Cyber Security Fundamentals Quiz
31 Questions
1 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What does the CIA Triangle stand for in cyber security?

  • Control, Integrity, Access
  • Confidentiality, Integrity, Availability (correct)
  • Communication, Integrity, Availability
  • Confidentiality, Identity, Access

    • Cyber security only involves protecting digital systems and does not include human beings.

    False

    Name one type of security threat that involves unauthorized access to information.

    Disclosure

    Keeping data secret is referred to as __________ in the CIA Triangle.

    <p>Confidentiality</p> Signup and view all the answers

    Match the following security threats with their descriptions:

    <p>Disclosure = Unauthorized access to information Deception = Acceptance of false information Disruption = Break in the availability of a system Usurpation = Unauthorized control of a system</p> Signup and view all the answers

    What is the primary purpose of a security policy?

    <p>To outline goals and mechanisms for maintaining security</p> Signup and view all the answers

    Role-Based Access Control (RBAC) assigns permissions based only on job roles.

    <p>True</p> Signup and view all the answers

    What are the three components of the Identification, Authentication, and Authorisation process?

    <p>Identification, Authentication, and Authorisation</p> Signup and view all the answers

    In access control, the term 'DAC' stands for ______.

    <p>Discretionary Access Control</p> Signup and view all the answers

    Which type of access control is typically found in high-security systems?

    <p>Mandatory Access Control</p> Signup and view all the answers

    Match the type of access control with its description:

    <p>Discretionary Access Control = Access decisions made by the resource owner Role-Based Access Control = Permissions assigned based on job role Mandatory Access Control = Access determined by security labels Authentication = Process of verifying user identity</p> Signup and view all the answers

    Authentication creep occurs when old privileges are not revoked after an employee changes departments.

    <p>True</p> Signup and view all the answers

    What is one of the main purposes of digital signatures?

    <p>To ensure the integrity of the document</p> Signup and view all the answers

    Identification is not necessary in the process of authentication.

    <p>False</p> Signup and view all the answers

    What are the three types of authentication?

    <p>What you know, What you are, What you have</p> Signup and view all the answers

    A ___ key is used in encryption to secure the digital signature.

    <p>private</p> Signup and view all the answers

    How does requiring two modes of authentication impact safety?

    <p>It reduces the chances of unauthorized access.</p> Signup and view all the answers

    Match the following terms with their definitions:

    <p>Digital Signature = Ensures integrity and authenticity of documents Identification = Associates actions with specific individuals One-way Hash = Transforms input into a fixed-length string Authentication = Verifies the user's identity</p> Signup and view all the answers

    A digital signature guarantees the signer can deny the validity of the document.

    <p>False</p> Signup and view all the answers

    What is the role of a public key in the context of digital signatures?

    <p>It is used for validation and decryption of the signature.</p> Signup and view all the answers

    The authentication process checks the user's details against a user ___ database.

    <p>authentication</p> Signup and view all the answers

    Match the types of authentication with their examples:

    <p>What you know = Password What you are = Fingerprint What you have = Security token</p> Signup and view all the answers

    What does 2 Factor Authentication (2FA) typically involve?

    <p>Entering a password and receiving a one-time password (OTP)</p> Signup and view all the answers

    Asymmetric encryption uses the same key for both encryption and decryption.

    <p>False</p> Signup and view all the answers

    What is the primary purpose of cryptography?

    <p>To encode messages so they can only be understood by the intended recipient.</p> Signup and view all the answers

    A ______________ is a malicious piece of code that can replicate itself.

    <p>virus</p> Signup and view all the answers

    Match the types of malware with their descriptions:

    <p>Virus = A malicious code that replicates itself Worm = A self-spreading virus Trojan Horse = Malware disguised as useful software Ransomware = Blocks access until ransom is paid</p> Signup and view all the answers

    Which of the following is NOT a type of malware?

    <p>Firewall</p> Signup and view all the answers

    Malware can be used for non-destructive purposes, such as adware.

    <p>True</p> Signup and view all the answers

    What is a key requirement for encryption?

    <p>A plain text, a key, and an encryption function.</p> Signup and view all the answers

