S3
61 Questions
0 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to Lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

Which of the following is NOT a practice related to Authorization and Authentication?

  • Least Privilege
  • Whitelisting
  • Need to Know
  • Firewall (correct)

What is the primary difference between Need to Know and Least Privilege principles?

  • Need to Know applies to data, while Least Privilege applies to access to a system. (correct)
  • Need to Know is a more restrictive principle than Least Privilege.
  • Need to Know is used during the provisioning stage, while Least Privilege is implemented after the user has been provisioned.
  • Need to Know is used for physical security, while Least Privilege is used for logical security.

What is the primary goal of Whitelisting?

  • Identifying and removing malicious software from a system.
  • Creating a list of trusted users who are allowed to access a system.
  • Allowing only approved applications to run on a system. (correct)
  • Blocking unauthorized users from accessing a system.

Which of the following authentication technologies is considered a form of multi-factor authentication?

<p>Biometrics (A)</p> Signup and view all the answers

What is the main purpose of Context Aware Authentication?

<p>Using user location and other data points to validate user identity. (B)</p> Signup and view all the answers

What is the main purpose of a digital signature?

<p>To ensure the integrity of a message by verifying the sender's identity. (B)</p> Signup and view all the answers

Which of the following is NOT a component of the NIST Cybersecurity Framework?

<p>Maintain (B)</p> Signup and view all the answers

What is the primary purpose of the Common Vulnerabilities and Exposures (CVE) Dictionary?

<p>To provide a standardized way of identifying and reporting cybersecurity vulnerabilities. (B)</p> Signup and view all the answers

Which of the following is NOT a type of security control?

<p>Directive (C)</p> Signup and view all the answers

What is the main difference between Discretionary Access Control and Mandatory Access Control?

<p>Discretionary Access Control is more flexible than Mandatory Access Control. (D)</p> Signup and view all the answers

Which access control method allows administrators to set permissions based on specific criteria defined by rules?

<p>Rule-Based Access Control (D)</p> Signup and view all the answers

Which of the following is a network security tool used to identify suspicious activity and alert administrators?

<p>Intrusion Detection System (B)</p> Signup and view all the answers

Which of the following is NOT a corrective control?

<p>Security Audits (C)</p> Signup and view all the answers

What is the concept of 'Defense in Depth' in cybersecurity?

<p>Using multiple layers of security to protect systems and data. (C)</p> Signup and view all the answers

Which of the following is NOT a recommended practice for password management, as per NIST SP800-63B?

<p>Passwords should be based on personal information like names or birthdays. (D)</p> Signup and view all the answers

What is the purpose of the 'Protect' function within the NIST Cybersecurity Framework?

<p>Developing and implementing safeguards to prevent vulnerabilities from being exploited. (A)</p> Signup and view all the answers

Which of the following is an example of a preventative control?

<p>Encryption (C)</p> Signup and view all the answers

What is the most critical component of an incident response plan?

<p>Human capital (D)</p> Signup and view all the answers

Which model of incident response teams is best suited for geographically widespread organizations?

<p>Distributed Incident Response Team (A)</p> Signup and view all the answers

During which phase of the General Incident Response Plan does the organization ensure no further damage occurs?

<p>Containment (D)</p> Signup and view all the answers

What type of event is defined as any intentional or unintentional event with negative consequences on systems?

<p>Adverse Event (B)</p> Signup and view all the answers

Which of the following is NOT a testing method for incident response plans?

<p>User Training Sessions (C)</p> Signup and view all the answers

What does the Mean Time to Repair metric measure in incident response?

<p>Time taken to actually fix the problem (D)</p> Signup and view all the answers

Which organization is known for creating various recovery frameworks besides NIST?

<p>ISO (A)</p> Signup and view all the answers

Which of the following losses would be covered by a cyber insurance policy?

<p>Cyber extortion losses (A)</p> Signup and view all the answers

Which of the following is NOT considered a threat agent in cybersecurity?

