Domain 1. Chapter 2

Question 1

1. Personnel Security
2. Risk Management Concepts
3. Social Engineering
4. Establish and Maintain a Security Awareness, Education, and Training Program

Question 2

1. Personnel Security
   1.1Candidate Screening and Hiring
   1) creating a job description or position description
   2) setting a classification for the job
   3) screening employment candidates
   4) hiring
   5) training
   Job roles typically align to a rank or level of privilege, whereas job descriptions map to specifically assigned responsibilities and tasks.
   Job responsibilities are the specific work tasks an employee is required to perform on a regular basis.
   Employment candidate screening for a specific position is based on the sensitivity and classification defined by the job description.
   Background checks include obtaining a candidate’s work and educational history; checking references; verifying education; interviewing colleagues; checking police and government records for arrests or illegal activities; verifying identity through fingerprints, driver’s license, and/or birth certificate; and holding a personal interview.

Question 3

1.2 Onboarding: Employment Agreements and Policies
Onboarding is the process of adding new employees to the organization, having them review and sign employment agreements and policies, be introduced to managers and coworkers, and be trained in employee operations and logistics.
The principle of least privilege states that users should be granted the minimum amount of access necessary for them to complete their required work tasks or job responsibilities.
When a new employee is hired, they should sign an employment agreement. Such a document outlines the rules and restrictions of the organization, the security policy, details of the job description, violations and consequences, and the minimum or probationary length of time the position is to be filled by the employee. These items might be separate documents, such as an acceptable use policy (AUP).
Nondisclosure agreement (NDA). An NDA is used to protect the confidential information within an organization from being disclosed by a current or former employee

Question 4

1.3 Employee Oversight
Managers should regularly review or audit the job descriptions, work tasks, privileges, and responsibilities for every staff member.
Reviewing and then adjusting user capabilities to realign with the principle of least privilege is a risk reduction strategy.
Mandatory vacations are used as a peer review process. A worker to be away from the office and without remote access for one to two weeks per year. A different worker performs their work duties. He/she detect abuse, fraud, or negligence on the part of the original employee.
Other user and worker management and evaluation techniques include separation of duties, job rotation, and cross-training.
User behavior analytics (UBA) and user and entity behavior analytics (UEBA).

Question 5

1.4 Offboarding, Transfers, and Termination Processes
Offboarding is the removal of an employee’s identity from the IAM system once that person has left the organization.
Employee transfers into a new job position.
1)Remove or disable the employee’s user account at the same time as or just before they are notified of being terminated.
2) Make sure the employee returns any organizational equipment or supplies from their vehicle or home.
3) Arrange for a member of the security department to accompany the released employee while they gather their personal belongings from the work area.
4) Inform all security personnel and anyone else who watches or monitors any entrance point to ensure that the ex-employee does not attempt to reenter the building without an escort.
5) An exit interview. Restrictions placed on the former employee based on the employment agreement, NDAs, and any other security-related documentation.

Question 6

1.5 Vendor, Consultant, and Contractor Agreements and Controls
- Multiparty risk exists when several entities or organizations are involved in a project. The risk or threats are often due to the variations of objectives, expectations, timelines, budgets, and security priorities of those involved.

Using service-level agreements (SLAs) is a means to ensure that organizations providing services maintain an appropriate level of service agreed on by both the service provider, vendor, or contractor and the customer organization.
- Outsourcing is the term often used to describe the use of an external third party, such as a vendor, consultant, or contractor, rather than performing the task or operation in-house. Outsourcing can be used as a risk response option known as transference or assignment
- Vendor management system (VMS). A VMS is a software solution that assists with the management and procurement of staffing services, hardware, software, and other needed products and services.

Question 7

1.6 Compliance Policy Requirements
Compliance is the act of conforming to or adhering to rules, policies, regulations, standards, or requirements. Compliance is an important concern of security governance.
Compliance is a form of administrative or managerial security control because it focuses on policies and people abiding by those policies (as well as whether the IT and physical elements of the organization comply with policies).

Question 8

1.7 Privacy Policy Requirements
Definitions of privacy:
- Active prevention of unauthorized access to information that is personally identifiable (that is, data points that can be linked directly to a person or organization), known as personally identifiable information (PII)
- Freedom from unauthorized access to information deemed personal or confidential
- Freedom from being observed, monitored, or examined without consent or knowledge.

The Health Insurance Portability and Accountability Act (HIPAA)
The Sarbanes–Oxley Act of 2002 (SOX),
The Family Educational Rights and Privacy Act (FERPA),
The Gramm–Leach–Bliley Act
Union’s General Data Protection Regulation (GDPR) (Regulation [EU] 2016/679)

Question 9

2. Risk Management Concepts
   2.1
   Risk management is a detailed process of identifying factors that could damage or disclose assets, evaluating those factors in light of asset value and countermeasure cost, and implementing cost-effective solutions for mitigating or reducing risk.
   The primary goal of risk management is to reduce risk to an acceptable level.
   Risk management is composed of two primary elements: risk assessment and risk response.
   - Risk assessment or risk analysis is the examination of an environment for risks, evaluating each threat event as to its likelihood of occurring and the severity of the damage it would cause if it did occur, and assessing the cost of various countermeasures for each risk.
   - Risk response involves evaluating countermeasures, safeguards, and security controls using a cost/benefit analysis; adjusting findings based on other conditions, concerns, priorities, and resources; and providing a proposal of response options in a report to senior management.
   Risk awareness is the effort to increase the knowledge of risks within an organization.

Question 10

2.2 Risk Terminology and Concepts
- An asset is anything used in a business process or task. If an organization relies on a person, place, or thing, whether tangible or intangible, then it is an asset.
- Asset valuation is value assigned to an asset based on a number of factors, including importance to the organization, use in critical process, actual cost, and nonmonetary expenses/costs (such as time, attention, productivity, and research and development). (AV)
- Threats - any potential occurrence that may cause an undesirable or unwanted outcome for an organization or for a specific asset
- Threat agents or threat actors intentionally exploit vulnerabilities. Threat agents are usually people, but they could also be programs, hardware, or systems.
- Threat events are accidental occurrences and intentional exploitations of vulnerabilities.
- A threat vector or attack vector is the path or means by which an attack or attacker can gain access to a target in order to cause harm.
- Vulnerability The weakness in an asset or the absence or the weakness of a safeguard or countermeasure is a vulnerability.
- Exposure is being susceptible to asset loss because of a threat; there is the possibility that a vulnerability can or will be exploited by a threat agent or event. (exposure factor (EF)
- Risk is the possibility or likelihood that a threat will exploit a vulnerability to cause harm to an asset and the severity of damage that could result. risk = threat * vulnerability. OR risk = probability of harm * severity of harm
- Safeguards A safeguard, security control, protection mechanism, or countermeasure is anything that removes or reduces a vulnerability or protects against one or more specific threats. This concept is also known as a risk response.
- An attack is the intentional attempted exploitation of a vulnerability by a threat agent to cause damage, loss, or disclosure of assets.
- A breach, intrusion, or penetration is the occurrence of a security mechanism being bypassed or thwarted by a threat agent. A breach is a successful attack.

Question 11

2.3 Asset Valuation
An asset-based or asset-initiated risk analysis starts with inventorying all organizational assets.
The goal of asset valuation is to assign to an asset a specific dollar value that encompasses tangible costs as well as intangible ones.
Assigning or determining the value of assets to an organization can fulfill numerous requirements by
- Serving as the foundation for performing a cost/benefit analysis of asset protection when performing safeguard selection
- Serving as a means for evaluating the cost-effectiveness of safeguards and countermeasures
- Providing values for insurance purposes and establishing an overall net worth or net value for the organization
- Helping senior management understand exactly what is at risk within the organization
- Preventing negligence of due care/due diligence and encouraging compliance with legal requirements, industry regulations, and internal security policies

Question 12

2.4 Identify Threats and Vulnerabilities
An essential part of risk management is identifying and examining threats. This involves creating an exhaustive list of all possible threats for the organization’s identified assets. The list should include threat agents as well as threat events.
National Institute of Standards and Technology (NIST) Special Publication (SP) 800-30r1 Appendix D, “Threat sources,” and Appendix E, “Threat events.”

But even risk management consultants do not perform risk assessment and analysis on paper only; they typically employ risk assessment software. This software streamlines the overall task, provides more reliable results, and produces standardized reports that are acceptable to insurance companies, boards of directors, and so on.

Question 13

2.5 Risk Assessment/Analysis
Risk management is primarily the responsibility of upper management. However, upper management typically assigns the actual task of risk analyses and risk response modeling to a team from the IT and security departments.
- Quantitative risk analysis assigns real dollar figures to the loss of an asset and is based on mathematical calculations. - Qualitative risk analysis assigns subjective and intangible values to the loss of an asset and takes into account perspectives, feelings, intuition, preferences, ideas, and gut reactions.
- The method of combining quantitative and qualitative analysis into a final assessment of organizational risk is known as hybrid assessment or hybrid analysis.

Question 14

2.6 Qualitative Risk Analysis
Qualitative risk analysis is more scenario based than it is calculator based.
You can use many techniques to perform qualitative risk analysis:
- Brainstorming
- Storyboarding
- Focus groups
- Surveys
- Questionnaires
- Checklists
- One-on-one meetings
- Interviews
- Scenarios
- Delphi technique

Question 15

2.6.1 Scenarios
The basic process for all these mechanisms involves the creation of scenarios. A scenario is a written description of a single major threat. The description focuses on how a threat would be instigated and what effects its occurrence could have on the organization, the IT infrastructure, and specific assets.
For each scenario, several safeguards are described that would completely or partially protect against the major threat discussed in the scenario. The analysis participants then assign to the scenario a threat level, a loss potential, and the advantages of each safeguard. These assignments can be simple—such as High, Medium, and Low, or a basic number scale of 1 to 10—or they can be detailed essay responses.

Question 16

2.6.2 Delphi Technique
The Delphi technique is simply an anonymous feedback-and-response process used to enable a group to reach an anonymous consensus.

Question 17

2.7 Quantitative Risk Analysis
The quantitative method results in concrete probability indications or a numeric indication of relative risk potential.
The process of quantitative risk analysis starts with asset valuation and threat identification (which can be performed in any order). This results in asset-threat pairings that need to have estimations of harm potential/severity and frequency/likelihood assigned or determined.
The major steps or phases in quantitative risk analysis are as follows:
1)Inventory assets, and assign a value (asset value [AV]).
2)Research each asset, and produce a list of all possible threats to each individual asset. This results in asset-threat pairings.
3)For each asset-threat pairing, calculate the exposure factor (EF).
4)Calculate the single loss expectancy (SLE) for each asset-threat pairing.
5)Perform a threat analysis to calculate the likelihood of each threat being realized within a single year—that is, the annualized rate of occurrence (ARO).
6)Derive the overall loss potential per threat by calculating the annualized loss expectancy (ALE).
7)Research countermeasures for each threat, and then calculate the changes to ARO, EF, and ALE based on an applied countermeasure.
8)Perform a cost/benefit analysis of each countermeasure for each threat for each asset. Select the most appropriate response to each threat.

Question 18

2.7 Quantitative Risk Analysis
The cost functions associated with quantitative risk analysis include the following:
- Exposure Factor The exposure factor (EF) represents the percentage of loss that an organization would experience if a specific asset were violated by a realized risk.
- The single-loss expectancy (SLE) is the potential loss associated with a single realized threat against a specific asset. The SLE is calculated using the following formula:
SLE = asset value (AV) * exposure factor (EF)
or more simply:
SLE = AV * EF
- The annualized rate of occurrence (ARO) is the expected frequency with which a specific threat or risk will occur (that is, become realized) within a single year.
- The annualized loss expectancy (ALE) is the possible yearly loss of all instances of a specific realized threat against a specific asset.
ALE = single loss expectancy (SLE) * annualized rate of occurrence (ARO)
or
ALE = asset value (AV) * exposure factor (EF) * annualized rate of occurrence (ARO)
or more simply:
ALE = SLE * ARO
or
ALE = AV * EF * ARO

The task of calculating EF, SLE, ARO, and ALE for every asset and every threat/risk is a daunting one.

Question 19

2.8 Risk Responses
There are several possible responses to risk:
- Mitigation or reduction - , is the implementation of safeguards, security controls, and countermeasures to reduce and/or eliminate vulnerabilities or block threats.
-Assignment or transfer - is the placement of the responsibility of loss due to a risk onto another entity or organization.
- Deterrence - is the process of implementing deterrents to would-be violators of security and policy. The goal is to convince a threat agent not to attack.
- Avoidance - is the process of selecting alternate options or activities that have less associated risk than the default, common, expedient, or cheap option.
- Acceptance - is the result after a cost/benefit analysis shows countermeasure costs would outweigh the possible cost of loss due to a risk. It also means that management has agreed to accept the consequences and the loss if the risk is realized.
- Reject or ignore. Denying that a risk exists and hoping that it will never be realized are not valid or prudent due care/due diligence responses to risk.

Question 20

2.8 Risk Responses
Risk appetite is the total amount of risk that an organization is willing to shoulder in aggregate across all assets.
Risk capacity is the level of risk an organization is able to shoulder.
An organization’s desired risk appetite may be greater than its actual capacity.
Risk tolerance is the amount or level of risk that an organization will accept per individual asset-threat pair.
This is often related to a risk target, which is the preferred level of risk for a specific asset-threat pairing.
A risk limit is the maximum level of risk above the risk target that will be tolerated before further risk management actions are taken.

Question 21

2.8 Risk Responses
Inherent risk is the level of natural, native, or default risk that exists in an environment, system, or product prior to any risk management efforts being performed.

Once safeguards, security controls, and countermeasures are implemented, the risk that remains is known as residual risk.

Total risk is the amount of risk an organization would face if no safeguards were implemented. A conceptual formula for total risk is as follows:
threats * vulnerabilities * asset value = total risk

The controls gap is the amount of risk that is reduced by implementing safeguards. A conceptual formula for residual risk is as follows:
total risk – controls gap = residual risk

Question 22

2.9 Cost vs. Benefit of Security Controls
Annual cost of the safeguard (ACS). Several common factors affect ACS:
- Cost of purchase, development, and licensing
- Cost of implementation and customization
- Cost of annual operation, maintenance, administration, and so on
- Cost of annual repairs and upgrades
- Productivity improvement or loss
- Changes to environment
- Cost of testing and evaluation

The final computation in this process is the cost/benefit calculation, or cost/benefit analysis.
[ALE pre-safeguard – ALE post-safeguard] – annual cost of safeguard (ACS) = value of the safeguard to the company

In review, to perform the cost/benefit analysis of a safeguard, you must calculate the following three elements:

The pre-safeguard ALE for an asset-threat pairing
The potential post-safeguard ALE for an asset-threat pairing
The ACS (annual cost of the safeguard)
With those elements, you can finally obtain a value for the cost/benefit formula for this specific safeguard against a specific risk against a specific asset:

(pre-safeguard ALE – post-safeguard ALE) – ACS
or, even more simply:

(ALE1 – ALE2) – ACS

Question 23

2.10 Countermeasure Selection and Implementation
However, you should consider several other factors when assessing the value or pertinence of a security control:

