Information Systems Security

Question 1

Cybersecurity Professionals and Their Tasks

What is Cybersecurity?

Answer 1

Cybersecurity is like a shield that keeps your digital stuff safe from bad guys. These bad guys try to break into your computers, networks, and programs to steal or mess up important information, get money from you, or disrupt your work.

To make this shield strong, you need different layers of protection for your computers, networks, and data. In a company, it’s not just about the technology. People and how they work together also play a big role in keeping everything safe. So, it’s like a team effort to guard against cyber attacks.

Question 2

Cybersecurity professionals have several important tasks

Answer 2

1. Stay Informed: They keep up with the latest technology and security threats through various sources.
2. Threat Analysis: They analyze and assess potential threats to understand their significance.
3. System Checks: They regularly review systems to identify and address any security weaknesses.
4. Security Measures: They implement security measures and establish protocols to protect systems and data.
5. Reporting: They create reports for company stakeholders to keep them informed about security status.
6. Education: They educate others in the company about the importance of security.

Question 3

Four (4) Cybersecurity Career Paths

Security Architect

Answer 3

These experts protect a company’s computer systems by thinking like hackers and anticipating their tactics. They maintain system security, often working irregular hours to stay updated on the latest threats. Some of the best security architects may have a background as former hackers, as they understand how hackers operate.

Question 4

Four (4) Cybersecurity Career Paths

Security Consultant

Answer 4

Security consultants act as advisors and supervisors, guiding companies on effective security measures. They assess potential security threats and develop plans for both prevention and response in case of breaches.

Question 5

Four (4) Cybersecurity Career Paths

Ethical Hacker

(White Hat Hacker)

Answer 5

Ethical hackers are information security experts who legally and systematically attempt to break into computer systems, networks, or applications to uncover vulnerabilities. They do this with the owner’s permission to identify and fix security weaknesses before malicious hackers can exploit them.

Question 6

Four (4) Cybersecurity Career Paths

Chief Information Security Officer (CISO)

Answer 6

The CISO is responsible for overseeing an organization’s information and data security. This role involves managing various aspects such as security operations, data protection, program management, and access control to ensure comprehensive protection of sensitive information.

Examples are security operations, data loss, program management, and access management.

Question 7

Introduction to Risks, Threats, and Vulnerabilities

THE ANATOMY OF CYBERATTACK

Steps 1to 4

Answer 7

1. Reconnaissance: Hackers gather info about the target, like IP addresses and emails. If needed, they trick employees with fake emails to find vulnerabilities.
2. Attack: Once inside, they steal credentials to gain full access. Then they can steal data, encrypt it for ransom, or tamper with it.
3. Expansion: They spread across the network, making it harder to detect. They don’t need high-level access anymore.
4. Obfuscation: Hackers cover their tracks to confuse investigators. They use tricks like fake information, erasing logs, and hidden commands. This is the final step.

Question 8

Seven (7) cybersecurity risks that may impact organizations

Technology

Answer 8

The widespread use of technology introduces vulnerabilities. For instance, if a company relies heavily on online customer data storage, a data breach could expose sensitive customer information.

Question 9

Seven (7) cybersecurity risks that may impact organizations

Supply Chain

Answer 9

Organizations increasingly depend on third-party vendors and IoT devices. If a vendor’s systems are compromised, it could affect the organization. For example, a breach at a cloud service provider could impact multiple client companies.

Question 10

Seven (7) cybersecurity risks that may impact organizations

Internet of Things (IoT)

Answer 10

IoT devices, like smart thermostats and security cameras, can be hacked if not properly secured. An example is a smart thermostat being hacked to disrupt a company’s HVAC system.

Question 11

Seven (7) cybersecurity risks that may impact organizations

Business Operations

Answer 11

Increased connectivity can lead to more vulnerabilities. If a manufacturing plant relies on automated systems connected to the internet, a cyberattack could disrupt production.

Question 12

Seven (7) cybersecurity risks that may impact organizations

Employees

Answer 12

Employees can unwittingly compromise cybersecurity. For instance, clicking on a phishing email link can lead to a malware infection that affects the entire organization’s network.

Question 13

Seven (7) cybersecurity risks that may impact organizations

Regulatory

Answer 13

Governments introduce regulations to protect data. For instance, GDPR in Europe mandates strict data protection. Failing to comply can lead to hefty fines and damage an organization’s reputation.

Question 14

Seven (7) cybersecurity risks that may impact organizations

Board of Directors

Answer 14

Boards play a crucial role in cybersecurity oversight. If they don’t prioritize cybersecurity, the organization may not be adequately prepared for cyber threats, which could lead to financial and legal consequences.

Question 15

12 Cybersecurity Threats and Vulnerabilities

Ransomware

Answer 15

This is like digital kidnapping. Criminals use malicious software to lock your computer or files, and they demand money (a ransom) to unlock them. Paying the ransom doesn’t guarantee you’ll get your files back. For example, imagine someone locking your photos and asking for $500 to unlock them.

Question 16

Cybersecurity Threats and Vulnerabilities

Malware

Answer 16

It’s short for malicious software. These are programs designed to sneak into your computer and do bad things, like stealing your information or damaging your files. Think of it as a digital spy or thief.

