HIPAA Compliance and Network Security Quiz

Sensitive Patient Data

• Patient data, including medical records, diagnoses, treatments, and personal information, is considered sensitive and should be treated as such to ensure compliance with privacy regulations like HIPAA (Health Insurance Portability and Accountability Act) in the United States.

Endpoint Detection and Response (EDR)

• EDR is a technology that monitors and analyzes the activity and behavior of endpoints, such as computers, laptops, mobile devices, and servers.
• EDR helps detect and prevent malicious software, such as viruses, malware, and Trojans, from infecting endpoints and spreading across the network.
• EDR provides visibility and response capabilities to contain and remediate threats.

Compensating Control

• A compensating control is a security measure that mitigates the risk of a vulnerability or weakness that cannot be resolved by the primary control.
• A compensating control reduces the likelihood or impact of an attack, but does not prevent or eliminate the vulnerability or weakness.
• Example: A host-based firewall on a legacy Linux system that allows connections from only specific internal IP addresses.

Disaster Recovery Plan (DRP)

• A DRP is a set of policies and procedures that aim to restore the normal operations of an organization in the event of a system failure, natural disaster, or other emergency.
• A DRP is required for an organization to properly manage its restore process in the event of system failure.

DNS Queries

• An unusual amount of DNS queries to systems on the internet over short periods of time during non-business hours may indicate that an internal system is sending malicious traffic.

Bug Bounty

• A bug bounty is a program that rewards security researchers for finding and reporting vulnerabilities in an application or system.
• Bug bounties are used by companies to improve their security posture and incentivize ethical hacking.

Smishing

• Smishing is a type of phishing attack that uses text messages or common messaging apps to trick victims into clicking on malicious links or providing personal information.
• Example: A fraudulent text message claiming to be from the CEO, asking an employee to purchase gift cards.

Shadow IT

• Shadow IT is the use of unauthorized or unapproved IT resources within an organization.
• Example: The marketing department setting up its own project management software without telling the appropriate departments.

Business Continuity Strategy

• Capacity planning is the process of determining the resources needed to meet the current and future demands of an organization.
• Capacity planning helps a company develop a business continuity strategy by estimating how many staff members would be required to sustain the business in the case of a disruption.

Threat Actors

• A threat actor is an entity that poses a threat to an organization's security.
• Example: A threat actor using large financial resources to attack a critic.

Password Spraying

• Password spraying is a type of brute-force attack that tries common passwords across several accounts to find a match.