The cost of the countermeasure should be less than the value of the asset.
The cost of the countermeasure should be less than the benefit of the countermeasure.
The result of the applied countermeasure should make the cost of an attack greater for the perpetrator than the derived benefit from an attack.
The countermeasure should provide a solution to a real and identified problem. (Don’t install countermeasures just because they are available, are advertised, or sound appealing.)
The benefit of the countermeasure should not be dependent on its secrecy. Any viable countermeasure can withstand public disclosure and scrutiny and thus maintain protection even when known.
The benefit of the countermeasure should be testable and verifiable.
The countermeasure should provide consistent and uniform protection across all users, systems, protocols, and so on.
The countermeasure should have few or no dependencies to reduce cascade failures.
The countermeasure should require minimal human intervention after initial deployment and configuration.
The countermeasure should be tamperproof.
The countermeasure should have overrides accessible to privileged operators only.
The countermeasure should provide fail-safe and/or fail-secure options.

Question 24

2.10 Countermeasure Selection and Implementation Security controls, countermeasures, and safeguards can be implemented administratively, logically/technically, or physically.
The category of administrative controls are the policies and procedures defined by an organization’s security policy and other regulations or requirements. They are sometimes referred to as management controls, managerial controls, or procedural controls.
The category of technical controls or logical controls involves the hardware or software mechanisms used to manage access and provide protection for IT resources and systems.
Physical controls are security mechanisms focused on providing protection to the facility and real-world objects.

Question 25

2.11 Applicable Types of Controls
- A preventive control (aka preventative control) is deployed to thwart or stop unwanted or unauthorized activity from occurring. Examples of preventive controls include fences, locks, authentication, access control vestibules, alarm systems, separation of duties, job rotation, data loss prevention (DLP), penetration testing, access control methods, encryption, auditing, security policies, security-awareness training, antimalware software, firewalls, and intrusion prevention systems (IPSs).

• A deterrent control is deployed to discourage security policy violations. Deterrent and preventive controls are similar, but deterrent controls often depend on individuals being convinced not to take an unwanted action. Some examples include policies, security-awareness training, locks, fences, security badges, guards, access control vestibules, and security cameras.
• A detective control is deployed to discover or detect unwanted or unauthorized activity. Detective controls operate after the fact and can discover the activity only after it has occurred. Examples of detective controls include security guards, motion detectors, recording and reviewing of events captured by security cameras or CCTV, job rotation, mandatory vacations, audit trails, honeypots or honeynets, intrusion detection systems (IDSs), violation reports, supervision and review of users, and incident investigations.
• A compensation control is deployed to provide various options to other existing controls to aid in enforcement and support of security policies. Here’s another example: if a building’s fire prevention and suppression systems fail and the building is damaged by fire so that it is not inhabitable, a compensation control would be having a disaster recovery plan (DRP) with an alternate processing site available to support work operations.
• A corrective control modifies the environment to return systems to normal after an unwanted or unauthorized activity has occurred. They also include antimalware solutions that can remove or quarantine a virus, backup and restore plans to ensure that lost data can be restored, and intrusion prevention systems (IPSs) that can modify the environment to stop an attack in progress.
• Recovery controls are an extension of corrective controls but have more advanced or complex abilities. A recovery control attempts to repair or restore resources, functions, and capabilities after a security policy violation. Examples of recovery controls include backups and restores, fault-tolerant drive systems, system imaging, server clustering, antimalware software, and database or virtual machine shadowing.
• A directive control is deployed to direct, confine, or control the actions of subjects to force or encourage compliance with security policies. Examples of directive controls include security policy requirements or criteria, posted notifications, guidance from a security guard, escape route exit signs, monitoring, supervision, and procedures.

Question 26

2.12 Security Control Assessment
A security control assessment (SCA) is the formal evaluation of a security infrastructure’s individual mechanisms against a baseline or reliability expectation. The SCA can be performed in addition to or independently of a full security evaluation, such as a penetration test or vulnerability assessment.
Generally, an SCA is a process implemented by federal agencies based on NIST SP 800-53 Rev. 5, titled “Security and Privacy Controls for Information Systems and Organizations”

Question 27

2.13 Monitoring and Measurement
Security controls should provide benefits that can be monitored and measured. If a security control’s benefits cannot be quantified, evaluated, or compared, then it does not actually provide any security.

Question 28

2.14 Risk Reporting and Documentation
Risk reporting is a key task to perform at the conclusion of a risk analysis. Risk reporting involves the production of a risk report and a presentation of that report to the interested/relevant parties.
A risk register or risk log is a document that inventories all the identified risks to an organization or system or within an individual project.
Including the following:
- Identifying risks
- Evaluating the severity of and prioritizing those risks
- Prescribing responses to reduce or eliminate the risks
- Tracking the progress of risk mitigation

A risk matrix or risk heat map is a form of risk assessment that is performed on a basic graph or chart. It is sometimes labeled as a qualitative risk assessment. The simplest form of a risk matrix is a 3×3 grid comparing probability and damage potential.

Question 29

2.15 Risk Maturity Model (RMM).
An enterprise risk management (ERM) program can be evaluated using the Risk Maturity Model (RMM). An RMM assess the key indicators and activities of a mature, sustainable, and repeatable risk management process.