    __________ is designed to block access to a system until a ransom is paid.

    <p>Ransomware</p> Signup and view all the answers

    Study Notes

    Lecture 10: Security Principles

    • Cyber security is more than just protecting digital systems; it also encompasses human beings and physical protection.
    • The CIA Triangle (Confidentiality, Integrity, Availability) is a fundamental concept in data security, illustrating three key aspects:
      • Confidentiality: Keeping data secret, preventing sensitive information from being leaked. Examples include email addresses and sensitive data.
      • Integrity: Ensuring data remains unaltered or unchanged, preventing hacks and modifications. Examples include preventing alterations to personal information or hacks altering data in systems.
      • Availability: Ensuring data is accessible when needed, and preventing ransomware attacks, for example.
    • Security threats include:
      • Disclosure: Unauthorized access to information.
      • Deception: Acceptance of false information.
      • Disruption: A break in the availability or regular function of a system.
      • Usurpation: Unauthorized control of a system.
    • Security principles rely on risk evaluation, selecting risks worth preventing, and conducting a security trade-off analysis, balancing the cost of security measures against the time and effort required to breach defenses.
    • Good security considers people, processes, and technology, along with well-defined policies.
    • Four areas of security are:
      • Preventative: Stopping problems from happening.
      • Detective: Identifying and understanding why issues occurred.
      • Reactive: Responding to problems as they happen.
      • Reconstructive: Recovering from issues.
    • Security policies outline organizational security goals and mechanisms, often implemented as multiple policies.
    • Access control restricts resources to authorized users. This includes different control models (like hierarchical and compartmentalized access models) and functions that dictate access according to role or function.
      • Hierarchical access control involves levels of security clearance (e.g., official, secret, top secret).
      • Compartmentalized access control restricts access based on roles and functions, ensuring only necessary individuals have access.
    • Identification, authentication, and authorization are essential security components. Knowing who you are (identification), confirming you are who you claim to be (authentication), and granting access accordingly (authorization) are vital.
      • Authentication encompasses methods like passwords, touch ID, or other multi-factor auth.
      • Authorization is controlling access based on established roles.
    • Types of Authentication:
      • What you know (passwords)
      • What you have (physical tokens)
      • What you are (biometrics)
    • A 2-factor authentication (2FA) is a method that improves security by requiring two forms of authentication.
    • Cryptography is the art of encoding messages for intended recipients, protecting confidentiality, and ensuring data integrity. This has existed for centuries and has become more complex with advancements in computing.
      • Symmetric cryptography and asymmetric cryptography (using public and private keys) are two common types of cryptography.
    • Encryption issues arise from difficulty of implementing, resource intensiveness, and the influence of random number generator quality. There are also political and privacy issues associated with encryption.
    • Attacks against systems include Malware, Traditional DoS (Denial of Service) and DDoS(Distributed DoS), Man-in-the-Middle (MitM), and Web-based.
    • Types of malware include:
      • Viruses
      • Worms
      • Trojan Horses
      • Rootkits
      • Ransomware
    • Malware propagation (spreading) occurs through various methods, including self-replication (worms) and human intervention.
    • Denial-of-service (DoS) attacks are designed to flood a system with requests, overwhelming it and stopping legitimate traffic.
    • MitM attacks intercept legitimate transactions, enabling malicious actors to read or alter them.
    • Poorly coded websites are susceptible to web-based attacks like SQL injection and cross-site scripting (XSS).
    • Physical security protects hardware from theft, damage, and natural disasters (e.g., fire, power failure, earthquakes, floods). Physical security risks include Sabotage and theft.
    • IoT (Internet of Things) devices are embedded computing devices connected via the internet to gather and send data.
    • IoT security difficulties, including unique hardware architectures, insufficient update procedures, various access methods, and third-party integrations, often leads to security conflicts and the collection of unnecessary data.
    • Security and IoT are examined at the device, gateway, and cloud layers, with separate Data and System Security concerns.
    • End-to-end security of IoT devices ensures secure data transfer using encryption, and ideally only decrypts data at the end-user level.
    • Building systems can be wholly customized or implemented utilizing prebuilt and configurable systems using different approaches and methods to develop systems suitable for their needs.

    Part 2: Building Systems

    • Building a system in systems development doesn't always mean creating a new system from scratch.
    • Alternatives include custom-built, off-the-shelf (OTS) solutions (free/commercial), and customization of existing systems.
    • Custom-built software:
      • Pros: Complete control, perfect fit, IP ownership, and resale opportunities.
      • Cons: Specialist knowledge required, costly development, non-standard and difficult maintenance.
    • Off-the-shelf (OTS) software:
      • Pros: Existing, quick installation, no development costs, more mature software, usually cheaper, and no specialist required knowledge.
      • Cons: Finding a precise solution, no IP ownership, ongoing licensing costs, adding new requirements difficult, and may not be a perfect fit.
    • Systems can be built from various approaches – a scale from fully custom to entirely off-the-shelf.
    • Customisation of existing systems (light to heavy, typical with open-source software).
    • Outsourcing involves contracting out a portion of a company's internal activity (e.g., software development) to another company. Strategies include Staff Augmentation, Co-sourcing, Managed Services, and Total Outsourcing.
    • Total Outsourcing has best use when little or no involvement is desired in the developed system.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Related Documents

    SDLecture10-SecurityPrinciples 2024 PDF

    Description

    Test your knowledge of the CIA Triangle and key concepts in cyber security. This quiz covers topics such as security threats, access control models, and the importance of security policies. Demonstrate your understanding of how to protect digital systems effectively.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser