342w Final Study Guide

disk striping with dedicated Hamming-code parity. OBSOLETE.

each participant goes through the activities and processes they would be expected to perform in an actual incident.

A RAID array in which every time data is written to disk, a portion (block) is written to each disk in turn, creating a "stripe" of data across the member disks. RAID 0 uses the total disk space in the array for storage, without protecting the data from drive failure. (2)

A technique that stripes data across three or more drives and uses parity checking, so that if one drive fails, the other drives can re-create the data stored on the failed drive. RAID 5 drives increase performance and provide fault tolerance. Windows calls these drives RAID-5 volumes.

While not a standard but a proprietary implementation, a system that incorporates the same principles as RAID 5 but enables the drive array to continue to operate if any disk or any path to any disk fails. The multiple disks in the array operate as a single virtual disk.

adds separate data parity drive not found in raid 5

Disruption of business with no warning; likely to get negative attention by media and public, problems for stakeholders

Disaster recovery plan phases

the recovery or salvage of necessary equipment technology, and data from the affected site

the reestablishment of normal operations at the primary site or new permanent site as they were before the disaster

free intrusion detection system

malware that does not require the host to do anything

A program disguised as a harmless application that actually produces harmful results.

Software that encrypts programs and data until a ransom is paid to remove it.

One method of testing a specific component of a plan. Typically, a team member makes a detailed presentation of the component to other team members (and possibly non-members) for their critique and evaluation.

contingency plan testing strategy in which individuals follow each and every IR/DR/BC procedure, including the disruption of service, restoration of data from backups, and notification of appropriate individuals

Also called mirroring, this RAID array type provides fault tolerance because all the data is written identically to the two drives in the mirrored set.

Byte-level striping with dedicated parity.

Striping then mirroring/ mirroring then striping

Under CSRC, which is under NIST, where to go for templates and plans if you are a government contractor

in degraded mode means operating at a reduced capacity or in a mode with fewer capabilities

attaching yourself while working at a physical workbench in order to avoid static discharge

a problem that may not be initially recognized as a crisis inside or outside the organization, it may generate unfavorable news if revealed

the planning and rehersal necessary to ready the organization to deal with a disaster

the recovery or salvage of necessary equipment, technology, and data from the affected site

the reconstruction of facilities and re-installation of technologies and equipment at the primary site or selection and preparation of a new permanent site

Application that captures and analyzes network packets

A network utility designed to scan a network and create a map. Frequently used as a vulnerability scanner.

Federal Emergency Management Agency, helps people before during and after disasters, works with all levels of government to meet the needs of overwhelming incidents

actions after phase, asses extent of the damage, restore lost or damaged data, scrub systems of infection, conduct an after action review

Faster recovery, improved survivability, efficiency in providing services, added flexibility,

The CP testing strategy in which copies of the appropriate plans are distributed to all individuals who will be assigned roles during an actual incident or disaster; each individual reviews the plan and validates its components.

designed to test your plans in a role playing activity where key actors react to critical events

Block-level striping with dedicated parity.

Disk striping with extra parity. Like RAID 5, but with more parity data.
Requires five or more drives, but you can lose up to two drives at once and your data is
still protected.

Critical Incident Stress Debriefing ; severe events are discussed within teams; peer driven process; confidential; after a major incident; conducted 24-72 hours after

Steps in collecting digital forensic evidence

Government agency that analyzes and disseminates actionable threat information about critical infrastructure

CBK