The typical RMM levels are as follows:
1) Ad hoc—A chaotic starting point from which all organizations initiate risk management.
2) Preliminary—Loose attempts are made to follow risk management processes, but each department may perform risk assessment uniquely.
3) Defined—A common or standardized risk framework is adopted organization-wide.
4) Integrated—Risk management operations are integrated into business processes, metrics are used to gather effectiveness data, and risk is considered an element in business strategy decisions.
5) Optimized—Risk management focuses on achieving objectives rather than just reacting to external threats; increased strategic planning is geared toward business success rather than just avoiding incidents; and lessons learned are reintegrated into the risk management process.

Question 30

2.16 EOL and/or EOSL
- End-of-life (EOL) is the point at which a manufacturer no longer produces a product. Service and support may continue for a period of time after EOL, but no new versions will be made available for sale or distribution.
- End-of-service-life (EOSL) or end-of-support (EOS) are those systems that are no longer receiving updates and support from the vendor. If an organization continues to use an EOSL system, then the risk of compromise is high because any future exploitation will never be patched or fixed.

Question 31

2.17 Risk Frameworks
A risk framework is a guideline or recipe for how risk is to be assessed, resolved, and monitored.
1)NIST established the Risk Management Framework (RMF) and the Cybersecurity Framework (CSF). These are both U.S. government guides for establishing and maintaining security, but the CSF is designed for critical infrastructure and commercial organizations, whereas the RMF establishes mandatory requirements for federal agencies.
The CSF is based on a framework core that consists of five functions: Identify, Protect, Detect, Respond, and Recover.

The RMF has six cyclical phases:
- Prepare to execute the RMF from an organization- and system-level perspective by establishing a context and priorities for managing security and privacy risk.
- Categorize the system and the information processed, stored, and transmitted by the system based on an analysis of the impact of loss.
- Select an initial set of controls for the system and tailor the controls as needed to reduce risk to an acceptable level based on an assessment of risk.
-Implement the controls and describe how the controls are employed within the system and its environment of operation.
-Assess the controls to determine if the controls are implemented correctly, operating as intended, and producing the desired outcomes with respect to satisfying the security and privacy requirements.
-Authorize the system or common controls based on a determination that the risk to organizational operations and assets, individuals, other organizations, and the nation is acceptable.
-Monitor the system and the associated controls on an ongoing basis to include assessing control effectiveness, documenting changes to the system and environment of operation, conducting risk assessments and impact analyses, and reporting the security and privacy posture of the system.

2) ISO/IEC 31000 document “Risk management — Guidelines.” This is a high-level overview of the idea of risk management that many will benefit from reading.This ISO guideline is intended to be useful to any type of organization, whether government or private sector.

Aditional:
The Committee of Sponsoring Organizations (COSO) of the Treadway Commission’s Enterprise Risk Management — Integrated Framework
ISACA’s Risk IT Framework
Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)
Factor Analysis of Information Risk (FAIR)
Threat Agent Risk Assessment (TARA)

Question 32

3. Social Engineering
   Social engineering is a form of attack that exploits human nature and human behavior. People are a weak link in security because they can make mistakes, be fooled into causing harm, or intentionally violate company security.

Methods to protect against social engineering include the following:
- Training personnel about social engineering attacks and how to recognize common signs
- Requiring authentication when performing activities for personnel over the phone
- Defining restricted information that is never communicated over the phone or through plaintext communications such as standard email
- Always verifying the credentials of a repair person and verifying that a real service call was placed by authorized personnel
- Never following the instructions of an email without verifying the information with at least two independent and trusted sources
- Always erring on the side of caution when dealing with anyone you don’t know or recognize, whether in person, over the phone, or over the internet/network

Question 33

3.1 Social Engineering Principles
1) Authority is an effective technique because most people are likely to respond to authority with obedience. The trick is to convince the target that the attacker is someone with valid internal or external authority.
2) Intimidation can sometimes be seen as a derivative of the authority principle. Intimidation uses authority, confidence, or even the threat of harm to motivate someone to follow orders or instructions. Often, intimidation is focused on exploiting uncertainty in a situation where a clear directive of operation or response isn’t defined.
3) Consensus or social proof is the act of taking advantage of a person’s natural tendency to mimic what others are doing or are perceived as having done in the past.
4) Scarcity is a technique used to convince someone that an object has a higher value based on the object’s scarcity.
5) Familiarity or liking as a social engineering principle attempts to exploit a person’s native trust in that which is familiar. The attacker often tries to appear to have a common contact or relationship with the target, such as mutual friends or experiences, or uses a facade to take on the identity of another company or person.
6) Trust as a social engineering principle involves an attacker working to develop a relationship with a victim.
7) Urgency often dovetails with scarcity, because the need to act quickly increases as scarcity indicates a greater risk of missing out.

