Security & Risk Management Flashcards
focuses on information systems, aiming to
reduce the impact and likelihood of threats such as
cyberattacks, employee mistakes, and natural disasters.
cyber risk
management
involve identifying,
assessing, and controlling risks to an organization’s capital,
earnings, and critical assets
Security and risk management
These risks can arise from
various sources, including financial uncertainty, legal
liabilities, strategic management errors, accidents, and natural disasters.
Security and risk management
is a
guiding model in information
security. A comprehensive
information security strategy
includes policies and security
controls that minimize threats to these three crucial components
Confidentiality, Integrity and Availability
refers to protecting
information from unauthorized
access.
Confidentiality
means data are
trustworthy, complete, and have
not been accidentally altered or
modified by an unauthorized user.
Integrity
means data are
accessible when you need them.
Availability
Security Governance six key principles:
- Responsibility
- Strategy
- Acquisition
- Performance
- Conformance
- Human Behavior
Clearly define roles and responsibilities for security across the
organization.
Responsibility
Align security efforts with the overall business strategy
Strategy
When acquiring new technologies or services, evaluate their
security implications.
Acquisition
Continuously monitor and assess security performance.
Performance
Ensure compliance with relevant regulations, standards, and
policies.
Conformance
Promote secure behaviors among employees.
Human Behavior
- Is an attempt by cybercriminals,
hackers or other digital adversaries to access a
computer network or system, usually for the
purpose of altering, stealing, destroying or
exposing information.
CYBERATTACK
— is any program or code that is created with the intent to do harm to a
computer, network or server.
Malware
an adversary encrypts a victim’s data and offers to provide a decryption key in exchange
for a payment.
Ransomware
is a type of malicious activity that uses native, legitimate tools built
into a system to execute a cyber attack.
Fileless Malware
type of unwanted, malicious software that infects a computer or other device and collects
information about a user’s web activity without their knowledge or consent.
Spyware
type of spyware that watches a user’s online activity in order to determine which ads to show
them. While adware is not inherently malicious, it has an impact on the performance of a user’s device
and degrades the user experience.
Adware
malware that appears to be legitimate software disguised as native operating system
programs or harmless files like free downloads. Trojans are installed through social engineering
techniques such as phishing or bait websites
Trojan
a self-contained program that replicates itself and spreads its copies to other
computers.
Worm
a collection of software designed to give malicious actors control of a computer
network or application. Once activated, the malicious program sets up a backdoor exploit and
may deliver additional malware.
Rootkits
- are tools that record what a person types on a device.
Keylogger
Common Types of Cyberattacks
- Malware
- Ransomware
- Fileless Malware
- Spyware
- Adware
- Trojan
- Worm
- Rootkits
- Keylogger
- Denial of Service Attacks
- Phishing
- Spear Phishing
- Whaling
is a malicious, targeted attack that floods a network with false
requests in order to disrupt business operations.
DoS Attack
- type of cyberattack that uses email, SMS, phone, social media, and social engineering
techniques to entice a victim to share sensitive information — such as passwords or account
numbers.
Phishing
type of phishing attack that targets specific individuals or organizations
typically through malicious emails.
Spear Phishing
- is a type of social engineering attack specifically targeting senior or C-level executive
employees with the purpose of stealing money or information, or gaining access to the person’s
computer in order to execute further cyberattacks.
Whaling
- is the act of sending fraudulent text messages designed to trick individuals into sharing sensitive data such as
passwords, usernames and credit card numbers.
Smishing
a voice phishing attack, is the fraudulent use of phone calls and voice messages pretending to be from a
reputable organization to convince individuals to reveal private information such as bank details and passwords.
Vishing
- is a technique through which a cybercriminal disguises themselves as a known or trusted source.
Spoofing
is a type of cyberattack in which an attacker eavesdrops on a conversation between two
targets with the goal of collecting personal data, (passwords or banking details).
Man in the middle Attack
- is a technique where attackers use psychological tactics to manipulate people into taking a desired
action.
Social Engineering
is a type of physical security breach in which an unauthorized person follows an authorized
individual to enter secured premises
Tailgaiting
