Organizational Role DescriptionThis is an alpha version of a proposed set of roles for Cyber Defense Incident Responders transmitted via E-mail by Dorian J. Cougias, Co-Founder and Compliance Scientist, Unified Compliance Framework (grcschema.org) on March 29, 2021Cyber Defense Incident ResponderCDIR_c27cb314-91c5-11eb-bc03-5c592a83ea00Executive Cyber LeadersReports To: executive cyber leadershipCyber incidents are quickly and effectively addressed_c27cb47c-91c5-11eb-bc03-5c592a83ea00To investigate, analyze, and respond to cyber incidents within a network environment or enclave._c27cb526-91c5-11eb-bc03-5c592a83ea00AbilitiesDemonstrate the following abilities_c27cb5bc-91c5-11eb-bc03-5c592a83ea001Role Abilities ~ These are the required abilities associated with the performance of this role.ResponsesDesign incident response for cloud service models._c27cb648-91c5-11eb-bc03-5c592a83ea001.1[bloom level 3]_07a50144-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_1[To be determined]DetectionApply techniques for detecting host and network-based intrusions using intrusion detection technologies._c27cb6de-91c5-11eb-bc03-5c592a83ea001.2[bloom level 3]_07a50266-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_2[To be determined]KnowledgeDemonstrate the following knowledge_c27cb76a-91c5-11eb-bc03-5c592a83ea002Role Knowledge ~ This is the required knowledge associated with the performance of this role.NetworksComprehend computer networking concepts and protocols, and network security methodologies._c27cb800-91c5-11eb-bc03-5c592a83ea002.1[bloom level 3]_07a503f6-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_3[To be determined]RiskComprehend risk management processes (e.g., methods for assessing and mitigating risk)._c27cb88c-91c5-11eb-bc03-5c592a83ea002.2[bloom level 3]_07a504d2-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_4[To be determined]Laws, Regulations, Policies & EthicsComprehend laws, regulations, policies, and ethics as they relate to Cybersecurity and privacy._c27cb922-91c5-11eb-bc03-5c592a83ea002.3[bloom level 3]_07a505a4-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_5[To be determined]Cybersecurity & PrivacyComprehend cybersecurity and privacy principles._c27cb9b8-91c5-11eb-bc03-5c592a83ea002.4[bloom level 3]_07a50676-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_6[To be determined]Rhreats & VulnerabilitiesComprehend cyber threats and vulnerabilities._c27cba4e-91c5-11eb-bc03-5c592a83ea002.5[bloom level 3]_07a5073e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_7[To be determined]Operational ImpactsComprehend specific operational impacts of cybersecurity lapses._c27cbae4-91c5-11eb-bc03-5c592a83ea002.6[bloom level 3]_07a5081a-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_8[To be determined]Backup & RecoveryComprehend data backup and recovery._c27cbb84-91c5-11eb-bc03-5c592a83ea002.7[bloom level 3]_07a508f6-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_9[To be determined]ContinuityComprehend business continuity and disaster recovery continuity of operations plans._c27cbc1a-91c5-11eb-bc03-5c592a83ea002.8[bloom level 3]_07a509d2-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_10[To be determined]AccessComprehend host/network access control mechanisms (e.g., access control list, capabilities lists)._c27cbcba-91c5-11eb-bc03-5c592a83ea002.9[bloom level 3]_07a50ab8-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_11[To be determined]InteractionsComprehend network services and protocols interactions that provide network communications._c27cbd50-91c5-11eb-bc03-5c592a83ea002.10[bloom level 3]_07a50b9e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_12[To be determined]Incidents & ResponsesComprehend incident categories, incident responses, and timelines for responses._c27cbdf0-91c5-11eb-bc03-5c592a83ea002.11[bloom level 3]_07a50c8e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_13[To be determined]Incident MethodologiesComprehend incident response and handling methodologies._c27cbe90-91c5-11eb-bc03-5c592a83ea002.12[bloom level 3]_07a50d88-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_14[To be determined]Detection MethodologiesComprehend intrusion detection methodologies and techniques for detecting host and network-based intrusions._c27cbf30-91c5-11eb-bc03-5c592a83ea002.13[bloom level 3]_07a50e78-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_15[To be determined]Traffic AnalysisComprehend network traffic analysis methods._c27cbfda-91c5-11eb-bc03-5c592a83ea002.14[bloom level 3]_07a50f7c-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_16[To be determined]PacketsComprehend packet-level analysis._c27cc0d4-91c5-11eb-bc03-5c592a83ea002.15[bloom level 3]_07a51080-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_17[To be determined]Systems & ApplicationsComprehend system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code)._c27cc17e-91c5-11eb-bc03-5c592a83ea002.16[bloom level 3]_07a51184-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_18[To be determined]AttacksComprehend what constitutes a