<p>Algorithmians (B)</p> Signup and view all the answers

What is the main purpose of a Denial of Service (DoS) attack?

<p>To disrupt network operations by flooding the system (C)</p> Signup and view all the answers

Which of the following attacks involves injecting malicious SQL code to manipulate a database?

<p>SQL Injection (B)</p> Signup and view all the answers

How does a Reverse Shell attack initiate communication?

<p>By sending a malicious email that bypasses the firewall (A)</p> Signup and view all the answers

Which of the following is a characteristic of a brute-force attack?

<p>Systematic testing of all possible passwords (D)</p> Signup and view all the answers

What type of malware installs a copy on a computer's memory and can remain active even after a reboot?

<p>Resident Virus (B)</p> Signup and view all the answers

Which attack uses methods not originally intended for data transmission to communicate?

<p>Covert Channels (A)</p> Signup and view all the answers

What is the main goal of a Social Engineering attack?

<p>To manipulate individuals into divulging confidential information (B)</p> Signup and view all the answers

Which type of attack aims to manipulate application behavior by forcing operations to execute out of order?

<p>Race Condition (B)</p> Signup and view all the answers

Which of the following is an example of spoofing in cybersecurity?

<p>Creating a fake email address to impersonate an organization (B)</p> Signup and view all the answers

Which of the following correctly describes the primary goal of Data Loss Prevention (DLP)?

<p>To detect and prevent attempts to transfer sensitive info out of the organization electronically. (D)</p> Signup and view all the answers

What is the main difference between privacy and confidentiality?

<p>Privacy gives individuals control over personal data while confidentiality protects unauthorized access to that data. (B)</p> Signup and view all the answers

In which way does obfuscation protect sensitive information?

<p>By replacing sensitive data with less valuable data. (A)</p> Signup and view all the answers

What type of encryption uses both a public key for encryption and a private key for decryption?

<p>Asymmetric encryption (C)</p> Signup and view all the answers

What is the purpose of conducting a walk-through in a security context?

<p>To evaluate program logic and simulate disaster scenarios. (C)</p> Signup and view all the answers

Which of the following is NOT a part of a Security Assessment Report (SAR)?

<p>Detailed cost analysis (D)</p> Signup and view all the answers

What does the 're-click rate' measure in phishing simulations?

<p>Percentage of employees who click on multiple phishing emails. (C)</p> Signup and view all the answers

Which type of Data Loss Prevention (DLP) system focuses on endpoint devices?

<p>Endpoint-Based DLP (B)</p> Signup and view all the answers

Which encryption method is often considered the highest form of data protection?

<p>Encryption in general (B)</p> Signup and view all the answers

Which of the following best describes the role of a Security Program Champion?

<p>A team member who champions security efforts across departments. (C)</p> Signup and view all the answers

What is the name of the security protocol that encrypts wireless internet connections between routers, switches, and mobile devices?

<p>WiFi Protected Access (WPA) (B)</p> Signup and view all the answers

Which of the following is NOT a commonly used methodology for threat modeling?

<p>NIST (B)</p> Signup and view all the answers

What is the primary goal of 'system hardening' in cybersecurity?

<p>Reducing the number of access points attackers can exploit (D)</p> Signup and view all the answers

Which of the following cyberattacks targets specific employees within an organization?

<p>Spear phishing (A)</p> Signup and view all the answers

Which of the following is NOT a risk related to cloud computing?

<p>Device mismanagement (B)</p> Signup and view all the answers

What is the primary purpose of a Bring Your Own Device (BYOD) policy?

<p>To allow employees to access company data from their personal devices (A)</p> Signup and view all the answers

Which of the following is a type of social engineering attack that uses a phone call to deceive a victim?

<p>Vishing (D)</p> Signup and view all the answers

What is the purpose of 'Network Segmentation' in cybersecurity?

