Module 3: Cyberattacks and Cybersecurity

Question 1

What factors have contributed to the increase in the number, variety, and severity of security incidents.

Answer 1

Increasing computing complexity, expanding and changing systems, an increase in the prevalence of BYOD policies, and growing reliance on software with known vulnerabilities, and the increasing sophistication of those who would do harm have caused a dramatic increase in security incidents.

Question 2

What is an exploit in the context of computer security?

Answer 2

An exploit is an attack on an information system that takes advantage of a particular system vulnerability, often due to poor system design or implementation.

Question 3

Who are the different types of individuals that launch computer attacks and what are their motivations?

Answer 3

The different types of people who launch computer attacks include black hat hackers, crackers, malicious insiders, industrial spies, cybercriminals, hacktivists, and cyberterrorists, each with different motivations.

Question 4

What is the role of a white hat hacker?

Answer 4

A white hat hackers is someone who has been hired by an organization to test the security of its information systems, allowing the organization to improve its defenses.

Question 5

What are some of the most common types of computer exploits?

Answer 5

Ransomware, viruses, worms, Trojan horses, logic bombs, blended threats, spam, DDoS attacks, rootkits, advanced persisten threats, phishing, spear phishing, smithing, vishing, cyberespionage, and cyber terrorism are among the most common computer exploits.

Question 6

What is the role of the Department of Homeland Security (DHS) in cybersecurity?

Answer 6

The DHS has the responsibility to provide for a “safer, more secure America, which is resilient against terrorism and other potential threats.” The agency’s OFfice of Cybersecurity and COmmunications is responsible for enhancing the security, resilience, and reliability of U.S. cyber and Communications infrastructure.

Question 7

What is the purpose of the US-CERT partnership?

Answer 7

The US-CERT is a partnership between DHS and the public and private sectors established to protect the nation’s internet infrastructure against cyberattacks by serving as a clearinghouse for information on new viruses, worms, and other computer security topics.

Question 8

What laws have been enacted to prosecute those responsible for computer-related crime?

Answer 8

Several laws have been enacted to prosecute those responsible for computer-related crime, including the Computer Fraud and Abuse Act, the Fraud and Related Activity in Connection with Access Devices Statute, the Stored Wire and Electronic Communications and Transactional Records Access Statutes, and USA Patriot Act.

Question 9

What are the key focuses of IT security practices to ensure a strong security program?

Answer 9

The IT security practices of organizations must focus on ensuring confidentiality, maintaining integrity, and guaranteeing the availability of their systems and data, referred to as the CIA security triad.

Question 10

What levels should an organization’s security strategy encompass?

Answer 10

An organizaiton’s security strategy must include security measures that are planned for, designed, implemented, tested, and maintained at the organization, network, application, and end-user levels.

Question 11

What should be included in a risk-based strategy to minimize the impact of security incidents?

Answer 11

A risk-based strategy should include a risk assessment to identify and prioritize threats, a well-defined disaster recovery plan, security policies, periodic security audits, compliance standards, and a security dashboard to track key performance indicators.

Question 12

What does the concept of reasonable assurance mean in the context of IT security?

Answer 12

The concept of reasonable assurance in IT security recognizes that managers must use their judgment to ensure that the cost of control does not exceed the benefits or risks involved.

Question 13

What are the key elements of the network security layer?

Answer 13

Key elements of the network security layer include authentication methods, a firewall, routers, encryption, proxy servers, VPN, and an intrusion detection system (IDS).

Question 14

What are the key elements of the application security layer?

Answer 14

The key elements of the application security layer include authentication methods, user roles and accounts, and data encryption.

Question 15

What are the key elements of the end-user security layer?

Answer 15

Key elements of the end-user security layer include security education, authentication methods, antivirus software, and data encryption.

Question 16

Why is it important to monitor systems and procedures to detect possible intrusions?

Answer 16

No security system is perfect, so systems and procedures must be monitored to detect a possible intrusion.

Question 17

What should a response plan include, and who should approve it?

Answer 17

A response plan should be developed well in advance of any incident and be approved by both the organization’s legal department and senior management. The response plan should address notification, evidence protection, activity log maintenance, containment, eradication, and follow-up

Question 18

What proactive measures should organizations take to prevent successful security intrusion?

Answer 18

Organizations must impelement fixes against well-known vulnerabilities and conduct periodic IT security audits.

Question 19

What is the role of a managed Security Service provider (MSSP) in handling security intrusions?

Answer 19

Many organizations outsource their network security operations to an MSSP, which is a company that monitors, managers, and maintains computer and network security for other organizations.

Question 20

Why is computer forensics important in the aftermath of a security intrusion?

Answer 20

Organizations must be knowledgeable of and have access to trained experts in computer forensics to identify, collect, examine, and preserve data from computer systems, networks, and storage devices in a manner that preserves the integrity of the data gathered so that it is admissible as evidence in a court of law.