network attack and a network attack’s relationship to both threats and vulnerabilities._c27cc21e-91c5-11eb-bc03-5c592a83ea002.17[bloom level 3]_07a51292-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_19[To be determined]DefenseComprehend cyber defense and information security policies, procedures, and regulations._c27cc2d2-91c5-11eb-bc03-5c592a83ea002.18[bloom level 3]_07a513a0-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_20[To be determined]Attack ClassesComprehend different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks)._c27cc37c-91c5-11eb-bc03-5c592a83ea002.19[bloom level 3]_07a514b8-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_21[To be determined]AttackersComprehend cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored)._c27cc426-91c5-11eb-bc03-5c592a83ea002.20[bloom level 3]_07a515d0-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_22[To be determined]Administration & HardeningComprehend system administration, network, and operating system hardening techniques._c27cc4da-91c5-11eb-bc03-5c592a83ea002.21[bloom level 3]_07a517e2-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_23[To be determined]Attack StagesComprehend cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks)._c27cc58e-91c5-11eb-bc03-5c592a83ea002.22[bloom level 3]_07a51918-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_24[To be determined]Security ArchitectureComprehend network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth)._c27cc642-91c5-11eb-bc03-5c592a83ea002.23[bloom level 3]_07a51a4e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_25[To be determined]OSI & ProtocolsComprehend OSI model and underlying network protocols (e.g., TCP/IP)._c27cc700-91c5-11eb-bc03-5c592a83ea002.24[bloom level 3]_07a51b7a-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_26[To be determined]CloudComprehend cloud service models and how those models can limit incident response._c27cc7b4-91c5-11eb-bc03-5c592a83ea002.25[bloom level 3]_07a51cb0-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_27[To be determined]MalwareComprehend malware analysis concepts and methodologies. [bloom level 3]_c27cc872-91c5-11eb-bc03-5c592a83ea002.26_07a51f9e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_28[To be determined]Information ClassificationComprehend an organization's information classification program and procedures for information compromise._c27cc930-91c5-11eb-bc03-5c592a83ea002.27[bloom level 3]_07a520e8-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_29[To be determined]Network ProtocolsComprehend network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services._c27cc9ee-91c5-11eb-bc03-5c592a83ea002.28[bloom level 3]_07a5226e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_30[To be determined]Application RisksComprehend Application Security Risks (e.g. Open Web Application Security Project Top 10 list) [bloom level 3] program and procedures for information compromise._c27ccaa2-91c5-11eb-bc03-5c592a83ea002.29[bloom level 3]_07a523e0-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_31[To be determined]SkillsDemonstrate the following skills_c27ccb6a-91c5-11eb-bc03-5c592a83ea003Role Skills ~ These are the required skills associated with the performance of this role.MalwareIdentify, capture, contain, and report malware._c27ccc28-91c5-11eb-bc03-5c592a83ea003.1[bloom level 3]_07a5253e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_32[To be determined]EvidencePreserve evidence integrity according to standard operating procedures or national standards._c27cccf0-91c5-11eb-bc03-5c592a83ea003.2[bloom level 3]_07a52692-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_33[To be determined]CommunicationsSecure network communications._c27ccdb8-91c5-11eb-bc03-5c592a83ea003.3[bloom level 3]_07a527e6-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_34[To be determined]Vulnerabilities & AttacksRecognize and categorize types of vulnerabilities and associated attacks._c27cce80-91c5-11eb-bc03-5c592a83ea003.4[bloom level 3]_07a52944-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_35[To be determined]ProtectionSkill in protecting a network against malware. (e.g., NIPS, anti-malware, restrict/prevent external devices, spam filters)._c27ccf48-91c5-11eb-bc03-5c592a83ea003.5[bloom level 3]_07a52b6a-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_36[To be determined]DamagePerform damage assessments._c27cd01a-91c5-11eb-bc03-5c592a83ea003.6[bloom level 3]_07a52cdc-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_37[To be determined]EventsUse security event correlation tools._c27cd0e2-91c5-11eb-bc03-5c592a83ea003.7[bloom level 3]_07a52e4e-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_38[To be determined]ResponsesDesign incident response for cloud service models._c27cd1aa-91c5-11eb-bc03-5c592a83ea003.8[bloom level 3]_07a52fc0-91c6-11eb-96ab-e2642a83ea00PLACEHOLDER_39[To be determined]_07a53132-91c6-11eb-96ab-e2642a83ea002021-05-12https://stratml.us/carmel/iso/part2/CDIRwStyle.xml_07a532a4-91c6-11eb-96ab-e2642a83ea00OwenAmburOwen.Ambur@verizon.net