<p>To isolate different parts of the network from each other (B)</p> Signup and view all the answers

Which of the following is NOT a key component of the COSO Internal Control Framework?

<p>Threat Modeling (C)</p> Signup and view all the answers

Which of the following is a common example of "Device Spoofing" in the context of IoT (Internet of Things) security?

<p>Using a fake IoT device to gain access to a network (D)</p> Signup and view all the answers

What is the primary purpose of "Reconnaissance" in the stages of a cyberattack?

<p>Collecting information about the target (B)</p> Signup and view all the answers

What is the main focus of the "STRIDE" threat modeling methodology?

<p>Identifying potential threats and vulnerabilities (A)</p> Signup and view all the answers

Which of the following is NOT a characteristic of a "Watering Hole Attack"?

<p>Adding malicious code to prepackaged software (D)</p> Signup and view all the answers

What is the main difference between "Phishing" and "Spear Phishing"?

<p>Phishing attacks are less sophisticated and less targeted than spear phishing attacks (A)</p> Signup and view all the answers

Which of the following is a core principle of "Database Hardening"?

<p>Assigning different privilege levels between admin users (C)</p> Signup and view all the answers

What is the primary aim of "Endpoint Hardening" in cybersecurity?

<p>Minimizing the attack surface on individual devices (A)</p> Signup and view all the answers

Flashcards

Hacker

An attacker who exploits system vulnerabilities for malicious purposes.

Adversary

A threat agent that is financially or politically motivated to gain unauthorized access to systems or data.

Denial of Service (DoS)

A type of attack that floods a network with overwhelming traffic, making it unable to respond to legitimate requests.

Man-in-the-Middle (MITM)

An attack where a malicious actor intercepts communication between two parties, impersonating one of them.

Signup and view all the flashcards

Return-Oriented Programming (ROP)

An attack that utilizes existing legitimate code within a system to perform unauthorized actions, often exploiting vulnerabilities.

Signup and view all the flashcards

SQL Injection

A type of attack where an attacker injects malicious SQL code into a website input form to access and manipulate sensitive data.

Signup and view all the flashcards

Cross-Site Scripting (XSS)

A cyberattack where an attacker injects malicious script code into a website to steal user data or hijack their browser.

Signup and view all the flashcards

Mobile Code

A type of malicious code that spreads from computer to computer, infecting applications and potentially causing damage.

Signup and view all the flashcards

Overwrite Virus

A type of mobile code that overwrites or deletes data on a victim's computer.

Signup and view all the flashcards

Multi-Partite Virus

A type of mobile code that uses multiple methods to spread and infect systems.

Signup and view all the flashcards

Worm

A type of malware that spreads to other computers without user interaction, often through email attachments or file-sharing networks.

Signup and view all the flashcards

Trojan Horse

A malicious program disguised as legitimate software, often used to steal personal information or gain access to a system.

Signup and view all the flashcards

Adware

Software designed to display unwanted advertisements on a user's computer.

Signup and view all the flashcards

Spyware

Software that secretly gathers information about a user's activities and transmits it to a third party.

Signup and view all the flashcards

Phishing

A type of social engineering attack that uses fake emails or websites to trick users into revealing sensitive information.

Signup and view all the flashcards

Spear Phishing

A type of phishing attack that targets specific individuals or organizations, using personalized emails or messages.

Signup and view all the flashcards

Business Email Compromise (BEC)

A type of phishing attack that targets high-level executives, attempting to acquire sensitive financial information or authorize fraudulent transactions.

Signup and view all the flashcards

Pharming

A technique that redirects users to fake websites, often to steal their login credentials.

Signup and view all the flashcards

Vishing

A social engineering attack that uses voice calls to deceive victims into revealing sensitive information.

Signup and view all the flashcards

Network Segmentation

The process of controlling network traffic so that it is separated from outside communications.

