What actor is most commonly associated with corporate espionage?, Competitors may engage in corporate espionage designed to steal sensitive information from your organization and use it to their own business advantage., Name 10 attacker motivations., Data exfiltration, espionage, service disruption, blackmail, financial gain, philosophical/political beliefs, ethical, revenge, disruption/chaos, and war., What type of attacker has a malicious intent?, An unauthorized attacker, What is shadow IT?, IT implementations, systems, and services created through unofficial means, often by well‐meaning employees or by employees outside of central IT., What type of attacker acts with authorization?, An authorized attacker is one who acts with authorization and seeks to discover security vulnerabilities with the intent of correcting them., What is a hacktivist?, A hacktivist uses hacking techniques to accomplish some activist goal., What is a nation‐state actor?, Nation‐state actors are sponsored by or supported by nations and are typically sophisticated and highly resourced., What characteristics differentiate the types of cybersecurity threat actors?, Internal vs. external, level of sophistication/capability, resources/funding, intent/motivation, What defines an unskilled attacker?, The term unskilled attacker is a term used for people who use hacking techniques and premade tools but have limited skills., What is organized crime?, Organized crime appears in any case where there is money to be made., What type of attacker acts without proper authorization, but they do so with the intent of informing their targets of any security vulnerabilities?, A semi‐authorized attacker, What is an insider threat?, When an employee, contractor, vendor, or other individual with authorized access to information and systems uses that access to wage an attack against the organization, What is the difference between misinformation and disinformation?, Misinformation is incorrect information, often resulting from getting facts wrong. Disinformation is incorrect, inaccurate, or outright false information that is intentionally provided to serve an individual or organization’s goals., What is an on‐path attack?, Occurs when an attacker causes traffic that should be sent to its intended recipient to be relayed through a system or device the attacker controls., What is business email compromise?, Business email compromise (BEC) relies on using apparently legitimate email addresses to conduct scams and other attacks., What are two types of Bluetooth attacks and what are their differences?, Bluejacking sends unsolicited messages to Bluetooth‐enabled devices. Bluesnarfing is unauthorized access to a Bluetooth device, typically aimed at gathering information like contact lists or other details the device contains., Name at least five social engineering techniques., Phishing, vishing, smishing, misinformation, disinformation, business email compromise, pretexting, watering hole attack, impersonation, brand impersonation, and typosquatting., Name eight threat vectors., Message‐based threat vectors, wired networks, wireless networks, systems, files and images, removable devices, cloud, and supply chain, What is typosquatting?, When attackers use misspelled and slightly off but similar to the legitimate site URLs and rely on the fact that people will mistype URLs and end up on their sites to drive up sales., What is an attack surface?, A system, application, or service that contains a vulnerability that attackers might exploit., Which term describes the points at which an unauthorized user could gain access?, Attack surface, What is NFC and how is it most frequently used?, NFC, or near‐field communication, is used for very short range communication between devices. You’ve likely seen NFC used for payment terminals using Apple Pay or Google Wallet using cell phones. NFC is limited to short range, meaning that it is not used to build networks of devices, and instead it is primarily used for low bandwidth, device to device purposes., What do you call it when someone uses a made‐up scenario to justify why they are approaching an individual?, Pretexting, What term describes an attack where an attacker uses websites that targets frequent to attack them?, A watering hole attack, What term describes the means that an attacker uses to gain access to a system?, Threat vectors are the means that threat actors use to obtain access to a system., What is brand impersonation?, An attack used in attempts to get users to log into their existing accounts, particularly for stores and banks., What is phishing?, Phishing is a broad term used to describe the fraudulent acquisition of information, often focused on credentials like usernames and passwords, as well as sensitive personal information like credit card numbers and related data., What term describes an organization that offers services such as security monitoring, vulnerability management, incident response, and firewall management?, Managed security service provider (MSSP)., When would cross‐site scripting attacks occur?, Cross‐site scripting (XSS) attacks occur when web applications allow an attacker to perform HTML injection, inserting their own HTML code into a web page., What is insecure direct object reference?, If the application does not perform authorization checks, the user may be permitted to view information that exceeds their authority. This situation is known as an insecure direct object reference., What are two variants that file inclusion attacks come in? How do they work?, Local file inclusion and remote file inclusion attacks. Local file inclusion attacks seek to execute code stored in a file located elsewhere on the web server. Remote file inclusion attacks allow the attacker to go a step further and execute code that is stored on a remote server., What is a zero‐day attack?, What kinds of issues should security analysts be aware of when dealing with IoT devices?, What is parameter pollution?, Parameter pollution is one technique that attackers have successfully used to defeat input validation controls., Give some examples of weak configurations., The use of default settings that pose a security risk; the presence of default credentials or unsecured accounts, including both normal user accounts and unsecured root accounts with administrative privileges; open ports and services that are not necessary to support normal system operations; and open permissions that allow users access that violates the principle of least privilege., What’s the difference between cross‐site scripting attacks and cross‐site request forgery attacks?, They exploit a different trust relationship. XSS attacks exploit the trust that a user has in a website