CompTIA CySA+ (CS0-003)Reporting and CommunicationEasy
A security analyst is reviewing logs after a suspected insider threat incident. The analyst observes the following log entries: ``` 2023-10-26 10:15:22 host1 user_A logged in from 192.168.1.50 2023-10-26 10:16:01 host1 user_A accessed /financial_reports/Q4_2023_forecast.xlsx 2023-10-26 10:16:35 host1 user_A copied /financial_reports/Q4_2023_forecast.xlsx to /mnt/usb_drive 2023-10-26 10:17:10 host1 user_A logged out ``` Which of the following metrics would BEST describe the time elapsed from the initial access of the sensitive file to its exfiltration?
- AMean Time To Exfiltrate (MTTE)
- BMean Time To Contain (MTTC)
- CMean Time To Detect (MTTD)
- DMean Time To Recover (MTTR)
Show answer & explanationAnswer & explanation
Correct answer: A. Mean Time To Exfiltrate (MTTE)
The question asks for a metric that describes the time from initial access of a sensitive file to its exfiltration. Mean Time To Exfiltrate (MTTE) directly measures this specific duration, reflecting the speed at which data is moved off the system after being accessed.
Why the other options are wrong
- B. MTTC measures the time from detection to containing the incident, which is also not the specific metric requested.
- C. MTTD measures the time from the start of an incident to its detection, which is not what the question is asking for.
- D. MTTR measures the time to restore services after an incident, which is unrelated to the time from access to exfiltration.
Mean Time To Exfiltrate (MTTE)
MTTE measures the average time it takes for an attacker, or insider, to exfiltrate sensitive data after gaining initial access to it.
- Focuses on data movement off the network.
- Critical for assessing data loss prevention effectiveness.
- Calculated from initial data access to confirmed exfiltration.
Memory trick: Many Times The Exfiltration timer starts when data is touched.