Signup and view all the flashcards

WiFi Protected Access (WPA)

A security protocol that encrypts wireless internet connections between routers, switches, and mobile devices.

Signup and view all the flashcards

System Hardening

A security measure that reduces risks by minimizing the number of access points a company can be attacked through.

Signup and view all the flashcards

Acceptable Use Policy

A control document that regulates and protects technology resources by assigning varying levels of responsibilities, listing acceptable behaviors, and specifying consequences.

Signup and view all the flashcards

Bring Your Own Device (BYOD) Policy

A policy that allows employees to bring their personal devices (e.g., smartphones, laptops) to work.

Signup and view all the flashcards

Virtual Private Network (VPN)

A secure communications method using encryption protocols to create a virtual private network.

Signup and view all the flashcards

Network Hardening

Securing a network by removing unused ports and blocking unnecessary protocols.

Signup and view all the flashcards

Server Hardening

Securing servers by physically isolating them in a secure facility.

Signup and view all the flashcards

MAC Filtering

Filtering network traffic based on Media Access Control (MAC) addresses, allowing only authorized devices. It uses a list of approved physical or hardware addresses.

Signup and view all the flashcards

Zero Trust

A security principle that assumes no user or device can be trusted by default, even if authenticated.

Signup and view all the flashcards

Least Privilege

Granting users only the minimum level of access required to perform their job, nothing more.

Signup and view all the flashcards

Need to Know

Only providing access to data that an individual requires to perform their job.

Signup and view all the flashcards

Whitelisting

A list of pre-approved applications that are allowed to run on a system. Any application not on the list is blocked.

Signup and view all the flashcards

Context Aware Authentication

Authentication that considers factors like location, time, and device used to access a system.

Signup and view all the flashcards

Digital Signatures

An electronic signature that binds a document to the sender's identity, proving authenticity.

Signup and view all the flashcards

Single Sign-On (SSO)

A single authentication process that allows users to access multiple resources or devices with one set of credentials.

Signup and view all the flashcards

Multi-Factor Authentication

Authentication requiring two or more factors to validate identity, such as a password and a fingerprint scan.

Signup and view all the flashcards

Personal Identification Number (PIN)

A numeric code used for authentication, often associated with a smart card.

Signup and view all the flashcards

Smart Cards

A physical card containing a microprocessor that can process data or execute activities.

Signup and view all the flashcards

Token

A device that generates passcodes for authentication, usually synchronized with time or using an algorithm.

Signup and view all the flashcards

Biometrics

Authentication that uses unique human characteristics, like facial recognition or fingerprints.

Signup and view all the flashcards

Security Assessment - Examination

A systematic process of examining, observing, and reviewing security assessment objectives. It involves scrutinizing documents, analyzing configurations, and assessing the effectiveness of security controls.

Signup and view all the flashcards

Security Assessment - Interviewing

A method used in security assessments to gather information through individual or group discussions with relevant personnel. It helps understand perspectives, practices, and potential risks.

Signup and view all the flashcards

Security Assessment - Testing

A way to determine how a system or device performs compared to its intended security posture. It involves simulating attacks, analyzing logs, and testing security controls against predefined scenarios.

Signup and view all the flashcards

Security Assessment Report (SAR)

A formal document produced after a security assessment, detailing the findings, recommendations, and action plans for addressing security gaps and deficiencies. It serves as evidence of compliance or non-compliance with security objectives.

Signup and view all the flashcards

Determination Statement (SAR)

A statement within a Security Assessment Report (SAR) that clearly conveys whether a particular security control or objective has been met or not. It indicates either 'satisfied' or 'other than satisfied'.

Signup and view all the flashcards

Incident Response Team (SAR)

A dedicated team responsible for responding to security incidents reported in a Security Assessment Report (SAR). They analyze the findings, take appropriate actions, and implement remediation plans.

Signup and view all the flashcards

Phishing Simulation

A simulation designed to educate employees on recognizing and avoiding phishing attacks. This technique involves sending emails that mimic real phishing attempts to gauge employee awareness levels.

