Chapter 7: Security Flashcards
Managers must understand that breaches occur to?
- Clarify the picture of what is going on
- To understand their organization’s vulnerabilities,
- To protect their own company from damages caused by successful cyberattacks
What are the five (5) key steps to a successful and holistic cybersecurity program?
- Identify
- Protect
- Detect
- Respond
- Recover
An organizations ability to understand and manage cybersecurity risks.
Identify
Activities that safeguard critical infrastructure services
Protect
Activities to identify the occurrence of a cybersecurity event
Detect
Activities to take action regarding a detected cybersecurity incident
Respond
Activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident
Recover
What are the Five (5) Key Information Security Decisions?
- Strategy
- Infrastructure
- Policy
- Culture
- Investments
An information security decision that is based on such IT principles as protecting the confidentiality of customer information, strict compliance with regulations, and maintaining a security baseline that is above the industry benchmark.
Information security strategy
involve selecting and configuring the right tools to achieve consistency in protection, economies of scale, and synergy among the components.
Information security infrastructure
guidelines for the organization’s activities, both technical and organizational, to increase cyber resilience.
Information security policy
Cybersecurity behaviors that are important to the success of the business
Cybersecurity culture
applying the basic system updates and patches offered from the vendors of systems
cybersecurity hygiene
decisions about the appropriate level of investment must be made jointly with the security expertise of the IT security managers and with the business priorities expertise of the business managers
Information security investments
occur when unauthorized actors gain access to systems, passwords, data, or other assets.
Breach
sends a person a counterfeit e‐mail that purports to be from a known entity
phishing attack
targeted attack, mimic a situation or relationship highly familiar to the targeted user
spear phishing
Software that tracks keystrokes and stores them for hackers to inspect later
key logger
Wi‐Fi connection and that all incoming and outgoing Internet traffic becomes routed through the perpetrator’s system
evil twin connection
Traps that appear to lead users to their goal, but in reality, they lead to a fraudulent site that requires a log‐in
cross‐site scripting (XSS)
What are the 7 common security Access Tools
1.Physical Locks
2.Passwords
3.Biometrics
4.Challenge Questions
5. Token
6. Text Message
7. Multi-factor Authentication
What are the 7 common storage and transmission security tools
- Antivirus/Antispyware
- Firewall
- System Logs
- System Alerts
- Encryption
- WEP/WPA
- VPN
Emphasizes security importance and instructs users on what they need to do to achieve safety
Security Policy
What are the 7 Commonly used security Policies
- Security updates
- Networks
- Passwords
- Mobile Devices
- Data Disposal
- Social Media
- Security services
Are hired to try to break into systems in an effort to help the client firm uncover weaknesses
white hat hackers.
Individuals who break in to systems for their own gain or to wreak havoc on a firm
Black Hat Hackers
test organizational systems without any authorization and notify a company when they find a weakness
Grey Hat Hackers
SETA stands for what?
Security Education Training and Awareness
WHat are the four (4) major areas for Education and Training
- Access Tools (Passwords/MFA Rules & How-to)
- BYOD (Rules and How-to)
- Social Media (Rules and Scenarios)
- Vigilance (Scenarios and How-to)
Security breach in which a hacker counterfeits an Internet address
Spoofing
The concept of having multiple layers of different security policies and practices so when one layer fails to stop a perpetrator, another layer might be more effective.
Defense in Depth
WHat are the 3 typical components of a Defense in Depth Plan (PTA)
- Physical Barriers
- Technical Barriers
- Administrative Barriers