Answer 33

Принципы социальной инженерии
1) Авторитет – эффективный метод, поскольку большинство людей склонны реагировать на авторитет послушанием. Хитрость заключается в том, чтобы убедить цель в том, что злоумышленник — это человек, обладающий действительными внутренними или внешними полномочиями.
2) Запугивание иногда можно рассматривать как производное от принципа власти. При запугивании используются авторитет, уверенность или даже угроза причинения вреда, чтобы побудить кого-либо следовать приказам или инструкциям. Часто запугивание направлено на использование неопределенности в ситуации, когда не определены четкие указания относительно действий или реагирования.
3) Консенсус или социальное доказательство — это акт использования естественной склонности человека имитировать то, что другие делают или воспринимают как делавшие в прошлом.
4) Дефицит — это метод, используемый для убеждения кого-либо в том, что объект имеет более высокую ценность, исходя из его редкости.
5) Знакомство или симпатия как принцип социальной инженерии пытаются эксплуатировать естественное доверие человека к тому, что ему знакомо. Злоумышленник часто пытается создать впечатление, что у него есть общий контакт или отношения с целью, например общие друзья или опыт, или использует фасад, чтобы выдать себя за другую компанию или человека.
6) Доверие как принцип социальной инженерии предполагает, что злоумышленник работает над развитием отношений с жертвой.
7) Срочность часто сочетается с дефицитом, поскольку необходимость действовать быстро возрастает, поскольку дефицит указывает на больший риск упустить выгоду.

Question 34

3.2 Eliciting Information
Eliciting information is the activity of gathering or collecting information from systems or people. In the context of social engineering, it is used as a research method in order to craft a more effective pretext.

Answer 34

Извлечение информации — это деятельность по сбору или сбору информации от систем или людей. В контексте социальной инженерии он используется как метод исследования для создания более эффективного предлога.

Question 35

3.3 Prepending
Prepending is the adding of a term, expression, or phrase to the beginning or header of some other communication. Often prepending is used in order to further refine or establish the pretext of a social engineering attack, such as spam, hoaxes, and phishing.

Answer 35

Prepending В ожидании — это добавление термина, выражения или фразы в начало или заголовок какого-либо другого сообщения. Часто добавление в начало используется для дальнейшего уточнения или установления предлога для атаки социальной инженерии, такой как спам, мистификация и фишинг.

Question 36

3.4 Phishing
Phishing is a form of social engineering attack focused on stealing credentials or identity information from any potential target. It is derived from “fishing” for information. Phishing can be waged in numerous ways using a variety of communication media, including email and the web; in face-to-face interactions or over the phone; and even through more traditional communication mediums, such as the post office or couriered packages.

Answer 36

Фишинг — это форма атаки социальной инженерии, направленная на кражу учетных данных или идентификационной информации у любой потенциальной цели. Это происходит от «ловли» информации. Фишинг может осуществляться разными способами с использованием различных средств связи, включая электронную почту и Интернет; при личном общении или по телефону; и даже через более традиционные средства связи, такие как почта или курьерские посылки.

Question 37

3.5 Spear Phishing
Spear phishing is a more targeted form of phishing where the message is crafted and directed specifically to a group of individuals.

Answer 37

Целевой фишинг — это более целенаправленная форма фишинга, при которой сообщение создается и направляется специально группе лиц. Часто злоумышленники используют украденную базу данных клиентов для отправки ложных сообщений, которые выглядят как сообщения от скомпрометированной компании, но с фальсифицированными адресами источника и неправильными URI/URL.

Question 38

3.6 Whaling
Whaling is a form of spear phishing that targets specific high-value individuals (by title, by industry, from media coverage, and so forth), such as the CEO or other C-level executives, administrators, or high-net-worth clients.

Answer 38

Китобойный промысел — это форма целевого фишинга, нацеленная на конкретных ценных людей (по должности, по отрасли, по освещению в СМИ и т. д.), таких как генеральный директор или другие руководители высшего звена, администраторы или состоятельные клиенты. .

Question 39

3.7 Smishing
Short Message Service (SMS) phishing or smishing (Spam over instant messaging [SPIM]) is a social engineering attack that occurs over or through standard text messaging services. There are several smishing threats to watch out for, including these:

Answer 39

Фишинг или смишинг службы коротких сообщений (SMS) (спам через систему мгновенных сообщений [SPIM]) — это атака социальной инженерии, которая происходит через стандартные службы обмена текстовыми сообщениями. Есть несколько серьезных угроз, на которые следует обратить внимание, в том числе следующие:

Question 40

3.8 Vishing
Vishing (i.e., voiced-based phishing) or SpIT (Spam over Internet Telephony) is phishing done over any telephony or voice communication system. This includes traditional phone lines, Voice-over-IP (VoIP) services, and mobile phones.

Answer 40

Вишинг (т. е. голосовой фишинг) или SpIT (спам через Интернет-телефонию) — это фишинг, осуществляемый через любую телефонную или голосовую систему связи. Сюда входят традиционные телефонные линии, услуги передачи голоса по IP (VoIP) и мобильные телефоны.

Question 41

3.9 Spam
Spam is any type of email that is undesired and/or unsolicited. But spam is not just unwanted advertisements; it can also include malicious content and attack vectors as well. Spam is often used as the carrier of social engineering attacks.

Answer 41

Спам – это любой тип электронной почты, который является нежелательным и/или нежелательным. Но спам – это не просто нежелательная реклама; он также может включать вредоносный контент и векторы атак. Спам часто используется в качестве носителя атак социальной инженерии.

Question 42

3.10 Shoulder Surfing
Shoulder surfing is often a physical world or in-person form of social engineering. Shoulder surfing occurs when someone is able to watch a user’s keyboard or view their display. Often, shoulder surfing is stopped by dividing worker groups by sensitivity levels and limiting access to certain areas of the building by using locked doors.

