.02 RG Vocab Information Security & Risk Management Flashcards

Question

Exploitation

Answer 1

is the sse of a vulnerability to gain access to an organization.

Answer 2

is the level of impact on organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals resulting from the operation of an information system, given the potential impact of a threat and the likelihood of that threat occurring.

Answer 3

is any circumstance or event that can adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, or individuals through an information system via unauthorized access, destruction, disclosure, modification of information, and denial of service; also, the potential for a threat source to successfully exploit a particular information system vulnerability.

Answer 4

also known as penetration testing, is the method of employing hacker tools and techniques to evaluate security and implemented controls. Another way of understanding a pen test is to discover both known and unknown vulnerabilities.

Answer 5

preserves authorized restrictions on information access and disclosure, including the means of protecting personal privacy and proprietary information.

Answer 6

guards against improper information modification or destruction, including ensuring information nonrepudiation and authenticity.

Answer 7

ensures timely and reliable access to and use of information

Answer 8

is an information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization.

Answer 9

include safeguards, measures, or steps taken to avoid, transfer, mitigate, reduce, or share the risks to organizational assets.

Answer 10

is the combination of the likelihood and the impact levels of risk.

Answer 11

is a group of people authorized and organized to emulate a potential adversary’s attack or exploitation capabilities against an enterprise’s security posture. The Red Team’s objective is to improve enterprise cybersecurity by demonstrating the impacts of successful attacks and what works for the defenders (i.e., the Blue Team) in an operational environment. Also known as the Cyber Red Team.

Answer 12

is a group responsible for defending an enterprise’s use of information systems by maintaining its security posture against a group of mock attackers (i.e., the Red Team). Typically the Blue Team and its supporters must defend against real or simulated attacks 1) over a significant period; 2) in a representative operational context (e.g., as part of an operational exercise); and 3) according to rules established and monitored with the help of a neutral group refereeing the simulation or exercise (i.e., the White Team).

Answer 13

is a method of testing where testers target individual binary components or the application as a whole to determine whether intra- or intercomponent vulnerabilities can be exploited to compromise the application, its data, or its environmental resources.

Answer 14

is hardware, firmware, or software intentionally included or inserted into a system for a harmful purpose.

Answer 15

is an unauthorized access point connected to a network.

Answer 16

disables the victim's access to data until a ransom is paid. (e.g., Ryuk)

Answer 17

changes files native to the OS (e.g., Astaroth).

Answer 18

collects user activity data without the user’s knowledge (e.g., DarkHotel)

Answer 19

serves unwanted advertisements (e.g., Fireball types of malware and their characteristics).

Answer 20

disguise themselves as desirable code (e.g., Emotet).

Answer 21

spread through a network by replicating themselves (e.g., Stuxnet).

Answer 22

give hackers remote control of a victim's device (e.g., Zacinlo).

Answer 23

monitor a user’s keystrokes (e.g., Olympic Vision).

Answer 24

launch a broad flood of attacks (e.g., Echobot).

Answer 25

infects mobile devices (e.g., Triada)

Answer 26

is a broad term used to describe malicious software, including spyware, ransomware, viruses, and worms. Malware breaches a network through a vulnerability, typically when a user clicks a dangerous link or email attachment that installs risky software. Once inside the system, malware can do the following: ● Block access to key components of the network (ransomware). ● Install malware or additional harmful software. ● Covertly obtain information by transmitting data from the hard drive (spyware). ● Disrupt certain components and render the system inoperable.

Answer 27

involves sending fraudulent communications that appear to come from a reputable source, usually through email. The goal is to steal sensitive data like credit card and login information or install malware on the victim’s machine. Phishing is an increasingly common cyberthreat.

Answer 28

are also known as eavesdropping attacks, which occur when attackers insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they can filter and steal data. The following are two common points of entry for On-Path attacks: 1. Attackers can insert themselves between a visitor’s device and the network on unsecured public Wi-Fi. Without knowing, the visitor passes all information through the attacker. 2. Once the malware has breached a device, an attacker can install software to process all of the victim’s information.

Answer 29

lood systems, servers, or networks with traffic to exhaust resources and bandwidth. As a result, the system is unable to fulfill legitimate requests. Attackers can also use multiple compromised devices to launch this type of attack. It may also be known as a Distributed Denial of Service (DDoS) attack.

Answer 30

is a Structured Query Language (SQL) injection that occurs when an attacker inserts malicious code into a server that uses SQL and forces the server to reveal information it normally would not. An attacker may carry out a SQL injection by simply submitting malicious code into a vulnerable website search box. Learn how to defend against SQL injection attacks.

Answer 31

hit after a network vulnerability is announced but before a patch or solution is implemented. Attackers target the disclosed vulnerability during this window of time. Zero-day vulnerability threat detection requires constant awareness.

