CompTIA CySA+ Study Guide, 3rd Edition

Chapter 9Building an Incident Response Program

THE COMPTIA CYBERSECURITY ANALYST (CYSA+) EXAM OBJECTIVES COVERED IN THIS CHAPTER INCLUDE:

• Domain 3.0: Incident Response and Management
  • 3.1 Explain concepts related to attack methodology frameworks
    • Cyber kill chain
    • Diamond Model of Intrusion Analysis
    • MITRE ATT&CK
    • Open Source Security Testing Methodology Manual (OSS TMM)
    • OWASP Testing Guide
  • 3.2 Given a scenario, perform incident response activities
    • Containment, eradication, and recovery
  • 3.3 Explain the preparation and post-incident activity phases of the incident management life cycle
    • Preparation
    • Post-incident activity

No matter how well an organization prepares its cybersecurity defenses, the time will come that it suffers ...