2.0 Threats, Vulnerabilities, and Mitigations Flashcards
What distinguishes a nation-state threat actor from an organized crime group?
Nation-state actors are typically government-sponsored with political motives, while organized crime groups focus on financial gain.
How can shadow IT pose a risk to an organization?
Shadow IT can introduce vulnerabilities by bypassing official security protocols.
What is a common motivation for hacktivists?
Promoting political or ideological beliefs through cyber activities.
Why is it important to consider both internal and external threat actors?
Internal actors have legitimate access that can be exploited, while external actors may use different attack vectors.
What mitigation strategy can help prevent insider threats?
Implementing strict access controls and monitoring user activity.
How does data exfiltration differ from espionage?
Data exfiltration focuses on stealing data for any purpose, while espionage specifically involves gathering intelligence.
What role does encryption play in mitigating threats?
Encryption protects data integrity and confidentiality against unauthorized access.
How can an organization detect potential insider threats?
By monitoring unusual behavior patterns and access logs.
What is a key characteristic of an unskilled attacker?
Limited technical skills relying on pre-made hacking tools.
Why might a nation-state engage in cyber warfare?
To disrupt another nation’s infrastructure or gather intelligence.
How can service disruption be a motivation for attackers?
To damage a competitor’s reputation or operations.
What is a common misconception about hacktivists?
That they lack technical skills; many are highly skilled in exploiting vulnerabilities.
How does financial gain motivate organized crime in cyber activities?
By conducting fraud, theft, or extortion online for profit.
What is an effective way to mitigate risks from shadow IT?
Enforcing strict IT governance policies and regular audits.
How does ethical hacking differ from other forms of hacking?
It is authorized and aims to improve security by identifying vulnerabilities.
How do philosophical beliefs motivate certain threat actors?
They may conduct attacks to support causes they believe in strongly.
What can be a direct consequence of ignoring insider threats?
Loss of sensitive data due to unauthorized access by trusted individuals.
Why is continuous monitoring important in cybersecurity?
To detect and respond promptly to emerging threats or attacks.
What distinguishes revenge-motivated attacks from other types?
They are personal and aim at causing harm due to perceived grievances.
How can organizations prepare for potential cyber warfare scenarios?
By strengthening defenses and collaborating with government agencies for intelligence sharing.
What type of attack involves sending fraudulent emails designed to trick recipients into revealing personal information?
Phishing
Which threat vector involves hiding malicious code within an image file?
Image-based attack
What is the term for registering domain names similar to legitimate ones in hopes of catching users who mistype URLs?
Typosquatting
How does vishing differ from phishing?
Vishing uses voice calls, while phishing typically uses email.
What is the risk associated with using default credentials on devices?
Attackers can easily guess default credentials, gaining unauthorized access.
What type of attack targets frequently visited websites by specific groups?
Watering hole attack
What is smishing?
SMS-based phishing attack
Why are unsupported systems considered high-risk?
They no longer receive security updates, leaving known vulnerabilities unpatched.
