Incident response




1, Develop a wireless and BYOD security plan for the company. Use the NIST Guidelines for Securing Wireless Local Area Networks (WLANs) Special Publication 800-153
2provide answers to the threat of unauthorized equipment or rogue access points on the company wireless network and the methods to find other rogue access points
3. Describe how to detect rogue access points and how they can actually connect to the network. Describe how to identify authorized access points within your network.

4Within your plan, include how the Cyber Kill Chain framework and approach could be used to improve the incident response times for networks.
5Create scenario on suspicious behavior, and your report will provide another section of your Continuous Improvement Plan.”
6 Explain how identity theft could occur and how MAC spoofing could take place in the workplace.
7 How would you protect against both identity theft and MAC spoofing?
8Address if it is feasible to determine if MAC spoofing and identity theft has taken place in the workplace.
Include a whitelist of approved devices for this network. Examples may include authorized access points, firewalls, and other similar devices.
Are there any legal issues, problems, or concerns with your actions?
What should be conducted before starting this investigation?
Were your actions authorized, was the notification valid, or are there any other concerns? Include your responses as part of the Continuous Improvement Plan.” with the title “Tracking Suspicious Behavior.”
show management how remote configuration management works
description of remote configuration management and how it is used in maintaining the security posture of your company’s network. Then, consider the following scenario:
An undocumented device is found on the company network. You have determined that the owner of the device should be removed from the network. Implement this and explain how you would remove the employee’s device. How would you show proof that the device was removed?
Include your responses as part of the Continuous Improvement Plan.”
with the title “Remote Configuration Management.”
show how you would investigate possible employee misconduct. You have been given a report that an employee has recorded logins during unofficial duty hours. The employee has set up access through an ad-hoc wireless network. Provide a definition of ad hoc wireless networks and identify the threats and vulnerabilities to a company. How could this network contribute to the company infrastructure and how would you protect against those threats? Use notional information or actual case data and discuss.

Address self-configuring dynamic networks on open access architecture and the threats and vulnerabilities associated with them, as well as the possible protections that should be implemented.
From your position as an incident manager, how would you detect an employee connecting to a self-configuring network or an ad hoc network? Provide this information in the report.
How would signal hiding be a countermeasure for wireless networks?
What are the countermeasures for signal hiding?
How is the service set identifier (SSID) used by cybersecurity professionals on wireless networks? Are these always broadcast, and if not, why not?
How would you validate that the user is working outside of business hours?