Chapter 1
Security Architecture
Course: Comptia Securityx Cas 005
Subject: Comptia Securityx Cas 005 Practice Exam
Chapter: Security Operations
Overview of Threat Management
Threat management involves identifying, assessing, and mitigating risks posed by various types of threats to an organization's assets and operations. It includes activities such as monitoring, analysis, and response to potential or actual threats. A robust threat management strategy is critical for maintaining security and operational continuity.
1. Intelligence Types
Threat intelligence provides the foundation for understanding and mitigating threats. It is categorized into three types:
Tactical Intelligence
- Definition: Tactical intelligence focuses on immediate, actionable information about ongoing threats, such as known malware or phishing campaigns.
- Example: Identifying a commodity malware strain like Emotet spreading via email attachments and creating a signature to block it in the network firewall.
- Activities:
Monitoring Indicators of Compromise (IoCs). Updating antivirus and endpoint detection systems. Automating defenses against common malware.
- Monitoring Indicators of Compromise (IoCs).
- Updating antivirus and endpoint detection systems.
- Automating defenses against common malware.