Unit 5 Attacks, Defence and Risk Based Digital Risk Management

Question 1

Five defences in U.K. Cyber Essentials framework

Answer 1

Use a firewall
Secure settings for devices and software
Control access to data and services
Protect from viruses and other malware
Keep devices and software up to date

Question 2

14 point framework for defence

Answer 2

1. Executive support
2. Reduce attack surface
3. Security architecture
4. Classify information assets
5. Zone the attack surface
6. Remove low value data
7. Use next-gen anti-malware
8. Strong user access controls
9. Dual authentication
10. Patch promptly
11. Other technical counter measures
12. Set security settings high
13. Educate users
14. Ensure security requirements included and tested

Question 3

7 root causes of Sony 2014 data breach

Answer 3

Not prepared for breach of this magnitude
Gaps in the defence layers
Patches not up to date
Non existent record retention and destruction procedures for emails increased impact
Information classification processes not in place
Disaffected employee????
No single point of accountability

Question 4

8 threat actors?

Answer 4

Nation states
Terrorist groups
Organised criminal groups
Hactivist communities
Skilled professional hackers
Disaffected or opportunistic insiders
Amateur hackers and journalists
Anyone

Question 5

2 ways to asses a threat actor?

Answer 5

Motivation and capability?

Question 6

3 stages in risk management process,

Answer 6

Identify,
Evaluate and prioritise,
Manage

Question 7

5 stages of typical cybersecurity approach?

Answer 7

Identify
Protect
Detect
Respond
Recover

Question 8

4TS

Answer 8

Tolerate,
treat,
transfer,
terminate

Question 9

3 key ingredients of cyber risk frameworks

Answer 9

Ownership
	Who is accountable?
Lifecycle
	Identified, investigating, analyzing, treating, 
        monitoring, closed
Risk information
	Probability and impact

Question 10

5 ways to treat a risk

Answer 10

Prevention
Reduction
Acceptance
Contingency
Transfer

Question 11

Six step risk based approach to cybersecurity management

Answer 11

Identify highest-value information targets first
Identify the digital assets that information needs to flow through and onto
Verify the business case for how and where information is needed
Consider the threats to the organization and the probability of them occurring
Minimise the footprint of any sensitive data, based on a business case
Then efficiently add the appropriate security controls

Question 12

What is phishing?

Answer 12

Using an electronic communication eg an email; to get information or install malware.
Cybersecurity for beginners

Question 13

What is spear phishing?

Answer 13

Targeted phishing pretending to come from a trusted source.

Cybersecurity for beginners

Question 14

What is polymorphic malware?

Answer 14

Malicious software that can change its attributes to help avoid detection. Mutation process can be automated so function of software continues but method of operation , location and other attributes change. Used in Sony data breach.
Cybersecurity for beginners

Question 15

What is SSL?

Answer 15

Secure Sockets Layer method for providing encrypted communication between two points in a digital landscape.
Cybersecurity for beginners

Question 16

What is drive by download?

Answer 16

The unintended receipt of malicious software onto a device through an internet page electronic service or link. Victim is usually unaware.
Cybersecurity for beginners

Question 17

What do we mean by secure configuration?

Answer 17

Ensuring that when settings applied to any item (device or Software) appropriate steps are taken to ensure default accounts are removed or disabled, shared accounts are not used and all protective and defensive controls use the strongest appropriate setting.
Cybersecurity for beginners

Question 18

What are default accounts?

Answer 18

Generic user and password permissions often with administrative access that is provided as standard for some software applications and hardware for use during initial set up.
Cybersecurity for beginners

Question 19

What are access controls?

Answer 19

Rules and techniques used to manage and restrict entry to or exit from a physical, virtual or digital area through use of permissions eg passwords, fingerprints, eye scans, physical tokens.
Cybersecurity for beginners

Question 20

What is patch management?

Answer 20

Controlled process used to deploy critical interim updates to software. Patches are often released to remove flaws or gaps in a software’s security.
Cybersecurity for beginners

Question 21

What is two factor or multi factor authentication?

Answer 21

Means using more than one form of proof to confirm the identity of person requesting access. In digital banking this is standard practice for instance you may need to put in a password but also receive a call on your mobile and are then asked to input another code. Methods can include something you know eg a password, something you have eg an access card or something you are eg fingerprint or facial recognition . Two or dual factor authentication would require proof from at least two categories.
Cybersecurity for beginners

Question 22

What is a honeypot?

Answer 22

An electronic device or a collection of data which is designed to trap attackers. They are designed to look like the rest of our network or attack surface but contain nothing of value but will contain tools to help us identify the attackers, isolate and trace any intrusion.
Cybersecurity for beginners

Question 23

What is a honey network?

Answer 23

A cluster of honeypots that operate together to detect intrusions to network.
Cybersecurity for beginners

Question 24

What is the dark web?

Answer 24

Web sites that hide their server locations which makes it difficult to determine which organisations are behind the sites but they are publicly accessible and enable criminal elements to exchange information across the web without being detected.
Cybersecurity for beginners

Question 25

What is a stacked risk?

Answer 25

Separate risks which accumulate to cause risks on one digital landscape to accumulate so that the overall impact is much larger than the individual components suggest. Mega data breaches such as the Sony data breach usually result from stacked risks in combination with a motivated attacker.
Cybersecurity for beginners

Question 26

What is MDM Mobile Device Management

Answer 26

Technology used to securely control operation of mobile devices eg able to wipe information from mobile device remotely or control what application can run.
Cybersecurity for beginners

Question 27

What is a closed application?

Answer 27

Collection of applications, systems and devices that can only communicate with each other. No connection to any component outside trusted group is permitted.
Cybersecurity for beginners

Question 28

What is a worm?

Answer 28

A form of malware that seeks to find other locations to which it can replicate . Protects the malware from removal and increase the area of the attack surface that is compromised.
Cybersecurity for beginners

Question 29

What is a micromort?

Answer 29

A unit of risk – one in a million chance of death used to measure risk of daily activities.
Cybersecurity for beginners

Question 30

What is hactivism?

Answer 30

An amalgamation of hacker and activism act of seeking unauthorised access to a device or network in order to promote a social or political agenda usually try to cause disruption and gain publicity.
Cybersecurity for beginners

Question 31

What is a hactivist?

Answer 31

An amalgamation of hacker and activist an individual who participates in hactivism,
Cybersecurity for beginners

Question 32

What is the threatscape?

Answer 32

Amalgamation of threat and landscape. An umbrella term to describe expected vectors/ methods and types of cyber attackers through or by which an organisation or individual may be attacked.
Cybersecurity for beginners

Question 33

What is the internet of things?

Answer 33

The incorporation of the internet into everyday things to allow them to network (communicate) with other network capable devices eg smart tvs, smart ovens, security cameras.
Cybersecurity for beginners

Question 34

What is materiality?

Answer 34

To have a level of significance or magnitude to be of concern.
Cybersecurity for beginners

Question 35

What is a risk register?

Answer 35

A central repository that contains entries for each significant loss or damage exposure, Used to track risks until impact has been managed.
Cybersecurity for beginners

Question 36

What is a risk assessment?

Answer 36

A systematic process for the detection of potential hazards or gaps in an existing or planned activity, asset, service, application, system or product.
Cybersecurity for beginners

Question 37

What do we mean by risk based?

Answer 37

An approach that considers the financial impact of failure along with its probability and proximity, to determine its comparative significance and priority for treatment.
Cybersecurity for beginners