CyberSecurity Basics Quiz

Malware and Attacks

• A type of malware that downloads onto a computer disguised as a legitimate program is called a Trojan.
• A brute-force attack is a type of attack where an attacker submits many passwords or passphrases with the hope of eventually guessing correctly.

CIA Triad

• The principle of integrity is about ensuring data is not modified without authorization.
• The principle of availability is about ensuring data is accessible and usable when needed.
• The principle of confidentiality is about ensuring data is only accessible to authorized individuals.

Cybersecurity Concepts

• A logic bomb is a malicious piece of code that is waiting for certain conditions to be met before activating.
• Hash functions can be used to check the integrity of a file.
• The second step of the Cyber Kill chain is Weaponization.
• HTTPS provides encryption and security features, while HTTP does not.

Hash Functions

• A good hash function should not be reversible.

Authorization and Access Control

• Mandatory Access Control (MAC) is an authorization method that uses security levels and compartments.
• Discretionary Access Control (DAC) allows the owner of a file to grant other users access to it using an access control list.
• Separation of duties is a security practice that involves splitting critical tasks between two or more people.

Security Models and Frameworks

• The Bell-LaPadula security model is implemented to enforce confidentiality.
• The BIBA security model does not allow read downs.
• The PCI DSS security framework is used to guide actions related to securing systems used to process credit card information.

Data and Information

• Personally identifiable information (PII) is information maintained about an individual that can be used to distinguish or trace their identity.
• Data in use is data stored in RAM.
• PHI (Protected Health Information) is a type of information that includes prescriptions and X-rays.

Cryptography

• Asymmetric encryption systems use two keys, one for encryption and one for decryption.
• Symmetric cryptosystems use one key for encryption and decryption.
• If User A wants to send User B a message that is encrypted for confidentiality, using asymmetric encryption, User A would use User B's public key to encrypt the message.

Security Documents and Practices

• A security policy gives a general description of assets that need securing and states security goals of an organization.
• Security frameworks, such as NIST Cybersecurity Framework or ISO 27001, provide practical guidance and a list of best practices on how an organization can protect their systems and data from cyber threats.
• A baseline document provides configuration information regarding the minimum level of security that every system in an organization must meet.

Risk Analysis

• The annualized rate of occurrence for a tornado at a data center is 0.005.
• The annualized loss expectancy for a tornado at a data center is $25,000.

Test your knowledge of cybersecurity concepts, including malware, attacks, and security principles. Covers topics such as Trojan malware, brute-force attacks, and CIA triad principles.