Security Engineering Principles Quiz

False (B)

To design and build dependable systems that remain protected against malicious threats.

<p>authentication</p> Signup and view all the answers

<p>Secure Software Development = Incorporating security into the software development lifecycle Network Security = Protecting network traffic using firewalls and intrusion detection systems Access Control = Restricting access based on user roles Encryption = Protecting data by converting it into unreadable code</p> Signup and view all the answers

<p>Ensuring Compliance (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Checksums and Digital Signatures.</p> Signup and view all the answers

<p>network</p> Signup and view all the answers

<p>Protecting data confidentiality (C)</p> Signup and view all the answers

<p>Hardware malfunction (C)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>A weakness or flaw that could be exploited. (C)</p> Signup and view all the answers

<p>human vulnerabilities</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>phishing</p> Signup and view all the answers

<p>human</p> Signup and view all the answers

<p>denial of service</p> Signup and view all the answers

<p>Implementing firewalls (D)</p> Signup and view all the answers

<p>Software Vulnerability = Weaknesses in applications Network Vulnerability = Weaknesses in network infrastructure Configuration Vulnerability = Weaknesses from improper system setups Human Vulnerability = Weaknesses from employee actions</p> Signup and view all the answers

<p>Malware = Malicious software designed to disrupt or damage systems. Man-in-the-Middle = Attackers intercepts communications between two parties. Insider threat = Threats posed by individuals within an organization. APT = Prolonged and targeted cyberattacks to steal data.</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Phishing (C)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>configuration management tools</p> Signup and view all the answers

<p>advanced persistent threat</p> Signup and view all the answers

<p>Implementing strong authentication mechanisms. (C)</p> Signup and view all the answers

<p>software vulnerabilities</p> Signup and view all the answers

<p>Uses expert judgment to evaluate risks subjectively (C)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>hybrid risk assessment</p> Signup and view all the answers

<p>SDLC</p> Signup and view all the answers

<p>To identify, evaluate, and prioritize risks (C)</p> Signup and view all the answers

<p>Qualitative = Subjective, relies on expert judgment Quantitative = Objective, uses numerical data Hybrid = Combines qualitative and quantitative methods NIST RMF = Structured approach, integrates risk into SDLC</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>expected monetary loss</p> Signup and view all the answers

<p>Gather quantitative data on the likelihood and impact of each risk (B)</p> Signup and view all the answers

<p>likelihood</p> Signup and view all the answers

<p>Develop Marketing Strategies (C)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Proactive Risk Management</p> Signup and view all the answers

<p>impact</p> Signup and view all the answers

<p>Qualitative = Uses descriptive scales for risk analysis Quantitative = Uses numerical values for risk analysis Hybrid = Combines both qualitative and quantitative methods NIST RMF = Framework published by the National Institute of Standards and Technology</p> Signup and view all the answers

<p>May be complex for smaller organizations. (B)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Improved decision-making</p> Signup and view all the answers

<p>To assess the potential consequences of risks (D)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Identify critical assets and processes</p> Signup and view all the answers

<p>quantitative</p> Signup and view all the answers

<p>Informed decision-making (D)</p> Signup and view all the answers

<p>Financial Impact = Monetary losses from a risk event Operational Impact = Disruptions to business operations Reputational Impact = Damage to an organization's trustworthiness Legal and Regulatory Impact = Consequences related to laws and regulations</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Network outages affecting customer service (C)</p> Signup and view all the answers

<p>The potential harm to individuals' safety and well-being resulting from a risk event.</p> Signup and view all the answers

<p>resilience</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>Ignoring documented findings (A)</p> Signup and view all the answers

<p>Lost revenue and decreased productivity</p> Signup and view all the answers

<p>Financial Impact = Loss of revenue, increased costs Operational Impact = Disruption to business processes Reputational Impact = Damage to brand image Legal and Regulatory Impact = Fines or penalties</p> Signup and view all the answers

<p>reputational</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Determine Likelihood of Impact (C)</p> Signup and view all the answers

<p>It allows organizations to allocate resources to areas that need the most attention.</p> Signup and view all the answers

<p>Avoidance (D)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Reduction</p> Signup and view all the answers

<p>sharing</p> Signup and view all the answers

<p>Avoidance = Eliminating activities that expose the organization to risk Reduction = Implementing measures to lessen likelihood or impact of a risk Sharing = Transferring the risk to another party Acceptance = Acknowledging the risk and not implementing control</p> Signup and view all the answers

<p>Assess Risks and Identify Controls (D)</p> Signup and view all the answers

<p>Ignore stakeholder concerns (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>mitigation</p> Signup and view all the answers

<p>Legal warnings and visible security measures (D)</p> Signup and view all the answers

