Cyber Awareness Challenge 2023 Flashcards

Spillage

• Spillage occurs when classified data is unintentionally transferred or disclosed to a lower classification system without authorization.
• Change the subject if asked about classified projects; neither confirm nor deny the information's authenticity.
• To prevent spillage, label files and removable media with appropriate classification markings.
• If you receive a classified attachment on an unclassified system, contact your security point of contact immediately.
• Report any suspected spillage to your security point of contact right away.
• Practices to prevent spillage include being aware of classification markings and handling caveats.

Classified Data

• Classified data must be stored in GSA-approved vaults or containers when not in use.
• Accessing classified information requires appropriate clearance, a signed non-disclosure agreement, and a need-to-know basis.
• The classification level "Secret" indicates information could cause serious damage to national security if disclosed.
• Classified materials must be properly labeled and marked for protection.
• Unauthorized disclosure of "Confidential" information could cause damage to national security, while "Top Secret" may cause exceptionally grave damage.

Insider Threat

• Insider threats leverage their trust and authorized access to sensitive information for malicious purposes.
• Potential indicators of insider threats include unusual interest in classified information, hostility towards U.S. policies, or obtaining classified information unauthorizedly.
• Behaviors such as persistent questioning about classified projects and removed sensitive information without permission are red flags.
• Insider Threat Programs aim to identify potential threats and develop comprehensive responses.

Social Networking

• Post vacation details only after returning home to avoid unwanted attention.
• Be cautious about granting permissions to game applications that access personal information.
• Security risks include exposing personal details like your birthday or mother's maiden name publicly.
• Best practices involve understanding privacy settings and validating friend requests.

Controlled Unclassified Information (CUI)

• CUI must be handled with safeguarding and dissemination controls to protect sensitive information.
• CUI is not considered classified, and storing it requires adhering to organizational protocols.
• Unauthorized storage of CUI on unapproved systems is against best practices.
• Protect Personally Identifiable Information (PII) by using government-approved equipment.

Physical Security

• Physically challenge individuals without appropriate badges within secure areas to maintain security integrity.
• Report suspicious activities to ensure rapid response to potential threats.
• Understand Cyberspace Protection Conditions (CPCON), which prioritize critical functions during heightened alert levels.

Identity Management

• Use two-factor authentication, which combines possession (e.g., a CAC) and knowledge (e.g., PIN) for robust security.
• Avoid common passwords across various accounts to diminish the risk of identity theft.### Identity Management
• Common Access Card (CAC) should be maintained at all times for protection.
• Writing down passwords on easily accessible devices, like smartphones, is not a best practice for maintaining identity authenticity.
• Two-factor authentication includes combining a password with a received code, enhancing security measures.
• DoD Public Key Infrastructure (PKI) tokens should only be used within systems for specific PKI-required tasks.
• The CAC includes certificates for identification, encryption, and digital signature, playing a crucial role in identity management.
• A strong password example is eA1xy2!P, showcasing complexity and security.
• Among various password examples, %2ZN=Ugq is the strongest due to its mix of characters and symbols.
• A valid example of two-factor authentication is a Common Access Card (CAC) and Personal Identification Number (PIN), providing an added layer of security.

Sensitive Compartmented Information (SCI)

• Sensitive Compartmented Information (SCI) segregates classified information into compartments for better protection and distribution control.
• A compromise occurs when unauthorized individuals gain access to SCI in any manner, breaching security protocols.
• All documents in a Sensitive Compartmented Information Facility (SCIF) must be appropriately marked, except for unclassified documents.
• Security Classification Guides (SCG) must be approved and signed by a recognized Original Classification Authority (OCA).
• The dissemination of intelligence sources and methods must adhere to directives from the Director of National Intelligence.
• Security badges must be visible at all times within SCIF facilities for identification purposes.
• Printed classified documents should be retrieved promptly to prevent unauthorized access.
• When discussing SCI, ensure all participants are cleared and have a need-to-know.
• Faxing SCI requires proper marking and the use of an approved SCI fax machine to maintain security integrity.
• If SCI is compromised, take actions such as evaluating the breach causes and reporting to security contacts.

Removable Media in a SCIF

• Users of removable media like CDs must ensure they are labeled with maximum classification, creation date, point of contact, and Change Management Control Number.
• Only government-owned Portable Electronic Devices (PEDs) expressly authorized by an agency are permitted in SCIFs.
• When using removable media inside SCIFs, it must be identified and disclosed to local authorities for Configuration/Change Management Control.
• Potential consequences of unsafe usage of removable media in SCIFs include loss of mission, loss of life, and compromise of sensitive information, while damage to the media itself is not a serious consequence.