Question 17

Cybersecurity Threats and Vulnerabilities

Social Engineering

Answer 17

This is when bad actors trick you into revealing important information. It could be a scammer pretending to be a bank and asking for your account details. They “engineer” a fake scenario to manipulate you.

Question 18

Cybersecurity Threats and Vulnerabilities

Phishing

Answer 18

Picture receiving an email that looks like it’s from your bank, but it’s actually from a hacker. They want you to click a link and enter your login info. It’s like a fisherman using bait (the email) to catch your sensitive information.

Question 19

Cybersecurity Threats and Vulnerabilities

Crypting Services

Answer 19

Criminals use these to hide their malware. It’s like putting a secret code on a message so only certain people can read it. They use it to avoid detection.

Question 20

Cybersecurity Threats and Vulnerabilities

Crimeware

Answer 20

This is the underground market for cybercriminals. They buy and sell malware tools and services. It’s like a black market for digital criminals.

Question 21

Cybersecurity Threats and Vulnerabilities

Remote Administration Tools

Answer 21

Imagine a hacker gaining control of your computer from afar. They can steal your data, mess up your computer, or even access your webcam without you knowing. It’s like a digital spy in your house.

Question 22

Cybersecurity Threats and Vulnerabilities

Keyloggers

Answer 22

These sneakily record every keystroke you make. Imagine someone secretly listening to your conversations and writing down everything you say, including your passwords.

Question 23

Cybersecurity Threats and Vulnerabilities

Exploit Kits

Answer 23

Hackers trick you into visiting a trusted website, but it secretly redirects you to a malicious one. It’s like thinking you’re entering a safe store, but you end up in a hidden trap.

Question 24

Cybersecurity Threats and Vulnerabilities

Leaked Data

Answer 24

Criminals steal data from your computer and sell it on the Dark Web. This could be your credit card info, social security number, or even your work login. It’s like someone stealing your wallet and selling your cards.

Question 25

Cybersecurity Threats and Vulnerabilities

Card Skimmers

Answer 25

Criminals put hidden devices on things like ATM machines or gas pumps. When you use them, your card info gets stolen. It’s like a thief tampering with a bank machine to steal your card details.

Question 26

Cybersecurity Threats and Vulnerabilities

Unpatched Systems

Answer 26

Many vulnerabilities can be fixed with software updates. But some people don’t update their systems. Imagine having a lock on your door, but not using it because it’s old and rusty. Criminals can easily break in.

Question 27

The CIA Triad

Answer 27

is a fundamental concept in cybersecurity that focuses on three key principles: Confidentiality, Integrity, and Availability.

In summary, the CIA Triad helps organizations protect their data and systems by focusing on confidentiality (keeping data secret), integrity (keeping data accurate), and availability (ensuring data is accessible). These principles guide the implementation of various security measures to safeguard information from unauthorized access, tampering, and disruptions.

Question 28

Confidentiality

Answer 28

This principle ensures that sensitive information is only accessible to authorized individuals and is protected from unauthorized access. It’s like having a secret that only trusted people can know.

Example: When you log into your email account, you need to enter a username and password. Only with the correct credentials can you access your emails. This ensures the confidentiality of your email messages.

Question 29

Integrity

Answer 29

Integrity ensures that data remains accurate, unaltered, and true to its original form. It’s about making sure that no one can tamper with or modify data without authorization.

Example: Imagine you’re sending money through a banking app. The app uses encryption to protect the transaction data while it’s being sent. This ensures that the amount you send remains unchanged and reaches the recipient intact.

Question 30

Availability

Answer 30

Availability ensures that information and resources are accessible when needed. It’s about making sure that systems are reliable and operational, even in the face of potential disruptions.

Example: A popular online shopping website needs to stay available 24/7 so that customers can make purchases at any time. They use redundancy and backup servers to ensure that the website remains accessible, even if one server fails or during a sudden surge in traffic.

Question 31

Data Classification Standards

Answer 31

Data Classification Standards are rules that help categorize data based on how sensitive, valuable, or critical it is. This classification helps determine the level of security needed to protect the data.

Remember, these stages can vary in complexity depending on the organization and the type of data involved. The goal is to follow these steps systematically to ensure data is handled appropriately throughout its lifecycle.

Question 32

Here’s a breakdown of the key stages in managing data according to these standards, with examples:

Answer 32

1. Understanding: This stage involves knowing what the data is, how it’s classified, and where it’s stored. For instance, a hospital might classify patient medical records as highly sensitive data, and they need to understand this to ensure proper protection.
2. Creating: This step includes collecting data and conducting experiments. For instance, a marketing team gathers customer feedback through surveys to create a database of customer preferences.
3. Storing: Involves designing storage systems and capturing metadata (data about the data). For example, a bank stores transaction records securely in a database and keeps track of when each record was created.
4. Using: Data is entered, processed, and analyzed in this phase. An e-commerce website uses data about user behavior to recommend products or personalize the shopping experience.
5. Sharing: This stage deals with distributing data while controlling access. An academic institution may share research findings with limited access to ensure data integrity.
6. Archiving: Data is preserved for the long term. A museum archives historical documents by digitizing them and storing them in a climate-controlled facility.
7. Destroying: When data is no longer needed, it must be securely disposed of. For example, a law firm shreds old legal documents to protect client confidentiality.