Answer 32

utilizes the Domain Name System (DNS) protocol to communicate non-DNS traffic over port 53. DNS tunneling sends HTTP and other protocol traffic over DNS. There are various legitimate reasons to utilize DNS tunneling. However, there are also malicious motivations for using DNS tunneling virtual private network (VPN) services. This tactic is used to disguise outbound traffic like DNS, concealing data typically shared through an internet connection. DNS requests are manipulated to exfiltrate data from a compromised system to the attacker’s infrastructure for malicious use. It can also be used for command and control callbacks from the attacker’s infrastructure to a compromised system.

Answer 33

Risk is accepted, and no measures are implemented to reduce its probability or impact.

Answer 34

Choose operations that do not lend themselves to a particular risk (e.g., relocating a factory from a region prone to a particular natural disaster to one that is not prone to that disaster).

Answer 35

Implement controls to reduce the probability and impact of the threat/risk materializing.

Answer 36

Engage others in the operations, so multiple parties assume the risk.

Answer 37

Through the purchase of insurance, an organization can transfer risk to another party.

Answer 38

The Payment Card Industry (PCI) has a Data Security Standard (DSS) with penalties for noncompliance by vendors. It is one of the most popular industry standards. If a company utilizes any payment card for any operation, it is a must for the selected service provider to be PCI-DSS compliant.

Answer 39

This congressional act specifies and requires data privacy and protection for medical information

Answer 40

This act extends privacy protections to the internet. Under CCPA, consumers may request and access the personally identifiable information (PII) data stored by companies. Businesses are required to provide a notice to consumers before their data can be sold.

Answer 41

This regulation was adopted during March 2014 to replace European Union (EU) privacy directive 95/46/EC (EU, n.d.). GDPR is one of the toughest privacy and security laws passed by the EU. Its reach extends to any organization collecting and using data related to people within its member countries. Violators of the GDPR face harsh fines.

Answer 42

is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.

Answer 43

is any observable occurrence in a system or network. Events include a user connecting to a file share, a server receiving a request for a webpage, a user sending email, or a firewall blocking a connection attempt. Adverse events have negative consequences, such as system crashes, packet floods, unauthorized use of system privileges, unauthorized access to sensitive data, and execution of malware that destroys data.

Answer 44

handles incidents throughout the organization

Answer 45

may be one of several teams within an organization with responsibility for a particular logical or physical segment of the organization.

Answer 46

is an incident response team that provides advice to other teams without having authority over those teams.

Answer 47

By establishing its incident response capability, an organization is ready to respond to incidents and prevent incidents by ensuring that systems, networks, and applications are sufficiently secure. Although the incident response team is not typically responsible for incident prevention, it is fundamental to the success of incident response programs.

Answer 48

Organizations need to be focused on being prepared to handle incidents that use common attack vectors. Different types of incidents merit different response strategies; knowing and preparing for common attack vectors is very important to success.

Answer 49

With a focus on minimizing the impact of an incident, containment and eradication strategies provide time for developing a tailored remediation plan. An essential part of containment is decision-making (e.g., shutting down a system, disconnecting it from a network, disabling certain functions).

Answer 50

: Learning and improving from an incident improves an organization’s preparedness for the next attack. Documenting lessons learned and plans for future action and response plan updates are important postincident activities.

Answer 51

The first tier of an incident response team often assumes responsibility for intrusion detection. The team generally benefits because it should be poised to analyze incidents more quickly and accurately, based on its knowledge of intrusion detection technologies.

Answer 52

A team may issue advisories regarding new vulnerabilities and threats within the organization. Automated methods should be used whenever appropriate to disseminate information; for example, the National Vulnerability Database (NVD) provides information via XML and RSS feeds when new vulnerabilities are added. Advisories are often necessary when new threats emerge, such as a high-profile social or political event (e.g., a celebrity wedding) that attackers are likely to leverage in their social engineering. Only one group within the organization should distribute computer security advisories to avoid duplicated effort and conflicting information.

Answer 53

Education and awareness are resource multipliers—the more the users and technical staff know about detecting, reporting, and responding to incidents, the less drain there should be on the incident response team. This information can be communicated through many means: workshops, websites, newsletters, posters, and even stickers on monitors and laptops.

Answer 54

Incident response teams often participate in information sharing groups, such as information sharing and analysis centers (ISACs) or regional partnerships. Accordingly, incident response teams often manage the organization’s incident information-sharing efforts, such as aggregating information related to incidents, sharing that information with other organizations, and ensuring that pertinent information is shared within the enterprise.

Answer 55

entails anticipating, defeating, and actively countering emerging cyberthreats using expert insights, innovative approaches/technologies, and investigative practices to protect the confidentiality, integrity, and availability of information and information systems.