Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIMA - P3 > 8. Cybersecurity Risk > Flashcards

8. Cybersecurity Risk Flashcards

1
Q

What is cybersecurity?

A

The technology, processes and measures that are designed to protect an organisation against an attack on its electronic information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the 4 main challenges of cybersecurity to risk managers?

A
  1. Reliance on technology
  2. Availability of technology
  3. Inevitability of bugs
  4. Rapid evolution and lack of understanding
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the 3 categories of information that a business may hold?

A
  1. Personal
  2. Business
  3. Classified
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is business information?

A

Anything that may cause risk to the company if discovered by a third party, such as a competitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is classified information?

A

That which could cause harm to public safety or security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 4 objectives of cybersecurity?

A
  1. Availability
  2. Confidentiality
  3. Integrity of data
  4. Integrity of processing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What 3 things do cybersecurity objectives need in order to be implemented effectively?

A
  1. Sufficient budget and resource
  2. Communicated clearly
  3. Key stakeholder support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the 3 categories of factors which influence cybersecurity risk?

A
  1. Technologies
  2. Organisational factors
  3. Organisational change
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What factors fall under the technologies category of influencers to cybersecurity risk?

A
  1. Outsourcing of IT services (cloud)
  2. Mobile devices
  3. Network structure
  4. Service providers/hosts
  5. Software applications
  6. Obsolete systems
  7. Dependence on emerging tech
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What factors fall under the organisational category of influencers to cybersecurity risk?

A
  1. Structure/size of IT department
  2. Types of user groups
  3. Geographic location (+ legal)
  4. Organisational structure
  5. Cybersecurity responsibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What factors fall under the organisational change category of influencers to cybersecurity risk?

A
  1. Have products or services changed?
  2. Any legislative change?
  3. Any change to org structure or departmental responsibilities?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is malware?

A

Software which is specifically designed to disrupt or gain unauthorised access to a computer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a virus?

A

A user opens or runs a host file which releases the virus, which then infects the users files and can restrict access or damage information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a worm?

A

Like a virus, but does not require the host to open a file

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a Trojan?

A

Malware that masquerades as real software but infects the computer when launched

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Spyware?

A

Malware that enables the originator to spy on the user’s activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Malversiting?

A

An online advert which has malware written into the code, either directing to a site where malware can be installed or directly infecting the computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are Botnets?

A

A network of private computers infected with malware and controlled by an agent without the knowledge of the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Ransomware?

A

Encrypting the users data and demanding payment for it’s release

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is polymorphic malware?

A

Malware which avoids being detected by constantly changing its features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the ‘ultimate’ line of attack against malware?

A

Antivirus software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are application attacks?

A

Attacks that target websites to alter their functionality and presentation, or extract sensitive information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the 4 types of application attack?

A

1.Bot attack
2. Distributed Denial of Service
3. Cross Site Scripting
4. SQL injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a bot attack?

A

Web robots that are used maliciously, e.g. to send spam email addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the 3 methods of defence against a bot attack?

A
  1. Maintain antibot software
  2. Evaluate who is accessing systems and where from
  3. Look out for sudden spikes or repeated login failures
26
Q

What is a DDoS attack?

A

A distributed denial of service attack - overwhelms a web application with so much traffic that it crashes

27
Q

What is a buffer overflow attack?

A

A DDoS attack which starts to overwrite existing data

28
Q

What are the 2 methods of defence against a DDoS attack?

A
  1. Install a firewall
  2. Invest in DDoS hardware and software to filter traffic
29
Q

What is Cross Site Scripting?

A

The attacker reprograms buttons on a website and redirects users to another site, disrupting traffic but also sometimes extracting sensitive information

30
Q

How do you protect from Cross Site Scripting?

A

Ensure changes to script are only allowed from authorised sources

31
Q

What is an SQL injection?

A

The attacker submits malicious software code into the organisations database by typing code into data input fields, which corrupts the data

32
Q

How do you protect from SQL injections?

A

Input fields are locked by data type and character length

33
Q

What is a hacker?

A

A skilled computer programmer who circumvents and organisations security systems to access sensitive information

34
Q

What is an ethical hacker?