to execute code on the user’s computer. XSRF attacks exploit the trust that remote sites have in a user’s system to execute commands on the user’s behalf., What does blind SQL injection (SQLi) mean and what are two forms of blind SQL injection?, Attackers use a technique called blind SQL injection to conduct an attack even when they don’t have the ability to view the results directly. Two forms of blind SQL injection are content‐based and timing‐based., What is the best way to detect a rootkit?, The best way to detect a rootkit is to test the suspected system from a trusted system or device. In cases where that isn’t possible, rootkit detection tools look for behaviors and signatures that are typical of rootkits., What is an evil twin?, A malicious fake access point that is set up to appear to be a legitimate, trusted network., What control should organizations put in place to ensure that successful ransomware infections do not incapacitate the company?, One of the most important defenses against ransomware is an effective backup system that stores files in a separate location that will not be impacted if the system or device it backs up is infected and encrypted by ransomware., What are keyloggers?, Programs that capture keystrokes from keyboards, although keylogger applications may also capture other input like mouse movement, touchscreen inputs, or credit card swipes from attached devices., What is ransomware?, Ransomware is malware that takes over a computer then demands a ransom or payment., Name at least three types of viruses., Memory‐resident viruses, non‐memory resident viruses, boot sector viruses, macro viruses, and email viruses, What’s the difference between Trojans and worms?, Trojans require user interaction, whereas worms are self‐installed and spread themselves., What key element separates logic bombs from other malware?, Logic bombs are functions or code that are placed inside other programs that will activate when set conditions are met instead of independent malicious programs., What are bots and what are botnets?, Bots are remotely controlled systems or devices that have a malware infection. Groups of bots are known as botnets, and botnets are used by attackers who control them to perform various actions ranging from additional compromises and infection to denial‐of‐service (DoS) attacks or acting as spam relays., What are rootkits?, Malware specifically designed to allow attackers to access a system through a backdoor., Name three password‐related attacks., Brute‐force attacks, password spraying attacks, and dictionary attacks, Give three ways that an attacker might discover a user’s password., Conducting social engineering attacks that trick the user into revealing a password, either directly or through a false authentication mechanism; eavesdropping on unencrypted network traffic; and obtaining a dump of passwords from previously compromised sites and assuming that a significant number of users reuse their passwords from that site on other sites., What are backdoors?, Backdoors are methods or tools that provide access that bypasses normal authentication and authorization procedures, allowing attackers access to systems, devices, or applications., Give some ways that an attacker might obtain a cookie., Eavesdropping on unencrypted network connections and stealing a copy of the cookie as it is transmitted between the user and the website; installing malware on the user’s browser that retrieves cookies and transmits them back to the attacker, and engaging in an on‐path attack, where the attacker fools the user into thinking that the attacker is actually the target website and presenting a fake authentication form. They may then authenticate to the website on the user’s behalf and obtain the cookie., How do environmental attacks work?, Environmental attacks include attacks like targeting an organization’s heating and cooling systems, maliciously activating a sprinkler system, and similar actions., What is resource exhaustion?, Resource exhaustion is when systems consume all of the memory, storage, processing time, or other resources available to them, rendering the system disabled or crippled for other uses., Describe how RFID cloning attacks work., RFID cloning attacks work by cloning an RFID tag or card., What is malware?, The term malware describes a wide range of software that is intentionally designed to cause harm to systems and devices, networks, or users., List four common methods to detect malicious software and applications., Signature‐based detection; heuristic or behavior‐based detection; artificial intelligence (AI) and machine learning (ML) systems; and sandboxing, What are two common NAC usage models?, Network access control (NAC) can use a software agent that is installed on the computer to perform security checks, or it may be agentless and run from a browser or via another means without installing software locally., What does segmentation accomplish?, Segmentation places sensitive systems on separate networks where they may communicate with each other but have strict restrictions on their ability to communicate with systems on other networks., How does network segmentation work?, It divides a network up into logical or physical groupings that are frequently based on trust boundaries, functional requirements, or other reasons that help an organization apply controls or assist with functionality., What are a few network hardening techniques?, The use of VLANs to segment different trust levels, user groups, or systems; placing IoT devices on a separate, protected VLAN; using a VLAN for guest networks or to isolate VoIP phones from workstations; changing default passwords; and removing unnecessary software., What is the function of segmentation?, It allows network engineers to place systems of differing security levels and functions on different network subnets., List three techniques that support removing systems, devices, or even entire network segments or zones., Isolation, containment, segmentation, What does isolation do?, Isolation goes a step further and completely cuts a system off from access to or from outside networks., What is one of the fastest ways to decrease the attack surface of a system?, Reducing the number of open ports and services that it provides by disabling ports and protocols., What are filesystem permissions?, They determine which accounts, users, groups, or services can perform actions like reading, writing, and executing (running) files., Name three endpoint protection solutions., Host‐based firewall, host intrusion prevention system (HIPS), and host intrusion detection system (HIDS)

Domain2

by
Print
Embed

Leaderboard

Visual style

Options

Switch template

Continue editing: ?