Answer 42

Серфинг через плечо часто представляет собой физический мир или личную форму социальной инженерии. Сёрфинг через плечо происходит, когда кто-то может наблюдать за клавиатурой пользователя или просматривать его дисплей. Часто «серфинг плечом» останавливается путем разделения групп рабочих по уровням чувствительности и ограничения доступа к определенным частям здания с помощью запертых дверей.

Question 43

3.11 Invoice Scams
Invoice scams are social engineering attacks that often attempt to steal funds from an organization or individuals through the presentation of a false invoice, often followed by strong inducements to pay. Attackers often try to target members of financial departments or accounting groups.

Answer 43

Мошенничество со счетами — это атаки социальной инженерии, которые часто пытаются украсть средства у организации или отдельных лиц путем предъявления фальшивого счета, за которым часто следуют сильные стимулы к оплате. Злоумышленники часто пытаются атаковать сотрудников финансовых отделов или бухгалтерских групп.

Question 44

3.12 Hoax
A hoax is a form of social engineering designed to convince targets to perform an action that will cause problems or reduce their IT security. A hoax can be an email that proclaims some imminent threat is spreading across the internet and that you must perform certain tasks in order to protect yourself.

Answer 44

Мистификация — это форма социальной инженерии, призванная убедить жертв выполнить действие, которое вызовет проблемы или снизит их ИТ-безопасность. Мистификацией может быть электронное письмо, в котором говорится, что в Интернете распространяется некая неминуемая угроза и что вы должны выполнить определенные задачи, чтобы защитить себя.

Question 45

3.13 Impersonation and Masquerading
Impersonation is the act of taking on the identity of someone else. This can take place in person, over the phone, through email, by logging into someone’s account, or through any other means of communication. Impersonation can also be known as masquerading, spoofing, and even identity fraud.

Answer 45

Олицетворение — это принятие личности другого человека. Это может произойти лично, по телефону, по электронной почте, путем входа в чью-либо учетную запись или с помощью любых других средств связи. Выдача себя за другое лицо также может быть известна как маскировка, подмена и даже мошенничество с личными данными.

Question 46

3.14 Tailgating and Piggybacking
Tailgating occurs when an unauthorized entity gains access to a facility under the authorization of a valid worker but without their knowledge. This attack can occur when a worker uses their valid credentials to unlock and open a door, then walks into the building as the door closes, granting the attacker the opportunity to stop the door from closing and to sneak in without the victim realizing.

Answer 46

Задержка происходит, когда неавторизованная организация получает доступ к объекту с разрешения действующего работника, но без его ведома. Эта атака может произойти, когда работник использует свои действительные учетные данные, чтобы разблокировать и открыть дверь, а затем входит в здание, когда дверь закрывается, предоставляя злоумышленнику возможность остановить закрытие двери и проникнуть внутрь без ведома жертвы.

Question 47

3.15 Dumpster Diving
Dumpster diving is the act of digging through trash, discarded equipment, or abandoned locations in order to obtain information about a target organization or individual. Typical collected items include old calendars, calling lists, handwritten meeting notes, discarded forms, product boxes, user manuals, sticky notes, printed reports, or the test sheet from a printer.

Answer 47

Погружение в мусорные контейнеры — это раскапывание мусора, выброшенного оборудования или заброшенных мест с целью получения информации о целевой организации или человеке. Типичные собираемые предметы включают старые календари, списки звонков, рукописные записи совещаний, выброшенные формы, коробки с продуктами, руководства пользователя, стикеры, распечатанные отчеты или тестовые листы с принтера.

Question 48

3.16 Identity Fraud
Identity fraud and identity theft are terms that are often used interchangeably. In fact, the U.S. Department of Justice (DoJ) states that “Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully obtains and uses another person’s personal data in some way that involves fraud or deception, typically for economic gain”

Answer 48

Мошенничество с личными данными и кража личных данных — это термины, которые часто используются как синонимы. Фактически, Министерство юстиции США (DoJ) заявляет, что «Кража личных данных и мошенничество с личными данными — это термины, используемые для обозначения всех видов преступлений, в которых кто-то неправомерно получает и использует личные данные другого человека каким-либо образом, который включает в себя мошенничество или обман, как правило, ради экономической выгоды»

Question 49

3.17 Typo Squatting
Typo squatting is a practice employed to capture and redirect traffic when a user mistypes the domain name or IP address of an intended resource. This is a social engineering attack that takes advantage of a person’s potential to mistype a fully qualified domain name (FQDN) or address.

Answer 49

Опечатка — это практика, используемая для захвата и перенаправления трафика, когда пользователь неправильно вводит доменное имя или IP-адрес предполагаемого ресурса. Это атака социальной инженерии, которая использует возможность человека ошибиться при вводе полного доменного имени (FQDN) или адреса.

Question 50

3.18 Influence Campaigns
Influence campaigns are social engineering attacks that attempt to guide, adjust, or change public opinion. Although such attacks might be undertaken by hackers against individuals or organizations, most influence campaigns seem to be waged by nation-states against their real or perceived foreign enemies.

