Tools of Defense Flashcards
firewall
Hardware or software designed to block unauthorized network access while permitting authorized communications.
cloud computing
The practice of using remote servers on the Internet to store, manage, and process data.
security awareness training
Any training that raises the awareness of a user to potential threats, and how to avoid them.
Kevin Mitnick
“World’s Most Wanted Hacker” in the 90s
“World’s Most Famous Hacker” today
successful Fortune 500 security consultant
part owner and the Chief Hacking Officer of KnowBe4
Kevin’s main contribution to KnowBe4 is his experience
KMSAT named after him
learning management system (LMS)
A system for the administration, documentation, tracking, reporting, and delivery of e-learning education courses or training programs.
return on investment (ROI)
Measures the amount of return on an investment relative to the investor’s cost. For IT Security this is measured by “reduction in risk.”
Shareable Content Object Reference Model (SCORM):
A technical standard that governs how online learning content and Learning Management Systems communicate with each other.
What are the Six Steps to Success SAT?
Step 1: Have a security policy, and have each employee read and sign it.
Step 2: Have all employees take mandatory SAT (online), with a clear deadline and reasons why they’re taking the training.
Step 3: Make SAT part of the onboarding process (the process of integrating new hires in a company).
Step 4: Regularly test employees to reinforce the SAT its application.
Step 5: Have employees who fail phishing tests meet privately with a supervisor or HR; reward employees with low failure rates.
Step 6: Send regular security hints and tips via email to all employees.
7 reasons why an organization would outsource SAT
- reduce costs
- access to talent
- geographic reach and scalability
- compliance
- mitigate risk
- business focus
- leverage the cost of technology
What is defense in depth and what are its 6 layers?
A security discipline that refers to having layers of protection in an IT infrastructure.
- Policies, Procedures, and Awareness
- perimeter
- internal network
- host
- application
- data
social engineering indicators (SEI)
A feature of KnowBe4’s simulated phishing campaigns that shows a user the red flags they missed when clicking on a link in a simulated phishing campaign.
Artificial Intelligence Driven Agent (AIDA)
A tool that uses artificial intelligence (AI) to automatically create integrated campaigns that send emails, text, and voicemail to an employee, simulating a multi-vector social engineering attack.
