INFORMATION SECURITY
This principle of the CIA Triad means information should only be accessible to people who are permitted to see it.
What is Confidentiality?
An attacker sends a fraudulent email pretending to be a legitimate organization in an attempt to trick a victim into revealing information or taking an action.
What is Phishing?
This is the original readable information before encryption.
What is Plaintext?
This security control examines network traffic and allows or blocks connections according to predefined rules.
What is a Firewall?
This document establishes an organization's general rules and expectations for protecting information and using technology.
What is a Security Policy?
An accounting employee accidentally changes ₱500,000 to ₱50,000 in a financial record. Which security principle has been compromised?
What is Integrity?
Instead of sending thousands of random phishing emails, an attacker researches the company's finance manager and sends a highly personalized message specifically targeting that person.
What is Spear Phishing?
A readable accounting message is transformed into an unreadable form before being transmitted. What process has occurred?
What is Encryption?
An accounting company's security system notices repeated suspicious connection attempts and sends an alert to the security administrator but does not automatically block the traffic.
What is an IDS?
What document explains the specific steps for carrying out a security policy?
What is Procedure
A company still has perfectly accurate financial records, but its accounting server is unavailable during payroll processing. Which CIA principle is primarily affected?
What is Availability?
What type of attack specifically targets an organization through fraudulent emails that appear to come from executives or trusted business contacts?
What is Business Email Compromise (BEC)?
A recipient uses the appropriate key to turn encrypted data back into its original readable form.
What is Decryption?
The same situation occurs, but this time the security system detects the suspicious traffic and automatically blocks it.
What is an IPS?
An employee can access the entire company's financial database even though their job only requires access to one client's records.
What security concept should the organization apply?
What is Least Privilege?
An employee is allowed to access client tax records because her job requires them. She then downloads thousands of unrelated client records that she does not need for her work.
What security principle or access-control concept is most directly violated?
What is Least Privilege?
A stranger carrying several boxes walks behind an employee through a secure office door without using an access card. The employee holds the door open for them.
What is Tailgating?
Two employees need to securely encrypt and decrypt information using the same secret value.
Question:
What type of encryption are they using?
What is Symmetric Encryption?
What term refers to data traveling between devices across a network?
What is Traffic
What process determines which users are allowed to access particular information or systems?
What is Authorization
A company has strong passwords, encryption, firewalls, and backups. However, employees have never been given rules explaining how confidential client information should be stored, shared, or handled. What organizational control is missing?
What is a Security Policy?
What attack involves an attacker pretending to be someone trustworthy, such as a CEO, to manipulate an employee?
What is Pretexting?
A company stores passwords using a one-way mathematical process. Even if the stored result is obtained, it is not intended to be reversed back into the original password.
Question:
What cryptographic technique is being described?
What is Hashing?
What security approach uses multiple security controls together so that one control can provide protection if another fails?
What is Layered Security / Defense in Depth?
What access-control method assigns permissions according to a person's job or organizational role?
RBAC