Answer 50

Кампании влияния — это атаки социальной инженерии, которые пытаются направлять, корректировать или изменять общественное мнение. Хотя такие атаки могут быть предприняты хакерами против отдельных лиц или организаций, большинство кампаний влияния, похоже, проводятся национальными государствами против своих реальных или предполагаемых иностранных врагов.

Question 51

3.19 Hybrid Warfare
Nations no longer limit their attacks against their real or perceived enemies using traditional, kinetic weaponry. Now they combine classical military strategy with modern capabilities, including social engineering, digital influence campaigns, psychological warfare efforts, political tactics, and cyberwarfare capabilities. This is known as hybrid warfare. Some entities use the term nonlinear warfare to refer to this concept.

Answer 51

Нации больше не ограничивают свои атаки на своих реальных или предполагаемых врагов с использованием традиционного кинетического оружия. Теперь они сочетают классическую военную стратегию с современными возможностями, включая социальную инженерию, кампании цифрового влияния, усилия по психологической войне, политическую тактику и возможности кибервойны. Это известно как гибридная война. Некоторые организации используют термин «нелинейная война» для обозначения этой концепции.

Question 52

3.20 Social Media
Social media has become a weapon in the hands of nation-states as they wage elements of hybrid warfare against their targets. In the last decade, we have seen evidence of several nations, including our own, participate in social media–based influence campaigns. You should realize that you cannot just assume that content you see on a social network is accurate, valid, or complete.

Answer 52

Социальные сети стали оружием в руках национальных государств, поскольку они ведут гибридную войну против своих целей. За последнее десятилетие мы стали свидетелями того, как несколько стран, включая нашу собственную, участвуют в кампаниях влияния в социальных сетях. Вы должны понимать, что вы не можете просто предполагать, что контент, который вы видите в социальной сети, является точным, действительным или полным.

Question 53

4. Establish and Maintain a Security Awareness, Education, and Training Program
   The successful implementation of a security solution requires changes in user behavior. These changes primarily consist of alterations in normal work activities to comply with the standards, guidelines, and procedures mandated by the security policy. Behavior modification involves some level of learning on the part of the user.

Question 54

4.1 Awareness
Awareness establishes a common baseline or foundation of security understanding across the entire organization and focuses on key or basic topics and issues related to security that all employees must understand. Awareness is not exclusively created through a classroom type of presentation but also through the work environment reminders such as posters, newsletter articles, and screen savers.

Question 55

4.2 Training
Training is teaching employees to perform their work tasks and to comply with the security policy. Training is typically hosted by an organization and is targeted to groups of employees with similar job functions.
All new employees require some level of training so they will be able to comply with all standards, guidelines, and procedures mandated by the security policy. Training is an ongoing activity that must be sustained throughout the lifetime of the organization for every employee. It is considered an administrative security control.
Awareness and training are often provided in-house.

Question 56

4.3 Education
Education is a detailed endeavor in which students and users learn much more than they actually need to know to perform their work tasks. Education is most often associated with users pursuing certification or seeking job promotion. It is typically a requirement for personnel seeking security professional positions.

Question 57

4.4 Improvements
The following are techniques for improving security awareness and training:

Change the target focus of the training. Sometimes you want to focus on the individual, sometimes on customers and clients, and other times on the organization.
Change around topic orders or emphasis; maybe focus on social engineering during one training, then next time focus on mobile device security, and then family and travel security after that.
Use a variety of presentation methods, such as in-person instruction, prerecorded videos, computer software/simulations, virtual reality (VR) experiences, off-site training, interactive websites, or assigned reading of either prepared courseware or off-the-shelf books (such as Scam Me If You Can: Simple Strategies to Outsmart Today’s Ripoff Artists, by Frank Abagnale).
Use role-playing by providing attendees with parts in a reenactment both as attacker and defender, but allow various people to offer ideas related to defending or responding to the attacks.

Question 58

4.5 Security champions.
Develop and encourage security champions. Often a security champion is a member of a group who decides (or is assigned) to take charge of leading the adoption and integration of security concepts into the group’s work activities. Security champions are often non-security employees who take up the mantle to encourage others to support and adopt more security practices and behaviors.

Question 59

4.6 Gamification
Security awareness and training can often be improved through gamification.
Gamification is a means to encourage compliance and engagement by integrating common elements of game play into other activities, such as security compliance and behavior change. This can include rewarding compliance behaviors and potentially punishing violating behaviors.
Well-applied game dynamics can result in improved worker engagement with training, an increase in organizational application of lessons, expansion of the comprehension of application of concepts, more efficient workflow, integration of more group activities such as crowdsourcing and brainstorming, increased knowledge retention, and a reduction of worker apathy.

Question 60

4.7 Effectiveness Evaluation
It is also important to perform periodic content reviews of all training materials. Reviews help ensure that the training materials and presentation stay in line with business goals, organizational mission, and security objectives. This periodic evaluation of training materials also provides the opportunity to adjust focus, add/remove topics, and integrate new training techniques into the courseware.
Troubleshooting personnel issues should include verifying that all personnel have attended awareness training on standard foundational security behaviors and requirements, evaluating the access and activity logs of users, and determining whether violations were intentional, coerced, accidental, or due to ignorance.