A

Hackers that break into an organisations systems in order to test the level of security, with prior knowledge and consent

35
Q

What is social engineering?

A

Influencing people to do something that would not normally do

36
Q

What are the 6 principles of persuasion?

A
  1. Reciprocity
  2. Scarcity
  3. Authority
  4. Consistency
  5. Liking
  6. Consensus
37
Q

What is phishing?

A

Using fradulent messages to steal sensitive information such as passwords, or install malware

38
Q

What is Spear phishing?

A

Targeting a specific user

39
Q

What is domain fraud?

A

A phishing email that imitates genuine domains but takes to a fraudulent page

40
Q

What are the 5 types of cost of a security breach?

A
  1. Paying ransom demands
  2. Legal claims
  3. Diversion of resource
  4. Loss of revenue
  5. Increased regulations
41
Q

What 3 risks does the increased use of social media increase?

A
  1. Identity fraud
  2. Damage to reputation
  3. Trolling
42
Q

What are the 5 opportunities to organisations through social media?

A
  1. Advertising
  2. Brand development
  3. Big data analytics
  4. Communication
  5. Real time information gathering
43
Q

What are the 6 main risks brought to organisations by social media?

A
  1. Human error (clicking on viruses)
  2. Productivity
  3. Data protection
  4. Hacking
  5. Reputation
  6. Inactivity
44
Q

What are the 6 main risks brought to individuals by social media?

A
  1. Going viral
  2. Employment issues
  3. Legal sanction
  4. Physical theft
  5. Identify fraud
  6. Permanence
45
Q

What 3 things must a cybersecurity policy do?

A
  1. Protect from cyberattack
  2. Detect attacks
  3. Respond promptly
46
Q

What do certificates particularly help protect against?

A

Man in the Middle attacks (3rd party between two sides and passing information)

47
Q

What are the 5 main aims of a Computer Incident Response Team?

A
  1. Minimise losses
  2. Restore normal operations
  3. Assist with investigations
  4. Provide data to support planned responses
  5. Assist with communications
48
Q

What is applied cyber security?

A

Being aware of risks and how they can be defended against

49
Q

What does network segmentation do?

A

Provide strong control over who can access what

50
Q

What are the 2 types of firewall?

A
  1. Network firewal (limit access to system)
  2. Application firewall (filters out damaging content)
51
Q

What are the 6 elements of applied cybersecurity?

A
  1. Device defences
  2. Device software updates
  3. BYOD limitations
  4. Network configuration management
  5. Firewalls
  6. Antivirus and endpoint security
52
Q

What are the 5 methods for communicating cybersecurity measures to staff?

A
  1. Training programmes
  2. Policy and procedures manual
  3. Job descriptions
  4. Code of conduct
  5. Promotion of whistle blower hotline
53
Q

What are the 5 methods of IT protection available to organisations?

A
  1. Policies and procedures
  2. Software updates
  3. Specialist software e.g. firewalls
  4. Configuration controls
  5. Application controls
54
Q

What risk does ISO27001 address?

A

IT security risk

55
Q

What are the 5 stages of the ISO27001 risk assessment?

A
  1. Establish a risk assessment framework
  2. Identify risks
  3. Analyse risks (impact/likelihood)
  4. Evaluate risks (vs appetite)
  5. Select risk management option
56
Q

What 3 things should an organisation do in systems monitoring?

A
  1. Detect attacks
  2. React to attacks
  3. Account for activity
57
Q

What are the 7 steps in the systems monitoring process?

A
  1. Establish a strategy
  2. Monitor all systems
  3. Monitor network for unusual activity
  4. Monitor users for unauthorised activity
  5. Establish centralised collection
  6. Ensure policies and procedures in place
  7. Conduct a lessons learned review
58
Q

What is business continuity planning?

A

A proactive approach that allows the organisation to continue to operate while the cybersecurity threat is resolved

59
Q

What is disaster recovery planning?

A

A reactive approach that focuses solely on taking action to restore the organisation to it’s original position

60
Q

What are the 4 types of back ups in BCP/BRP?

A
  1. Mirror site
  2. Hot back up site
  3. Warm back up site
  4. Cold back up site

CIMA - P3 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions