Security Engineering Principles Quiz

The practice of building secure systems using engineering principles.

Ensuring sensitive information is only accessible to authorized users.

Maintaining data accuracy and completeness, preventing unauthorized changes.

Guaranteeing information and systems are accessible to authorized users when needed.

Verifying the identity of users and systems.

Controlling access to resources based on user roles and permissions.

Ensuring actions or transactions cannot be denied after they occur.

Building secure software through code reviews, secure coding practices, and security testing.

Protecting network traffic with firewalls, intrusion detection/prevention systems (IDS/IPS), and VPNs.

Developing plans to respond to security incidents efficiently, including communication channels and drills.

A weakness or flaw in a system that could potentially be exploited by a threat.

A source of harm or danger that could potentially exploit a vulnerability.

The potential risk of a threat exploiting a vulnerability.

Malicious software designed to harm computer systems.

A type of social engineering attack where attackers trick someone into providing sensitive information.

An attack aimed at overwhelming a system or service with traffic, making it unavailable to users.

A type of DoS attack where attackers use multiple devices to flood a target.

An attack where an attacker intercepts and possibly alters communication between two parties.

Threats originating from individuals within the organization, intentionally or unintentionally causing harm.

Prolonged and targeted cyberattacks designed to steal data or disrupt operations.

Weaknesses in a network infrastructure that can be exploited by attackers. Examples include insecure configurations, unpatched routers, and lack of encryption.

Problems caused by incorrect system or application configurations. This can include using default passwords, enabling unnecessary services, or misconfigured access controls.

Weaknesses caused by human actions like using weak passwords, clicking phishing links, or accidentally sharing sensitive data.

Actions taken to protect against cyber threats and vulnerabilities, including using security tools, educating users, and conducting regular assessments.

The practice of designing and building secure systems using engineering principles. It considers security throughout the development cycle to prevent security vulnerabilities.

Clearly define the goals and boundaries for the risk assessment, determining which assets, systems, and processes will be evaluated.

Identify potential threats, vulnerabilities, and risks using methods like brainstorming, threat modeling, and vulnerability assessments.

Assess the likelihood and impact of each identified risk.

Document the identified risks, likelihood and impact, and the prioritized list of risks.

Develop strategies to mitigate or manage identified risks.

Regularly review and update the risk assessment as the threat landscape, organizational structure, or technology environment changes.

Enables organizations to proactively identify and address potential risks before they materialize.

Prioritize risks and allocate resources effectively to areas with the highest potential impact.

A systematic process of identifying potential risks, analyzing their impact and likelihood, and determining appropriate measures to mitigate or manage these risks.

A subjective approach that evaluates risks based on their severity and likelihood using expert judgment. Risks are categorized as high, medium, or low.

An objective approach that uses numerical data and statistical methods to quantify risks. It assigns monetary values to the potential impact and likelihood of risks.

Combines elements of qualitative and quantitative risk assessment to leverage the strengths of both approaches.

A structured, comprehensive approach developed by NIST that integrates risk management into the system development life cycle (SDLC).

The first step in the NIST RMF process, where information systems are categorized based on the sensitivity of the data they process.

The second step in the NIST RMF process, where appropriate security controls are selected based on the categorization of the information system.

The third step in the NIST RMF process, where the selected security controls are implemented and configured.

The fourth step in the NIST RMF process, where the effectiveness of the implemented security controls is assessed to identify any gaps or weaknesses.

The fifth step in the NIST RMF process, where the information system is authorized for operation once the security controls are deemed effective.

The potential harm to individuals' safety and well-being resulting from a risk event. This includes physical harm, health risks, and safety violations.

A process of analyzing the potential consequences of risks on an organization's operations, assets, and individuals.

It helps prioritize risk mitigation efforts and allocate resources effectively, ensuring efforts are focused on mitigating the most significant threats.

By analyzing impacts, you can improve your overall risk management strategy, develop targeted mitigation plans, and enhance resilience to adverse events.

