:00:46,740
to safeguard our digital assets.

25
00:00:46,740 --> 00:00:48,570
So in this section of the course,

26
00:00:48,570 --> 00:00:49,740
we're going to be focused solely

27
00:00:49,740 --> 00:00:52,500
on domain four and objective 4.9.

28
00:00:52,500 --> 00:00:55,200
Objective 4.9 states that given a scenario,

29
00:00:55,200 --> 00:00:56,940
you must be able to use data sources

30
00:00:56,940 --> 00:00:58,800
to support an investigation.

31
00:00:58,800 --> 00:01:00,330
Now, for most of my students

32
00:01:00,330 --> 00:01:02,940
this is probably the hardest objective on the exam

33
00:01:02,940 --> 00:01:05,310
because you're not being asked to just memorize things.

34
00:01:05,310 --> 00:01:06,630
But here you're going to be asked

35
00:01:06,630 --> 00:01:08,760
to look at a given log snippet or alert

36
00:01:08,760 --> 00:01:09,750
and then make a decision

37
00:01:09,750 --> 00:01:11,880
based on the evidence you see in that code snippet

38
00:01:11,880 --> 00:01:14,250
to determine if an incident has occurred or not.

39
00:01:14,250 --> 00:01:16,470
And if one has, what kind of remediation

40
00:01:16,470 --> 00:01:17,670
would you recommend performing

41
00:01:17,670 --> 00:01:19,200
on that given system?

42
00:01:19,200 --> 00:01:21,150
For example, consider the following snippet

43
00:01:21,150 --> 00:01:24,150
of a web server log that contains six lines of code.

44
00:01:24,150 --> 00:01:25,890
As you review those lines of the log,

45
00:01:25,890 --> 00:01:26,940
you're going to be able to determine

46
00:01:26,940 --> 00:01:29,040
what kind of attack was being attempted.

47
00:01:29,040 --> 00:01:30,870
Now in this example, look at line two

48
00:01:30,870 --> 00:01:33,300
and you notice that there's a query string of laptops,

49
00:01:33,300 --> 00:01:35,250
that is normal and that is perfect.

50
00:01:35,250 --> 00:01:36,870
But if you look down in line three,

51
00:01:36,870 --> 00:01:38,610
we see the query string is updated

52
00:01:38,610 --> 00:01:41,700
to include laptops, apostrophe, semi-colon,

53
00:01:41,700 --> 00:01:44,940
DROP TABLE users, semi-colon, dash, dash.

54
00:01:44,940 --> 00:01:47,610
Now, this line isn't just looking for the term laptops

55
00:01:47,610 --> 00:01:49,650
but instead it's using that apostrophe to

56
00:01:49,650 --> 00:01:51,510
attempt an SQL injection.

57
00:01:51,510 --> 00:01:54,600
So if the question asks you what type of an attack this was

58
00:01:54,600 --> 00:01:56,910
you would say it's an SQL injection.

59
00:01:56,910 --> 00:01:58,620
Alternatively, they may also ask you

60
00:01:58,620 --> 00:02:00,570
what's the best way to mitigate against this type

61
00:02:00,570 --> 00:02:02,790
of attack that you looked at inside of the logs?

62
00:02:02,790 --> 00:02:04,170
So looking at the logs

63
00:02:04,170 --> 00:02:06,270
you determine it's an SQL injection.

64
00:02:06,270 --> 00:02:07,650
Now, what's the best answer

65
00:02:07,650 --> 00:02:09,750
to be able to prevent an SQL injection?

66
00:02:09,750 --> 00:02:10,590
And that would be something

67
00:02:10,590 --> 00:02:12,450
like a web application firewall

68
00:02:12,450 --> 00:02:14,190
being placed between the database server

69
00:02:14,190 --> 00:02:16,440
and the end user who's trying to access it.

70
00:02:16,440 --> 00:02:18,660
Because a web application firewall can detect

71
00:02:18,660 --> 00:02:20,820
and prevent SQL injections from occurring

72
00:02:20,820 --> 00:02:22,590
by conducting input sanitization

73
00:02:22,590 --> 00:02:24,300
and blocking out known attack patterns

74
00:02:24,300 --> 00:02:26,820
like those used in an SQL injection.

75
00:02:26,820 --> 00:02:28,590
Now as we begin this section of the course

76
00:02:28,590 --> 00:02:29,640
we are going to start out by looking

77
00:02:29,640 --> 00:02:30,960
at the different types of data

78
00:02:30,960 --> 00:02:33,210
that can be used during your investigations.

79
00:02:33,210 --> 00:02:35,820
Then we're going to move through 11 different examples

80
00:02:35,820 --> 00:02:36,990
with some known incidents

81
00:02:36,990 --> 00:02:38,970
that you can then learn how to read these logs,

82
00:02:38,970 --> 00:02:40,620
alerts, and other types of data

83
00:02:40,620 --> 00:02:42,930
so you can use it during your investigation.

84
00:02:42,930 --> 00:02:44,280
As we move through the section,

85
00:02:44,280 --> 00:02:46,140
we're going to cover things like dashboards,

86
00:02:46,140 --> 00:02:48,390
automated reports, vulnerability scans,

87
00:02:48,390 --> 00:02:51,420
packet captures, firewall logs, application logs,

88
00:02:51,420 --> 00:02:54,030
endpoint logs, operating system security logs,

89
00:02:54,030 --> 00:02:56,130
IPS and IDS logs and alerts,

90
00:02:56,130 --> 00:02:58,110
network logs, and metadata.

91
00:02:58,110 --> 00:02:59,970
Once we finish going through all the examples

92
00:02:59,970 --> 00:03:01,470
of each of those different types of data

93
00:03:01,470 --> 00:03:02,880
that you may see on the exam,

94
00:03:02,880 --> 00:03:04,560
we're then going to move into a short quiz

95
00:03:04,560 --> 00:03:06,720
to see what you've learned during this section of the course

96
00:03:06,720 --> 00:03:08,640
and review each of those quiz questions fully

97
00:03:08,640 --> 00:03:11,370
to ensure you can explain why the right answer was right.

98
00:03:11,370 --> 00:03:12,780
So if you're ready,

99
00:03:12,780 --> 00:03:14,490
let's start investigating our data

100
00:03:14,490 --> 00:03:16,170
so we can identify if some kind of action

101
00:03:16,170 --> 00:03:17,220
is malicious or not

102
00:03:17,220 --> 00:03:18,670
in this section of the course