The MTTR (Mean Time to Resolution) decreases by 20% is the best possible outcome that this effort hopes to achieve, as it reflects the improvement in the efficiency and effectiveness of the incident response process by reducing analyst alert fatigue. Analyst alert fatigue is a term that refers to the phenomenon of security analysts becoming overwhelmed, desensitized, or exhausted by the large number of alerts they receive from various security tools or systems, such as DLP (Data Loss Prevention) or CASB (Cloud Access Security Broker).
DLP is a security solution that helps to prevent unauthorized access, use, or transfer of sensitive data, such as personal information, intellectual property, or financial records. CASB is a security solution that helps to monitor and control the use of cloud-based applications and services, such as SaaS (Software as a Service), PaaS (Platform as a Service), or IaaS (Infrastructure as a Service). Both DLP and CASB can generate alerts when they detect potential data breaches, policy violations, or malicious activities, but they can also produce false positives, irrelevant information, or duplicate notifications that can overwhelm or distract the security analysts. Analyst alert fatigue can have negative consequences for the security posture and performance of an organization, such as missing or ignoring critical alerts, delaying or skipping investigations or remediations, making errors or mistakes, or losing motivation or morale. Therefore, it is important to reduce analyst alert fatigue and optimize the alert management process by using various strategies, such as tuning the alert thresholds and rules, prioritizing and triaging the alerts based on severity and context, enriching and correlating the alerts with additional data sources, automating or orchestrating repetitive or low-level tasks or actions, or integrating and consolidating different security tools or systems into a unified platform. By reducing analyst alert fatigue and optimizing the alert management process, the effort hopes to achieve a decrease in the MTTR, which is a metric that measures the average time it takes to resolve an incident from the moment it is reported to the moment it is closed. A lower MTTR indicates a faster and more effective incident response process, which can help to minimize the impact and damage of security incidents, improve customer satisfaction and trust, and enhance security operations and outcomes. The other options are not as relevant or realistic as the MTTR decreases by 20%, as they do not reflect the best possible outcome that this effort hopes to achieve. SIEM ingestion logs are reduced by 20% is not a relevant outcome, as it does not indicate any improvement in the incident response process or any reduction in analyst alert fatigue. SIEM (Security Information and Event Management) is a security solution that collects and analyzes data from various sources, such as logs, events, or alerts, and provides security monitoring, threat detection, and incident response capabilities. SIEM ingestion logs are records of the data that is ingested by the SIEM system from different sources. Reducing SIEM ingestion logs may imply less data volume or less data sources for the SIEM system, which may not necessarily improve its performance or accuracy. Phishing alerts drop by 20% is not a realistic outcome, as it does not depend on the integration of DLP and CASB or any reduction in analyst alert fatigue. Phishing alerts are notifications that indicate potential phishing attempts or attacks, such as fraudulent emails, websites, or messages that try to trick users into revealing sensitive information or installing malware. Phishing alerts can be generated by various security tools or systems, such as email security solutions, web security solutions, endpoint security solutions, or user awareness training programs.
Reducing phishing alerts may imply less phishing attempts or attacks on the organization, which may not necessarily be influenced by the integration of DLP and CASB or any reduction in analyst alert fatigue. False positive rates drop to 20% is not a realistic outcome

認証権限を持つユーザーを検証するためのアクセス制御の追加レイヤーを導入することは、主要な制御をバイパスする可能性のある認証脆弱性に対する最善の代替制御です。代替制御とは、主要な制御が不十分または実行不可能な場合に、脆弱性または脅威のリスクを軽減するために実装されるセキュリティ対策です。代替制御は、主要な制御と同等またはそれ以上のレベルの保護を提供し、対処する脆弱性または脅威と密接に関連している必要があります。この場合、主要な制御は機密データベースへのアクセスを制限することであり、脆弱性は認証バイパスです。
したがって、最適な代替制御は、多要素認証、ロールベースのアクセス制御、暗号化などのアクセス制御の追加レイヤーを導入し、データベースにアクセスする個人の身元と権限を確認することです。これにより、主要な制御がバイパスされた場合でも、代替制御によってデータベースへの不正アクセスを防止できます。
定期的な侵入テストの実行、定期的なセキュリティ意識向上トレーニングの実施、侵入検知ソフトウェアの実装はすべて優れたセキュリティ対策ですが、これらは主要な制御と同等またはそれ以上のレベルの保護を提供しておらず、対処している脆弱性や脅威と密接に関連していないため、認証の脆弱性に対する補償制御にはなりません。

Generating hashes for each file from the hard drive is the next action that the analyst should perform to ensure the data integrity of the evidence. Hashing is a technique that produces a unique and fixed-length value for a given input, such as a file or a message. Hashing can help to verify the data integrity of the evidence by comparing the hash values of the original and copied files. If the hash values match, then the evidence has not been altered or corrupted. If the hash values differ, then the evidence may have been tampered with or damaged .

* サーバー側リクエストフォージェリ (SSRF) は、攻撃者が Web サーバーを操作して不正な内部または外部リクエストを行い、多くの場合、内部リソースにアクセスしたりデータを盗み出したりするときに発生します。
* Web アプリケーション ファイアウォール (WAF) は、次のような理由から最適な緩和策です。
* 悪意のあるリクエストがサーバーに到達する前にフィルタリングしてブロックします。
* 攻撃者が内部サービスに不正なリクエストを送信するのを防ぎます。
* 着信トラフィック内の SSRF パターンを検出してブロックできます。
他の選択肢はなぜないのか?
* B (CASB) # クラウドアクセス制御に使用されますが、SSRF に対しては効果がありません。
* C (フォワード プロキシ) # 送信トラフィックの制御に役立ちますが、SSRF には受信要求が関係します。
* D (MFA) # 認証には役立ちますが、SSRF 攻撃を防ぐことはできません。
参照: CompTIA CySA+ CS0-003、第6章「アプリケーションセキュリティとセキュアコーディング」、セクション:
「SSRF と Web エクスプロイトの防止」

A false negative is a situation where an attack or a threat is not detected by a security control, even though it should have been. In this case, the SIEM rule was unable to detect an attack with nine failed logins, which is below the threshold of ten failed logins that triggers an alert. This means that the SIEM rule missed a potential attack and failed to alert the security analysts, resulting in a false negative.