Types of Risk
Losing money directly, such as paying a ransom, or even indirectly, such as having to call an attorney to see what kind of fiscal sanctions will be placed on your company is this type of risk.
What is a financial risk?
This malware locks your files and demands payment to unlock them. You are unable to retrieve your files or perform your daily duties due to your systems being encrypted.
What is ransomware?
A visible camera discourages locker theft, even though no one ever reviews the footage.
What is a deterrent control?
This low-skill attacker runs tools someone else built, just for thrills or bragging rights.
Who is a script kiddie?
The "A" in the CIA Triad stands for this.
What is availability?
A factory's production line is shut down for two days after a cyberattack on its control systems.
What is operational risk?
A parent finds software silently recording every key their child presses, including saved passwords, homework assignments, journaling.
What is a keylogger?
Laptops that automatically lock after 5 minutes of inactivity stop unauthorized access before it happens.
What is a preventive control?
Attackers who deface a company's website with a protest message about its environmental record.
Who are hacktivists?
These three words make up the DAD Triad.
What are disclosure, alteration, and denial?
A school's grading system is down for a full week after an attack. Name the primary risk, and the secondary risk if student grade data is protected by privacy law such as FERPA.
What are operational (primary) and compliance (secondary) risk?
A breach investigation finds no unusual files, but the attacker has held admin-level access for months and normal security tools can't see them. Name the malware and the trait that makes it so dangerous.
What is a rootkit, which hides itself and other malware?
A monitoring alert flags files being encrypted, and IT then wipes the systems and restores last night's backup. Name the control type for the alert and for the restore.
What are detective (the alert) and corrective (the restore)?
Two attackers target the same school: a fired employee with basic skills and a still-active login, and a well-funded foreign group. Which is internal, and which has far greater resources?
Who are the fired employee (internal) and the foreign group (greater resources)?
A stolen, unencrypted laptop exposes student records. Name the CIA principle, its DAD term, and the data protection concept that would have prevented the exposure.
What are confidentiality, disclosure, and encryption?
A student council picks a free app to sell prom tickets without vetting it, and the app is breached. For three days no tickets or lunches can be sold, families see fraudulent charges on their cards, and the council’s whole plan to fund next year’s events falls apart. Name the risk types in order: the three days of no sales, the fraudulent charges, and the collapsed funding plan.
What are operational, financial, and strategic risk?
A gamer installs a "free game mod" and an attacker can now turn on the webcam and control the computer remotely. Name the specific malware and the broader category it is disguised as.
What are a Remote Access Trojan (RAT) and a Trojan?
A server room needs a keycard that only three staff members hold, and the door logs every entry. Name the control type for the keycard lock and for the entry log.
What are physical (the keycard lock) and detective (the log)?
A group defaces a company's website to protest its practices, then also sells stolen customer data for profit. Name the two actor types it blends and why it's hard to classify.
What are hacktivist and organized crime, with mixed motivations that don't fit one box?
On the same day, a hacker changes students' grades and a DDoS attack takes the school website offline. Pair each CIA principle with its DAD term.
What are integrity/alteration and availability/denial?
A hospital's unencrypted laptop is stolen. Regulators cite it for violating privacy law, it pays the resulting fine, and news coverage drives patients to rival hospitals. Name the three risk types in that order.
What are compliance, financial, and reputational risk?
Name the virus that activates before the operating system even starts loading, and the virus that stays in RAM so it can re-infect programs after a restart.
What are a boot sector virus and a memory resident virus?
An old lab computer can't be patched, so IT isolates it on its own separate network. Name the control type and explain why it isn't simply preventive.
What is a compensating control, a workaround used when the ideal control (patching) isn't possible?
An employee is secretly paid by a foreign government to leak internal documents. Give the actor type, whether it is internal or external, and who is behind it.
What is an insider threat (internal), backed by a nation-state?
A ransomware gang encrypts a hospital's files and also threatens to leak them online. Name the two CIA principles violated, with their DAD terms.
What are availability/denial and confidentiality/disclosure?