Signup and view all the flashcards

Security Program Champions

Individuals within an organization who actively promote and champion security awareness initiatives. They act as ambassadors for security best practices, encouraging employee engagement and understanding.

Signup and view all the flashcards

Tokenization

The process of replacing sensitive data with non-sensitive surrogate values. This helps protect data without compromising functionality, ensuring that sensitive information is not exposed.

Signup and view all the flashcards

Encryption

A technique for protecting data by converting it into an unreadable format. This is a common method for securing data at rest and in transit, making it difficult for unauthorized access.

Signup and view all the flashcards

Incident Response Plan (IRP)

A set of procedures, people, and information used to detect, respond to, and limit the consequences of a cyberattack on an organization.

Signup and view all the flashcards

Incident Response Timeline

A chart that visually represents the timeline of an IRP, showing key events and actions, such as detection, containment, eradication, and recovery.

Signup and view all the flashcards

Tabletop Exercise

A planned event simulating a real-world cyberattack to test an organization's incident response procedures and capabilities.

Signup and view all the flashcards

IRP Metrics

A measurable factor used to evaluate the performance of an IRP, such as the time it takes to detect, contain, and repair a cyberattack.

Signup and view all the flashcards

Cyber Insurance

A type of insurance policy designed to cover financial losses resulting from a cyberattack, such as business interruption, ransom payments, and legal fees.

Signup and view all the flashcards

Containment

The process of identifying and isolating the source of a cyberattack to prevent its spread and further damage.

Signup and view all the flashcards

Eradication

The process of permanently removing the threat and restoring systems to their original state after a cyberattack.

Signup and view all the flashcards

Reporting

Communicating the details of a cyberattack and its resolution to relevant stakeholders, including management, security teams, and law enforcement.

Signup and view all the flashcards

Study Notes

Cybersecurity Threats and Attacks

  • Cybersecurity protects organizational IT infrastructure and data from malicious actors through technology, internal controls, and best practices.
  • Threat agents include attackers, hackers, adversaries (with incentives to hack), government/state-sponsored actors, hacktivists (for social/political causes), insiders, and external threats.

Types of Cyberattacks

  • Network-Based Attacks: Exploit network infrastructure to disrupt operations. Examples include:
    • Backdoors/trapdoors
    • Covert channels
    • Buffer overflows
    • Denial-of-service (DoS) attacks (including DDoS)
    • Man-in-the-middle (MITM) attacks
    • Port scanning
    • Ransomware
    • Reverse shell attacks
    • Replay attacks
    • Return-oriented programming (ROP) attacks
    • Spoofing (including ARS, DNS, and hyperlink spoofing)
  • Application-Based Attacks: Target applications. Examples include:
    • SQL injection
    • Cross-site scripting (XSS)
    • Race conditions
    • Mobile code attacks (overwrite, multi-partite, parasitic, polymorphic, resident viruses)
  • Host-Based Attacks: Focus on individual hosts (laptops, servers, mobile devices). Examples include:
    • Brute-force attacks
    • Keylogger attacks
    • Malware (viruses, worms, Trojans, adware, spyware)
    • Rogue mobile apps
  • Social Engineering Attacks: Manipulate individuals to gain access. Examples include:
    • Phishing (including spear phishing, business email compromise/whaling, and pharming)
    • Pretexting
    • Catfishing
    • Vishing
  • Physical Attacks (On-Premises): Target physical hardware. Examples include:
    • Intercepting discarded equipment
    • Piggybacking
    • Tampering (e.g., rewiring cabling, adding unauthorized devices)
    • Theft
  • Supply Chain Attacks: Target vulnerabilities in software or hardware supply chains. Examples include:
    • Embedded malware
    • Foreign-sourced attacks
    • Pre-installed malware
    • Vendor attacks
    • Watering hole attacks

