Podcast
Questions and Answers
What is one of the primary goals of information security awareness?
What is one of the primary goals of information security awareness?
- To maintain awareness and skills among employees (correct)
- To minimize employee salaries
- To manage social media accounts
- To increase internet speed
Which type of malware is NOT discussed in the session agenda?
Which type of malware is NOT discussed in the session agenda?
- Spyware
- Worms
- Zombie malware (correct)
- Viruses
What was highlighted as a top security concern in 2015?
What was highlighted as a top security concern in 2015?
- Increased hardware sales
- New software installations
- Top security breaches (correct)
- Social media marketing
Which of the following is considered a human-based attack?
Which of the following is considered a human-based attack?
Which of the following is NOT a security tip mentioned in the session?
Which of the following is NOT a security tip mentioned in the session?
What does 'clearing your screen' refer to in the context of security tips?
What does 'clearing your screen' refer to in the context of security tips?
Which security measure is recommended for protecting mobile devices?
Which security measure is recommended for protecting mobile devices?
What is a key component of incident reporting?
What is a key component of incident reporting?
What does 'business continuity' refer to in the context of information security?
What does 'business continuity' refer to in the context of information security?
What should you do to protect sensitive data?
What should you do to protect sensitive data?
Which action should you take when stepping away from your workstation?
Which action should you take when stepping away from your workstation?
Why is it important to keep your operating system and applications updated?
Why is it important to keep your operating system and applications updated?
What is a recommended practice when using strong passwords?
What is a recommended practice when using strong passwords?
What should you avoid when charging your smartphone?
What should you avoid when charging your smartphone?
What percentage of information security is attributed to behavior rather than technology?
What percentage of information security is attributed to behavior rather than technology?
What security measure should be taken for a strong password?
What security measure should be taken for a strong password?
Which statement is true regarding social networking security?
Which statement is true regarding social networking security?
What is one recommended action for email security?
What is one recommended action for email security?
What does the Web of Trust (WOT) help users determine?
What does the Web of Trust (WOT) help users determine?
Which of the following is a suggestion for mobile phone security?
Which of the following is a suggestion for mobile phone security?
What is a best practice for physical security at a workstation?
What is a best practice for physical security at a workstation?
What should you do with sensitive documents after use?
What should you do with sensitive documents after use?
Which of the following is NOT a recommended practice for mobile security?
Which of the following is NOT a recommended practice for mobile security?
Which characteristic is essential for a password phrase?
Which characteristic is essential for a password phrase?
What precaution should be taken regarding third-party applications in social networking?
What precaution should be taken regarding third-party applications in social networking?
What is the first step in incident reporting?
What is the first step in incident reporting?
What is an example of a successful phishing attack?
What is an example of a successful phishing attack?
What does the acronym IRC stand for in incident reporting?
What does the acronym IRC stand for in incident reporting?
Which of the following reflects a countermeasure to information security risks?
Which of the following reflects a countermeasure to information security risks?
What is one common misconception about digital information?
What is one common misconception about digital information?
What is a key characteristic of digital information?
What is a key characteristic of digital information?
Which of the following is a type of social engineering attack?
Which of the following is a type of social engineering attack?
In the case of a phishing email detected, what is the typical content of the email?
In the case of a phishing email detected, what is the typical content of the email?
What should be avoided when dealing with potential security incidents?
What should be avoided when dealing with potential security incidents?
What is a characteristic of phishing emails?
What is a characteristic of phishing emails?
Which department usually addresses an incident after it has been reported?
Which department usually addresses an incident after it has been reported?
What does APT stand for in information security?
What does APT stand for in information security?
What does successfully falling for phishing lead to?
What does successfully falling for phishing lead to?
The first line of defense against social engineering attacks is:
The first line of defense against social engineering attacks is:
Which method is NOT considered a form of information gathering for phishing?
Which method is NOT considered a form of information gathering for phishing?
What should be reported as a potential sign of an APT attack?
What should be reported as a potential sign of an APT attack?
Which of the following is NOT a human-based social engineering attack method?
Which of the following is NOT a human-based social engineering attack method?
What is a common tactic of an attacker who conducts a phishing campaign?
What is a common tactic of an attacker who conducts a phishing campaign?
Which of the following is a countermeasure against APTs?
Which of the following is a countermeasure against APTs?
Which of the following tactics is used in dumpster diving?
Which of the following tactics is used in dumpster diving?
Flashcards are hidden until you start studying
Study Notes
Information Security Goals
- Maintain an appropriate level of knowledge and skills among employees and managers
- Ensure business continuity if information security incidents occur
Types of Malware
- A type of social engineering attack where unauthorized personnel gain access to the network undetected for a long time to steal data
- Often uses social engineering to gain access to the network via legitimate means
- Establishes a backdoor once access is achieved
- Countermeasures include reporting odd user behavior, keeping aware of social engineering attempts, and understanding information/credentials disclosure compromises the entire information system
Top Security Breaches of 2015
- Not mentioned in provided material
Social Engineering
- Human based attacks:
- Information gathering (Social media vectors)
- Shoulder surfing
- Dumpster diving
- Impersonation
- Phishing
- Computer based attacks:
- Online Scams
Incident Reporting
- Report, fix, follow-up
- Repair and Support unit (RSU)
- Incident Reporting Coordinator (IRC)
- Concerns about business line
###Security Tips & Counter-measures
- HTTPs:
- Protect by encrypting information sent between computer and website
- WOT:
- Shows a colored traffic light to indicate the trustworthiness of websites
- Social networking security:
- Limit the amount of personal information you post
- Be cautious of third-party applications
- Use strong passwords
- Check privacy policies
- Password security:
- At least 8 characters
- Mix of upper and lowercase characters
- Mix of alpha and numeric characters
- Don't use dictionary words
- Change passwords frequently
- Don't share or reuse passwords
- Use different passwords for different accounts
- Don't write down passwords
- Use password phrases
- Clear desk & clear screen:
- Clear away paperwork
- Use shredders when disposing of sensitive documents
- Lock desks and filing cabinets
- Lock away portable devices such as tablets
- Lock your workstation when you leave
- Make sure no documents are left in the printer
- Treat mass storage devices (CDROM, DVDs, USB drives) as sensitive and secure
- them in a locked drawer
- Email Security
- Never open an attachment from an unknown sender
- Make sure the email references the attachment
- Don't hesitate to contact the sender of an email that contains an attachment
- Never send anyone your personal data (name, address, phone number, password, account numbers)
- In case of suspicion, contact the IT department or the information security officer
- Mobile threat & security:
- Number of malicious installation packages and new malicious programs detected (Q3 2014 – Q1 2015)
- Never plug in your phone to the PC
- Download applications only from trusted sources
- Install antimalware controls
- Never store business-related documents on your phone
- Always change the factory pin code (0000)
- Always use a screen lock
- Install locking features
- Use secure messaging applications
- Secure personal email
- How to protect your PC:
- Always back up sensitive data
- Always lock your workstation when away from your desk
- Ensure that antivirus definitions are updated regularly
- Reboot your system after applying new updates
- Use a strong password and try not to be confused with passwords used for personal accounts
- Never charge smartphones from the PC
- Never insert a USB or any storage device into your PC
Conclusion
- Security is 20% technical and 80% behavior
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
