DOD Cyber Awareness 2023 Flashcards

Vendor Data Request

• Refer vendors to appropriate personnel for organizational data requests.

Protecting Classified Data

• Store classified data in GSA-approved vaults/containers when not in use.

Handling Classified Data

• Classification markings and handling caveats dictate data handling and storage.

Unclassified Laptop Usage

• Disable any embedded cameras, microphones, and Wi-Fi before using unclassified laptops in classified environments.

Impact of Top Secret Disclosure

• Disclosure of Top Secret information can cause exceptionally grave damage to national security.

Telework Guidelines

• Permission from the organization is required for teleworking.

Marking Classified Material

• Proper marking is essential for protecting classified data.

Insider Threat Activities

• Attempting to access sensitive information without the need-to-know is reportable as an insider threat.

Indicators of Insider Threat

• Removing sensitive information without authorization for telework may indicate insider threat behavior.

Social Media Privacy

• Safest information to share on social media includes non-identifiable details, like favorite movies.

Apps and Smart Devices

• Many apps gather and share personal information, impacting online identity.

Social Networking Site Protection

• Avoid posting identifiable work-related photos where landmarks can be recognized.

Protecting Controlled Unclassified Information (CUI)

• Store CUI in locked desk drawers after business hours for security.

Transmitting CUI Safely

• Verify CUI status, mark emails appropriately, and digitally sign them for secure transmission.

Designation of Information Types

• CUI includes Personally Identifiable Information (PII) and Protected Health Information (PHI).

Examples of CUI

• Press release data is not classified as CUI.

Storing CUI Safely

• CUI storage should not be performed on any password-protected system indiscriminately.

Physical Security Best Practices

• Stop unbadged individuals in secure areas to ensure safety and compliance.

Two-Factor Authentication

• Examples include using a Common Access Card and a Personal Identification Number.

Protecting Security Cards

• Store Common Access Cards (CAC) or Personal Identity Verification (PIV) cards in shielded sleeves.

SCIF Entry Protocol

• Confirm the need-to-know and access before allowing individuals in Sensitive Compartmented Information Facilities (SCIF).

SCI Access Requirements

• Access to Sensitive Compartmented Information (SCI) requires Top Secret clearance and specific indoctrination.

Removable Media Risks

• Using removable media unsafely in SCIF does not typically damage the media itself, but poses other risks.

Authorization for Electronic Devices

• Only government-owned, expressly authorized devices are permitted in SCIF.

Incident Response in SCIF

• Responding to incidents, such as opening unauthorized DVDs, necessitates all outlined measures.

Malicious Code Types

• Categories do not include executables.

Identity Protection Actions

• Shredding personal documents is a crucial step in protecting identity.

Government Email Usage

• Utilize digital signatures for attaching files or hyperlinks in government emails.

Types of Social Engineering Attacks

• Spear phishing specifically targets particular groups or individuals.

Preventing Social Engineering

• Always verify individual identities to combat social engineering threats.

Traveling with Mobile Phones

• Personal devices under BYOAD policy must be unenrolled when traveling abroad.

Public Wi-Fi Safety

• Connecting to public Wi-Fi, like hotel internet, poses significant risks.

Permissible Computer Peripherals

• Headsets with microphones and USB connections can be used with government-furnished equipment.

Data Security on Mobile Devices

• Enable automatic screen lock on mobile and portable devices to secure data.

Removable Media Examples

• External hard drives qualify as examples of removable media.

IoT Security Risks

• Internet of Things (IoT) devices can create vulnerabilities on home networks.

Security Badge Visibility

• Security badges must be visible at all times within facilities.

Handling Printed SCI

• Retrieve classified documents promptly from printers to maintain security.

Conversation Guidelines with SCI

• Ensure everyone within earshot is cleared and has a need-to-know during sensitive conversations.

Mobile Device Security Measures

• Encrypt sensitive data on government-issued mobile devices for enhanced protection.

Definition of Spillage

• Spillage does not include classified information downgraded to unclassified status.

Inadvertent Spillage Prevention

• Utilize the classified network solely for classified work; do not mix with unclassified tasks.

Classified Information on the Internet

• Downloading classified information found online should be avoided.

Classification Designation Authority

• The authority for designating information classification lies with the appropriate officials.

Good Practices for Protecting Classified Information

• Systematic approaches and consistent adherence to policies are essential.

Preventing Information Spillage

• Follow strict procedures for transferring data between outside agencies and non-government networks.