English
Menu

Cyber Attacks and Defense in Practice

For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?

  1. AMTTD 4 hours, MTTC 12 hours
  2. BMTTD 8 hours, MTTC 4 hours
  3. CMTTD 12 hours, MTTC 4 hours
Show answer and explanation

Answer: C. MTTD 12 hours, MTTC 4 hours

MTTD is the mean of the times from occurrence to detection, so it is (10 + 30 + 2 + 6) ÷ 4 = 48 ÷ 4 = 12 hours. MTTC is the mean of the times from detection to containment, (4 + 2 + 6 + 4) ÷ 4 = 16 ÷ 4 = 4 hours. In this example the late detection of incident 2 pulls the mean up considerably, and the gap from the median time to detection (8 hours) shows that a few incidents took a long time to detect. The longer the time to detection, the longer attackers can operate inside, so shortening MTTD through log monitoring and EDR is important for limiting damage.

  • A. This combination swaps MTTD and MTTC.
  • B. This is the median time to detection ((6 + 10) ÷ 2 = 8 hours), not the mean.
  • C. Correct. 48 ÷ 4 = 12 hours and 16 ÷ 4 = 4 hours.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. For ransomware damage, the loss per incident (SLE) is estimated at 40 million yen and the annual number of occurrences (ARO) at 0.5. Control A costs 6 million yen a year and reduces occurrences to 0.2 per year. Control B costs 3 million yen a year and does not change the number of occurrences but speeds up recovery, reducing the loss per incident to 24 million yen. With the annualized loss expectancy ALE = SLE × ARO and ROSI = (reduction in ALE − annual cost of the control) ÷ annual cost of the control, which of the following correctly gives the control with the larger ROSI and its value?
  2. An IDS examines 1 million connections a day, of which 100 are actual attacks. The IDS detects 99% of attacks and wrongly judges 0.1% of non-attack connections to be attacks. Which of the following is closest to the proportion of the alerts raised by the IDS that are actual attacks?
  3. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?
  4. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?
  5. MITRE ATT&CK is a knowledge base that organizes the methods observed in real attacks into "tactics", which represent the attacker's goals, and "techniques", which represent the concrete methods for achieving those goals. Which of the following correctly pairs an observed action with the tactic it falls under?

Comparisons in this topic