Deck Two

Question 1

The interconnection of electronic devices embedded in everyday or specialized objects, enabling them to sense, collect, process, and transmit data. IoT devices include wearable fitness trackers, “smart” appliances, home automation devices, wireless health devices, and cars—among many others.

Answer 1

Internet of Things (IoT)

Question 2

A system or software that monitors and analyzes network or system events for the purpose of finding and providing real-time or near real-time warning of attempts to access system resources in an unauthorized manner. In addition, intrusion prevention systems can also attempt to stop the activity, ideally before it reaches its targets.

Answer 2

Intrusion Detection System/Intrusion Prevention System

Question 3

A computer program that is covertly placed onto a computer or electronic device with the intent to compromise the confidentiality, integrity, or availability of data, applications, or operating systems. Common types of malware include viruses, worms, malicious mobile code, Trojan horses, rootkits, spyware, and some forms of adware.

Answer 3

Malware

Question 4

Authentication using two or more different factors to provide increased security during log-ins. Factors may include: (i) something you know (e.g., password/PIN); (ii) something you have (e.g., cryptographic identification device, token); or (iii) something you are (e.g., biometric).

Answer 4

Multi-factor Authentication/Two-Factor Authentication/Dual Factor Authentication

Question 5

An information system implemented with a collection of interconnected components such as computers, routers, hubs, cabling, and telecommunications controllers.

Answer 5

Network

Question 6

Splitting a network into sub-networks, for example, by creating separate areas on the network which are protected by firewalls configured to reject unnecessary traffic. Network segmentation minimizes the harm of malware and other threats by isolating it to a limited part of the network.

Answer 6

Network Segmentation

Question 7

A widely used, risk-based approach to managing cybersecurity composed of three parts: the Framework Core, the Framework Profile, and the Framework Implementation Tiers. The Cybersecurity Framework includes references to standards, guidelines, and best practices. The Framework is voluntary for private sector use; federal agencies must use this risk management approach.9

Answer 7

NIST Cybersecurity Framework

Question 8

The software “master control application” that runs a computer or electronic device.

Answer 8

Operating System

Question 9

The software “master control application” that runs a computer or electronic device.

Answer 9

Operating System

Question 10

A secret sequence of words or other text used to authenticate a person’s or system’s identity. A passphrase is similar to a password but is generally longer for added security.

Answer 10

Passphrase

Question 11

A secret string of characters (letters, numbers, and other symbols) used to authenticate an identity, to verify access authorization or to derive cryptographic keys.

Answer 11

Passwords

Question 12

A “repair job” for a piece of programming, also known as a “fix.” When a software developer or distributor learns of a security weakness, a patch is the usual immediate solution that is provided to users and can sometimes be downloaded from the software maker’s web site.

Answer 12

Patch

Question 13

Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network. Penetration testing often involves issuing real attacks on real systems and data, using the same tools and techniques used by actual attackers. Most penetration tests involve looking for combinations of vulnerabilities on a single system or multiple systems that can be used to gain more access than could be achieved through a single vulnerability.

Answer 13

Penetration Testing

Question 14

Information which can be used to distinguish or trace the identity of an individual (e.g., name, social security number, biometric records, etc.) alone, or when combined with other personal or identifying information which is linkable to a specific individual (e.g., date and place of birth, mother’s maiden name, etc.).

Answer 14

Personally Identifiable Information (PII)

Question 15

A technique for attempting to acquire sensitive data, such as bank account numbers, or access to a larger computerized system through a fraudulent solicitation in email or on a web site. The perpetrator typically masquerades as a legitimate business or reputable person.

Answer 15

Phishing

Question 16

Physical measures, policies, and procedures to protect an entity’s electronic information systems and related buildings and equipment from natural/environmental hazards and unauthorized intrusion.

Answer 16

Physical Security/Safeguards

Question 17

Digital privacy is more than the security of personal information. It also covers the processing of information about individuals for a business’ operational purposes throughout the information lifecycle (from collection through disposal) and addressing risks that this processing could create for these individuals. These problems could range from embarrassment, discrimination, or loss of autonomy to more tangible harms such as identity theft or physical harm.

Answer 17

Privacy

Question 18

A type of malware that attempts to deny access to a user’s data, usually by encrypting the data with a key known only to the hacker who deployed the malware, until a ransom is paid.10

Answer 18

Ransomware

Question 19

Access to an organization’s information system by a user (or a process acting on behalf of a user) communicating through an external network (e.g., the Internet).

Answer 19

Remote Access

Question 20

The extent to which an entity is threatened by a potential circumstance or event. Risk typically is a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Information system-related security risks arise from the loss of confidentiality, integrity, or availability of information or information systems. These risks reflect the potential adverse impacts to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation.

Answer 20

Risk

Question 21

The program and supporting processes to manage information security risk to organizational operations (including mission, functions, image, reputation), organizational assets, individuals, other organizations, and the Nation. Risk management includes: (i) establishing the context for risk-related activities; (ii) assessing risk; (iii) responding to risk once determined; and (iv) monitoring risk over time.

Answer 21

Risk Management

Question 22

Router
A device that allows communication between different networks. Routers determine the best path for forwarding data to its destination.

Question 23

Forms of electronic communications, including websites and applications, that enable users to create and share content or to participate in social networking.

Answer 23

Social Media

Question 24

Electronic junk mail or the abuse of electronic messaging systems to indiscriminately send unsolicited bulk messages.

Answer 24

Spam

Question 25

A highly targeted phishing attack, usually to a specific individual or department within an organization.

Answer 25

Spear phishing

Question 26

Software that is secretly or surreptitiously installed into an information system to gather information on individuals or organizations without their knowledge.

Answer 26

Spyware

Question 27

A security exploit in which scammers call, place alarming pop-up messages on a computer, offer free “security” scans, or set up fake websites to convince someone that his/her computer is infected or has a problem. The scammers then ask to be paid to fix the non-existent problem.11

Answer 27

Tech Support Scams

Question 28

Any circumstance or event with the potential to adversely impact organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service.

Answer 28

Threat

Question 29

Type of standard cable, connector, or protocol for connecting computers, electronic devices, and power sources.

Answer 29

USB

Question 30

A computer program that can copy itself and infect a computer without permission or knowledge of the user. A virus might corrupt or delete data on a computer, use e-mail programs to spread itself to other computers, or even erase everything on a hard disk.

Answer 30

Viruses

Question 31

Virtual network built on top of existing networks that can provide a secure communications mechanism for data and Internet Protocol (IP) information transmitted via the virtual network.

Answer 31

Virtual Private Network (VPN)

Question 32

A weakness in a system, application, or network that is subject to exploitation or misuse.

Answer 32

Vulnerability

Question 33

A security exploit where the attacker infects websites that are frequently visited by members of the group being attacked, with a goal of infecting a computer used by one of the targeted group when they visit the infected website.

Answer 33

Watering Hole Attack

Question 34

An approved list or register of entities provided a particular privilege, service, mobility, access, or recognition.

Answer 34

Whitelist

Question 35

Overwriting media (like a hard drive) or portions of media to hinder reconstruction of the data.

Answer 35

Wiping

Question 36

A generic term that refers to a wireless local area network that follows the IEEE 802.11 protocol. Wireless capabilities allow computers, smartphones, or other devices to connect to the Internet or communicate with one another wirelessly within a particular area.

Answer 36

Wireless (WiFi)