You Should Know This :-)
Risk Chain
Inputs for a Risk Assessment
Data Classification
Assessment Activities
100
CIA:DAD
Integrity:_________
What is Alteration?
100
A standardized identifier for a known cybersecurity vulnerability.
What is a CVE?
100
These are implemented to reduce or mitigate risk.
What are controls?
100
This is an example of data protected by FERPA.
What are grades?
100
This assessment identifies weaknesses without attempting to exploit them.
What is a vulnerability assessment?
200
This ensures that users are granted only the rights to perform actions required by their job.
What is the principle of least privilege?
200
Hardware, software, data, and people can all fall into this category when they have value to an organization.
What are assets?
200
This establishes how a system is set up right now, including hardware, software, and settings.
What is the current configuration?
200
Customer Social Security numbers and employee medical information would generally fall into this information classification.
What is protected or private information?
200
This type of testing attempts to exploit identified weaknesses.
What is penetration testing?
300
This scoring system identifies the severity of a vulnerability.
What is CVSS?
300
An employee falls for a phishing email. Identify the exploit.
What is social engineering?
300
This resource is used to graphically document system configurations.
What are network/system diagrams?
300
An organization's product brochures or testimonials generally fall into this information classification.
What is public information?
300
This rudimentary assessment tool tests whether a network device is 'up'.
What is PING?
400
This is what remains after reasonable risks have been addressed.
What are residual risks?
400
An employee falls for a phishing email. Identify the vulnerability.
What is lack of employee training or awareness?
400
This process sets and maintains an approved, known state for systems and devices.
What is configuration management?
400
These are two types of intrusion detection systems.
What are host based and network based?
400
A vulnerability scanner reports that a server may be vulnerable to a known exploit. What has the analyst identified: a confirmed successful exploit or a potential vulnerability?
What is a potential vulnerability?
500
This set of 18 controls and 153 safeguards is used to reduce/mitigate risk.
What are the CIS Controls?
500
This is a weakness that can be exploited.
What is a vulnerability?
500
This process controls an documents modifications to systems so that changes don't introduce new risk.
What is change management?
500
This is an example of data subject to PCI DSS.
What is credit card information?
500
This penetration testing software combines exploits and payloads to test vulnerable systems. We used it in lab.
What is Metasploit?