Stages of a Cyberattack

  • Reconnaissance: Information gathering about target.
  • Gaining Access: Entering targeted system through vulnerabilities.
  • Escalation of Privileges: Increasing access levels.
  • Maintaining Access: Remaining in the system.
  • Network Exploitation/Exfiltration: Malicious activity, data theft.
  • Covering Tracks: Removing evidence of intrusion.
  • Cloud Computing: Additional industry exposure, malware injection, compliance violations, data loss, loss of control/visibility, multi-cloud/hybrid management, IP theft.
  • Mobile Technologies: Application malware, lack of updates/encryption, physical threats, unsecured Wi-Fi, location tracking.
  • Internet of Things (IoT): Device mismanagement (changing defaults), device spoofing, expanded attack surface, cyberattacks, information theft, outdated firmware, malware/network attacks.

Threat Modeling Methodologies

  • PASTA (Process for Attack Simulation and Threat Analysis): Structured approach to simulations.
  • VAST (Visual, Agile, and Simple Threat): Scalable threat analysis.
  • STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial-of-Service, Elevation of Privilege): Common threat categories.

Security Mitigation Strategies

  • COSO Framework: Business objectives (Operations, Record Keeping, Compliance). Five components of Internal Control (Control environment, Risk Assessment, Information & Communication, Monitoring, Control Activities).
  • Security Policies: Comprehensive guidelines for security implementation. Examples include Acceptable Use Policy, Bring Your Own Device (BYOD) policy, Network Segmentation/Isolation.
  • Security Technologies: VPNs, SSID use, system hardening, MAC filtering.
  • Authentication/Authorization: Zero trust, least privilege, need-to-know, whitelisting. Authentication methods include context-aware, digital signatures, SSO, MFA, PIN, smart cards, tokens, biometrics.
  • Password Management: Recommendations like complexity (length, character types), frequency of changes, and avoiding personal information.
  • Vulnerability management: NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover). CVE Dictionary.
  • Layered Security: Combining physical, logical, and administrative controls for defense in depth.

Security Assessment Methods

  • Security Assessment Reports (SARs): Document findings, including summary, methodology, findings, recommendations, and action plans.
  • Security Awareness: Training and awareness programs. Phishing simulations, champions, engagement, materials.

Confidentiality and Privacy

  • Confidentiality vs. Privacy: Confidentiality protects unauthorized access/disclosure of information, privacy protects individual rights; individuals control it.
  • Obfuscation, Tokenization, Masking, Encryption: Techniques for protecting sensitive data.
  • Data Loss Prevention (DLP): Prevents unauthorized data transfer. Types include network-based, cloud-based, endpoint-based.
  • Safeguards for data at rest: Physical, Digital, Access Controls, Change Management, Backups.
  • Walk Throughs: Understanding security/privacy procedures. Types such as Read, Structured, and Fire Drills.

Incident Response

  • Incident Response Plan (IRP): Procedures, people, and info for detecting, responding to, and reducing consequences of attacks.
  • Incident Response Timeline: IRP showing incident occurrence, detection, containment, eradication, recovery to normal operations.
  • NIST Response Team Models: Centralized, Distributed, Coordinating.
  • General Incident Response Plan (PDCERRL): Preparation, Detection, Containment, Eradication, Reporting, Recovery, Learning.
  • Testing IRP Plans: Simulations, metrics, post-incident reviews, periodic audits, continuous monitoring.
  • Insurable Losses: Business interruption, extortion, response costs, system replacement, legal fees, reputation damage, information/identity theft.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Quiz Team

Description

This quiz explores various types of cybersecurity threats and attacks, including network-based and application-based attacks. Understand the different threat agents and their motivations, as well as the specific tactics used in these cyberattacks. Test your knowledge on how to protect organizational IT infrastructure.

More Like This

Use Quizgecko on...
Browser
Open
Browser
Browser