<p>Technical, administrative, and physical</p> Signup and view all the answers

<p>Deploying technical solutions and updating policies (C)</p> Signup and view all the answers

<p>To promote security awareness and diligence among employees.</p> Signup and view all the answers

<p>acceptable</p> Signup and view all the answers

<p>Avoidance = Eliminating the risk by not engaging in the activity Reduction = Minimizing the likelihood or impact of the risk Sharing = Transferring risk to a third party Acceptance = Acknowledging the risk and deciding not to mitigate it actively</p> Signup and view all the answers

<p>Avoid stakeholder engagement (B)</p> Signup and view all the answers

<p>True (A)</p> Signup and view all the answers

<p>Firewalls (D)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Multi-factor authentication</p> Signup and view all the answers

<p>layered security</p> Signup and view all the answers

<p>Technical Controls = Implemented through technology Administrative Controls = Policies and procedures that govern security Physical Controls = Measures that protect the physical environment and assets</p> Signup and view all the answers

<p>Identifying the organization's security requirements (A)</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>Identify weaknesses and vulnerabilities</p> Signup and view all the answers

<p>administrative</p> Signup and view all the answers

<p>Layered Security = Slows down potential attackers Regular Training and Awareness = Reduces human error Automation and Integration = Faster detection of threats</p> Signup and view all the answers

<p>False (B)</p> Signup and view all the answers

<p>To detect security incidents</p> Signup and view all the answers

<p>administrative</p> Signup and view all the answers

<p>Technical Controls = Implemented through technology Physical Controls = Protect the physical environment Administrative Controls = Organizational policies and procedures</p> Signup and view all the answers

The practice of building secure systems using engineering principles.

Ensuring sensitive information is only accessible to authorized users.

Maintaining data accuracy and completeness, preventing unauthorized changes.

Guaranteeing information and systems are accessible to authorized users when needed.

Verifying the identity of users and systems.

Controlling access to resources based on user roles and permissions.

Ensuring actions or transactions cannot be denied after they occur.

Building secure software through code reviews, secure coding practices, and security testing.

Protecting network traffic with firewalls, intrusion detection/prevention systems (IDS/IPS), and VPNs.

Developing plans to respond to security incidents efficiently, including communication channels and drills.

A weakness or flaw in a system that could potentially be exploited by a threat.

A source of harm or danger that could potentially exploit a vulnerability.

The potential risk of a threat exploiting a vulnerability.

Malicious software designed to harm computer systems.

A type of social engineering attack where attackers trick someone into providing sensitive information.

An attack aimed at overwhelming a system or service with traffic, making it unavailable to users.

A type of DoS attack where attackers use multiple devices to flood a target.

An attack where an attacker intercepts and possibly alters communication between two parties.

Threats originating from individuals within the organization, intentionally or unintentionally causing harm.

Prolonged and targeted cyberattacks designed to steal data or disrupt operations.

Weaknesses in a network infrastructure that can be exploited by attackers. Examples include insecure configurations, unpatched routers, and lack of encryption.

Problems caused by incorrect system or application configurations. This can include using default passwords, enabling unnecessary services, or misconfigured access controls.

Weaknesses caused by human actions like using weak passwords, clicking phishing links, or accidentally sharing sensitive data.

Actions taken to protect against cyber threats and vulnerabilities, including using security tools, educating users, and conducting regular assessments.

The practice of designing and building secure systems using engineering principles. It considers security throughout the development cycle to prevent security vulnerabilities.

Clearly define the goals and boundaries for the risk assessment, determining which assets, systems, and processes will be evaluated.

Identify potential threats, vulnerabilities, and risks using methods like brainstorming, threat modeling, and vulnerability assessments.

Assess the likelihood and impact of each identified risk.

Document the identified risks, likelihood and impact, and the prioritized list of risks.

Develop strategies to mitigate or manage identified risks.

Regularly review and update the risk assessment as the threat landscape, organizational structure, or technology environment changes.

Enables organizations to proactively identify and address potential risks before they materialize.

Prioritize risks and allocate resources effectively to areas with the highest potential impact.

A systematic process of identifying potential risks, analyzing their impact and likelihood, and determining appropriate measures to mitigate or manage these risks.

A subjective approach that evaluates risks based on their severity and likelihood using expert judgment. Risks are categorized as high, medium, or low.

An objective approach that uses numerical data and statistical methods to quantify risks. It assigns monetary values to the potential impact and likelihood of risks.

Combines elements of qualitative and quantitative risk assessment to leverage the strengths of both approaches.

A structured, comprehensive approach developed by NIST that integrates risk management into the system development life cycle (SDLC).

The first step in the NIST RMF process, where information systems are categorized based on the sensitivity of the data they process.

The second step in the NIST RMF process, where appropriate security controls are selected based on the categorization of the information system.

