What is the first scenario described?

Third party breach involving AWS and Hotel Chains.

What is the second scenario described?

Intellectual Property Breach involving AWS.

What is the third scenario described?

Client Web Portal Compromise via SQL Injection.

What specific alert triggered the AWS scenario?

A news report from Krebs on Security about an AWS breach.

What data was affected in the Web Portal compromise?

Customer address, email, and purchase history.

What was the root cause of the Web Portal breach?

SQL injection against a connection between the web application and another internal application.

What containment step was suggested for the Web Portal?

Contacting the user by telephone, revoking access, or resetting passwords.

What did the malware analysis indicate in the AWS scenario?

Attackers zipped and encrypted data prior to exfiltration, but it is unknown if all data was collected.

What was the 'Wildcard' mentioned in preliminary considerations?

Identification of 3rd Party breaches, as it depends on notification from them.

IR Scenarios General | Montance® LLC

IR scenarios - General.pptx

IR Scenarios General

Presentation outlining common incident response scenarios for training.

This page contains AI generated content. Errors or omissions may be present. Use human level critical thinking.

Q: What is the first scenario described?

A: Third party breach involving AWS and Hotel Chains.
Q: What is the second scenario described?

A: Intellectual Property Breach involving AWS.
Q: What is the third scenario described?

A: Client Web Portal Compromise via SQL Injection.
Q: What specific alert triggered the AWS scenario?

A: A news report from Krebs on Security about an AWS breach.
Q: How long did the intruder operate in the AWS scenario?

A: Over the course of 14 months.
Q: What data was affected in the Web Portal compromise?

A: Customer address, email, and purchase history.
Q: What was the root cause of the Web Portal breach?

A: SQL injection against a connection between the web application and another internal application.
Q: What containment step was suggested for the Web Portal?

A: Contacting the user by telephone, revoking access, or resetting passwords.
Q: What did the malware analysis indicate in the AWS scenario?

A: Attackers zipped and encrypted data prior to exfiltration, but it is unknown if all data was collected.
Q: What was the 'Wildcard' mentioned in preliminary considerations?

A: Identification of 3rd Party breaches, as it depends on notification from them.

Ask a question

Have a doubt or need clarification?

  I’m here to help. Share your question, and I’ll get back to you with the guidance you need regarding the course.

Ask a question

Thank you!