Chapter 1 & 2 Todays Security Professional & CyberSecurity Threat Landscape

Question 1

1. What is the CIA triad of cybersecurity?
   2a. What is C**?
   2b. What is I?
   2c. What is A**?
2. What data obfuscation method is used above?

Answer 1

1. Confidentiality, Integrity, and Availability
   2a. Ensures unauthorized users cannot access information
   2b. Ensures there are no unauthorized modifications to data or systems
   2c. Ensures that info and systems are ready to meet the needs of users when requested.
2. Masking

Question 2

1. What is the DAD Triad?

Answer 2

1. Disclosure, Alteration, Denial

Question 3

What differentiates Strategic vs. Operational Risk?

Answer 3

If a risk threatens the very existence of an organization and its ability to execute business plans, that is a strategic risk, which seriously jeopardizes the organizations ongoing viability. If a risk only causes inefficiency and delay within the organization, that is operational.

Strategic Risk - risk that an organization will become less effective in meeting its major goals and objectives as a result of a breach.
Operational Risk - risk to an organizations ability to carry out day to day functions.

Question 4

Breach Impact: other risks

Answer 4

Financial Risk
Reputational Risk
Compliance Risk

Question 5

Security Controls

Answer 5

Technical Controls - enforce CIA in digital space. ex. firewall rules, ACLs, IPSs, Encryption.
Operational Controls - processes put in place to manage technology, access reviews, log monitoring, vulnerability management.
Managerial Controls - procedural mechanisms that focus on mechanics of risk management, periodic risk assessments, security planning exercises, security practice incorporation.

Question 6

Security Control Types

Answer 6

Preventative Controls - Firewalls and encryption
Detective Controls - Intrusion Detection (IDS)
Corrective Controls - Restoring backups after ransomware attack
Deterrent Controls - Guard dogs, barbed wire fences, etc.
Physical Controls - fences, lighting, locks, fire suppression/burglar alarms
Compensating Controls - designed to mitigate risk

Question 7

PCI DSS Compensating Controls Criteria:

Answer 7

Control must meet intent and rigor of OEM requirement
Control must provide similar defense as OEM requirement
Control must be “above and beyond” other PCI DSS requirements