EC-COUNCIL 212-89 - Questions & Answers

By classifying and encrypting customer Personally Identifiable Information (PHI), you are specifically guarding against the risk of Sensitive Data Exposure. This OWASP security risk involves the accidental or unlawful exposure of protected data to unauthorized individuals. Encryption serves as a critical defense mechanism by ensuring that, even if data is accessed without authorization, it remains unintelligible and useless to the attacker without the decryption keys. Data classification further supports this by identifying which data is sensitive and requires such protections, ensuring that appropriate security controls are applied to prevent exposure.

References:
OWASP Top 10, a widely respected document that outlines the most critical web application
security risks, identifies Sensitive Data Exposure as a key risk area. Incident Handler (ECIH v3) courses and study guides often refer to the OWASP Top 10 to explain common web security risks and appropriate countermeasures, including the importance of encrypting sensitive data.

A Trojan attack involves a type of malicious code or software that appears legitimate but can take control of your computer. Trojans often disguise themselves as legitimate software or are hidden within legitimate software that has been tampered with. They differ from viruses and worms because they do not replicate.
However, once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. This can include unauthorized actions such as deleting files, monitoring user activities, or installing additional malicious software.

References:
The ECIH v3 course details various forms of malware, including Trojans, their modes of
operation, and their impact on information security. Understanding the nature of these threats is crucial for effective incident handling and response.

Risk assessment is the risk management process that involves identifying risks, estimating their impact on the organization, and determining the sources of those risks to recommend appropriate mitigation measures. The goal of a risk assessment is to understand the nature of potential threats, vulnerabilities, and the consequences of those risks materializing, allowing an organization to make informed decisions about how to address them effectively. Risk assumption involves accepting the potential impact of a risk, risk mitigation focuses on reducing the likelihood or impact of risks, and risk avoidance involves taking actions to avoid the risk entirely.
References:
The ECIH v3 course materials include discussions on risk management processes, outlining the importance of risk assessment in identifying and preparing for potential security threats.

Email Dossier is a tool designed to perform detailed investigations on email messages to verify their authenticity and trace their origin. It can analyze email headers and provide information about the route an email has taken, the servers it passed through, and potentially malicious links or origins. For an incident handler like Stenley, tasked with verifying the validity of emails and containing malicious email threats, Email Dossier serves as a practical tool for analyzing and validating emails received by employees. By using this tool, Stenley can identify fraudulent or suspicious emails, thereby helping to protect the organization from phishing attacks, malware distribution, and other email-based threats.

References:
In the context of managing and mitigating the risks associated with email communications,
ECIH v3 study materials outline various tools and techniques for email analysis and validation. These resources recommend the use of tools like Email Dossier for incident handlers to effectively scrutinize incoming emails for security threats.

Farheen's activity of using the DD tool to create a sector-by-sector mirror image of the original disk is an example of system preservation. This process is crucial in digital forensics for creating an exact copy of a storage device to ensure that the original data remains unchanged during the investigation. By making a forensic duplication, or image, of the disk, Farheen ensures that the static data on the disk is preserved in its current state for thorough analysis, without altering the original evidence. This step allows investigators to work with a precise replica of the data, protecting the integrity of the original evidence.

References:
The Incident Handler (ECIH v3) certification materials discuss various methods and tools for
data acquisition and preservation, highlighting the importance of system preservation in the initial stages of forensic analysis.

Leaving sensitive business details over voicemail or sending them out through email broadcast messages is not a best practice for security. This approach significantly increases the risk of information leakage and unauthorized access to critical business information. Such practices can be exploited by insiders to conduct malicious activities, including data theft, fraud, or sabotage. The best practices for mitigating insider threats involve implementing strict access controls, monitoring and auditing employee actions, securing communications, and ensuring that sensitive information is only shared through secure and authorized channels. Encouraging or allowing the practice of leaving sensitive business details in such insecure manners contradicts the principles of information security and increases the vulnerability to insider attacks.

References:
ECIH v3 courses and study materials stress the importance of implementing strong security
policies and practices to mitigate the risk of insider threats. These include controlling access to information, monitoring use of corporate resources, and securing communication channels to ensure that sensitive information is not exposed or mishandled within the organization.

Anti-forensics techniques are designed to prevent, mislead, or interfere with the incident handling process, affecting the collection, preservation, and identification phases of the forensic investigation process. These techniques include methods to erase, encrypt, or alter information, make data recovery difficult, hide data (e. g., steganography), or otherwise obstruct forensic analysis and investigation efforts. Anti-forensics can significantly challenge the efforts of incident responders and forensic investigators in establishing the facts of a security incident or crime.

References:
The Incident Handler (ECIH v3) courses and study guides discuss various challenges in digital
forensics, including anti-forensics methods and their impact on the effectiveness of forensic investigations.

An active assessment involves using automated tools to scan and probe the network actively to identify hosts, services, and vulnerabilities. This type of assessment directly interacts with the network components to gather information about the existing security posture, unlike passive assessments, which analyze traffic without sending packets to the target systems. Dickson's approach, employing automated tools to identify the network's hosts, services, and vulnerabilities, fits the definition of an active assessment. This method provides a more immediate understanding of the network's vulnerabilities, allowing for timely remediation actions.

References:
The ECIH v3 program includes discussions on vulnerability assessment techniques,
highlighting the differences between active and passive assessments and their applicability in identifying network security issues.

The correct sequence of steps involved in forensic readiness planning, based on the activities described, is as follows:

Identify the potential evidence required for an incident.

Determine the source of the evidence.

Define a policy that determines the pathway to legally extract electronic evidence with minimal disruption.

Establish a policy for securely handling and storing the collected evidence.

Identify if the incident requires full or formal investigation.

Train the staff to handle the incident and preserve the evidence.

Create a special process for documenting the procedure.

References:
Incident Handler (ECIH v3) courses and study guides include discussions on forensic
readiness planning, highlighting the importance of preparing organizations for effective legal and technical handling of incidents.

Turning off the infected machine is a common immediate response to contain a malware incident and prevent it from spreading to other systems on the network. This action halts any ongoing malicious activities by the malware, thereby limiting the potential for further damage or data exfiltration. However, it is essential to note that this step can lead to the loss of volatile data that might be useful for forensic analysis.
Therefore, it is advisable only when it's critical to stop the malware immediately, and there's a strategy in place for forensic investigation that includes handling non-volatile data or when the preservation of volatile data is not possible.

References:
The Incident Handler (ECIH v3) curriculum by EC-Council outlines various strategies for
containing malware incidents, discussing the implications and considerations of actions such as turning off infected machines.