The third step in the NIST RMF process, where the selected security controls are implemented and configured.

The fourth step in the NIST RMF process, where the effectiveness of the implemented security controls is assessed to identify any gaps or weaknesses.

The fifth step in the NIST RMF process, where the information system is authorized for operation once the security controls are deemed effective.

The potential harm to individuals' safety and well-being resulting from a risk event. This includes physical harm, health risks, and safety violations.

A process of analyzing the potential consequences of risks on an organization's operations, assets, and individuals.

It helps prioritize risk mitigation efforts and allocate resources effectively, ensuring efforts are focused on mitigating the most significant threats.

By analyzing impacts, you can improve your overall risk management strategy, develop targeted mitigation plans, and enhance resilience to adverse events.

Impact analysis helps organizations comply with regulations by identifying risks that could lead to legal penalties and implementing measures to meet compliance standards.

The process of identifying critical assets, assessing potential impacts, quantifying impact levels, determining likelihood, prioritizing risks, and documenting findings.

Financial, operational, reputational, legal and regulatory, and safety impacts.

Impact analysis helps to create a better understanding of the potential consequences of risks, enabling informed decision-making, effective resource allocation, improved risk management, regulatory adherence, and enhanced organizational resilience.

Examining the potential effects of identified risks on an organization's operations, assets, and individuals.

Identifying which assets and processes are crucial for an organization's smooth functioning.

Evaluating the possible consequences of identified risks on critical assets and processes, considering financial, operational, reputational, and legal impacts.

Assessing the likelihood of each risk materializing and causing the evaluated impact.

Financial, operational, reputational, legal, and safety.

The potential monetary losses an organization could face due to a risk event.

The disruption to business operations caused by a risk event.

The damage to an organization's trustworthiness and overall image caused by a risk event.

The legal and regulatory consequences of a risk event, including fines, penalties, and legal actions.

The potential threat to the safety of individuals or assets due to a risk event.

The process of implementing actions to reduce the likelihood and impact of identified cyber risks.

This strategy completely avoids activities or conditions that expose the organization to risk. It's used when a risk is unacceptable.

This strategy reduces the likelihood or impact of a risk event. It's the most common approach.

Shifting the risk to another party, like by purchasing insurance or outsourcing.

Accepting the risk and choosing not to implement additional controls when the cost outweighs the potential impact.

This strategy discourages attackers from trying to exploit vulnerabilities.

This involves identifying controls, creating plans, implementing them, and then monitoring their effectiveness over time.

Evaluating risks, identifying relevant controls, and implementing these controls to reduce risk levels.

Creating detailed plans for implementing mitigation strategies, including timelines, resources, and responsibilities.

Putting the controls into action, which can involve technical solutions, policy updates, and awareness programs.

Evaluating identified risks and determining the most effective ways to reduce their impact. It involves identifying specific controls and measures to minimize the likelihood and effects of each risk.

Creating comprehensive plans for implementing chosen risk mitigation strategies. These plans outline steps, responsibilities, and timelines for each action, ensuring alignment with organizational goals and resources.

Putting the identified controls into action. This can involve deploying technical solutions, updating policies, and conducting training programs.

Continuously checking the effectiveness of implemented controls and updating mitigation strategies regularly. It involves periodic assessments to ensure ongoing protection against new threats.

Communicating risk mitigation strategies to all stakeholders and providing resources to ensure employees understand their roles in risk management. It fosters a culture of security awareness and vigilance.

Ensuring security controls are regularly updated to address new threats and vulnerabilities. This involves keeping software, hardware, and policies up-to-date to stay ahead of evolving risks.

Utilizing tools and technologies to continuously monitor for security incidents in real-time. It enables proactive detection and response to potential threats.

Involving all relevant stakeholders in the risk mitigation process, ensuring everyone understands their roles and responsibilities in managing risks.

Safeguards implemented to protect information systems and reduce the risk of security breaches.

Security controls implemented through technology to protect systems and data.

Policies, procedures, and practices that guide how security measures are implemented and managed.

Security measures that protect physical assets and environments.

Implementing multiple layers of security controls for comprehensive protection against attacks.

Providing ongoing training and awareness programs to educate employees about security policies and threats.

Using automated tools to streamline security processes and reduce human error.

Regularly assessing security controls to identify weaknesses and vulnerabilities.

Implementing controls based on the organization's needs, effectiveness, costs, and regulations.

Determining the organization's security requirements and identifying assets that need protection.

Choosing security controls that address identified risks and meet the organization's requirements.

Creating detailed policies and procedures for implementing and managing security controls.

Implementing technical controls, like firewalls and encryption, to secure information systems.

Establishing and enforcing administrative controls, like security policies and incident response plans.

Installing physical security measures, such as surveillance cameras and security guards, to protect critical assets.