Chapter 1

Question 1

Assets

Answer 1

Hardware, software, data

Question 2

Vulnerability

Answer 2

A weakness in the system that allows harm to occur

Question 3

Threat

Answer 3

A set of circumstances that has the potential to cause loss or harm

Question 4

Controls

Answer 4

Prevents threats from exercising vulnerabilities. Also known as a countermeasure. Examples are action, device, procedure or technique

Question 5

CIA/security triad

Answer 5

Availability - only used by authorised parties
Integrity - only modified by authorised parties
Confidentiality - only viewed by authorised parties

Additionally:
authentication - the ability of the system to confirm the identity of the sender
non-repudiation/accountability - to confirm that the sender cannot deny having sent something

Question 6

Harm

Answer 6

Interception
Interruption
Modification
Fabrication

Question 7

Failure of confidentiality

Answer 7

Unauthorised access to data by a person or program
Unauthorised access to an approximate data value
Unauthorised learning of the existence of data

Question 8

Subject

Answer 8

Who

Question 9

Object

Answer 9

What

Question 10

Mode of access

Answer 10

How

Question 11

Policy

Answer 11

who+what+how = yes/no

Question 12

Preservation of integrity

Answer 12

precise
accurate
unmodified
modified (correct way, authorised people, authorised process)
consistent
internally consistent
meaningful and usable

Question 13

3 aspects of integrity

Answer 13

authorised actions, separation and protection of resources
error detection
correction

Question 14

Availability

Answer 14

Applies to data and services. Definition:
Timely response to requests
Fair resource allocation
Concurrency is controlled
Fault tolerant
The service/system can be easily used

Question 15

Advanced persistent threat

Answer 15

Organised, financed and patient assailants

Question 16

3 factors for ensuring success by a malicious hacker

Answer 16

Method - skills, knowledge, tools
Opportunity - time and access
Motive - money, fame, politics, terror

Question 17

Attack surface

Answer 17

A systems full set of vulnerabilities

Question 18

Dealing with harm (controls)

Answer 18

prevent
deter
deflect
mitigate
detect
recover

Question 19

Different types of controls

Answer 19

Physical - locks, guards, sprinklers
Procedural - agreement/command for how to act: laws, policies, procedures, guidelines, patents & copyrights, contracts & agreements
Technical - counter with technology: passwords, access controls, network protocols, firewalls, encryption, network traffic flow regulators

Question 20

Overlapping controls

Answer 20

Defense in depth - more than one control or more than one class of control to achieve protection