Impact analysis helps organizations comply with regulations by identifying risks that could lead to legal penalties and implementing measures to meet compliance standards.

The process of identifying critical assets, assessing potential impacts, quantifying impact levels, determining likelihood, prioritizing risks, and documenting findings.

Financial, operational, reputational, legal and regulatory, and safety impacts.

Impact analysis helps to create a better understanding of the potential consequences of risks, enabling informed decision-making, effective resource allocation, improved risk management, regulatory adherence, and enhanced organizational resilience.

Examining the potential effects of identified risks on an organization's operations, assets, and individuals.

Identifying which assets and processes are crucial for an organization's smooth functioning.

Evaluating the possible consequences of identified risks on critical assets and processes, considering financial, operational, reputational, and legal impacts.

Assessing the likelihood of each risk materializing and causing the evaluated impact.

Financial, operational, reputational, legal, and safety.

The potential monetary losses an organization could face due to a risk event.

The disruption to business operations caused by a risk event.

The damage to an organization's trustworthiness and overall image caused by a risk event.

The legal and regulatory consequences of a risk event, including fines, penalties, and legal actions.

The potential threat to the safety of individuals or assets due to a risk event.

The process of implementing actions to reduce the likelihood and impact of identified cyber risks.

This strategy completely avoids activities or conditions that expose the organization to risk. It's used when a risk is unacceptable.

This strategy reduces the likelihood or impact of a risk event. It's the most common approach.

Shifting the risk to another party, like by purchasing insurance or outsourcing.

Accepting the risk and choosing not to implement additional controls when the cost outweighs the potential impact.

This strategy discourages attackers from trying to exploit vulnerabilities.

This involves identifying controls, creating plans, implementing them, and then monitoring their effectiveness over time.

Evaluating risks, identifying relevant controls, and implementing these controls to reduce risk levels.

Creating detailed plans for implementing mitigation strategies, including timelines, resources, and responsibilities.

Putting the controls into action, which can involve technical solutions, policy updates, and awareness programs.

Evaluating identified risks and determining the most effective ways to reduce their impact. It involves identifying specific controls and measures to minimize the likelihood and effects of each risk.

Creating comprehensive plans for implementing chosen risk mitigation strategies. These plans outline steps, responsibilities, and timelines for each action, ensuring alignment with organizational goals and resources.

Putting the identified controls into action. This can involve deploying technical solutions, updating policies, and conducting training programs.

Continuously checking the effectiveness of implemented controls and updating mitigation strategies regularly. It involves periodic assessments to ensure ongoing protection against new threats.

Communicating risk mitigation strategies to all stakeholders and providing resources to ensure employees understand their roles in risk management. It fosters a culture of security awareness and vigilance.

Ensuring security controls are regularly updated to address new threats and vulnerabilities. This involves keeping software, hardware, and policies up-to-date to stay ahead of evolving risks.

Utilizing tools and technologies to continuously monitor for security incidents in real-time. It enables proactive detection and response to potential threats.

Involving all relevant stakeholders in the risk mitigation process, ensuring everyone understands their roles and responsibilities in managing risks.

Safeguards implemented to protect information systems and reduce the risk of security breaches.

Security controls implemented through technology to protect systems and data.

Policies, procedures, and practices that guide how security measures are implemented and managed.

Security measures that protect physical assets and environments.

Implementing multiple layers of security controls for comprehensive protection against attacks.

Providing ongoing training and awareness programs to educate employees about security policies and threats.

Using automated tools to streamline security processes and reduce human error.

Regularly assessing security controls to identify weaknesses and vulnerabilities.

Implementing controls based on the organization's needs, effectiveness, costs, and regulations.

Determining the organization's security requirements and identifying assets that need protection.

Choosing security controls that address identified risks and meet the organization's requirements.

Creating detailed policies and procedures for implementing and managing security controls.

Implementing technical controls, like firewalls and encryption, to secure information systems.

Establishing and enforcing administrative controls, like security policies and incident response plans.

Installing physical security measures, such as surveillance cameras and security guards, to protect critical assets.