Chapter 8 Flashcards
We further need to protect information and environments from…
Employees, contractors, partners, customers, service providers, and others
Inappropriate actions of human being may compromise our security
What is an RSA breach?
An example of social engineering attack
Hardware authentication tokens of RSA was stolen by attacking a company’s environment
We need a solid security awareness and training program to…
avoid social engineering attack
We need to consider following items to build security awareness among users
o protecting data o passwords o social engineering o network usage o malware o the use of personal equipment o clean desk o policy knowledge
Data protection is essential in business because of
o Reputation and customer retention
o Avoid any penalties
What are the practices of Data Protection?
o Regular training to educate employees and users
o May consider gamification techniques to increase users participation
Most OSs and tools enforce certain levels of password strength:
at least eight characters, at least one upper case, at least one lower case, at least one symbol, at least one number
balance the complexity of the password with the importance of what is being protected. For example…
bank account vs family photos
Use a policy of resetting password in a _____ interval
regular
We can stipulate that new passwords cannot be a _____ of the previous 10 passwords used
variation
Users’ Mistakes include:
- Write their password down and stick it to the underside of their keyboard
- Passwords being shared among users
- Passwords being created based on pet names, birthdates, or other such personal information
- More damaging user behaviours is manually syncing passwords between systems or applications
- Train employees and users to avoid the above actions
- Users also need to use strong passwords in every applications and systems
Social Engineering refers to…
psychological manipulation of people into performing actions or divulging confidential information
•”Any act that influences a person to take an action that may or may not be in their best interests”
Pretexting means:
Attackers establish fabricated scenarios to access victim’s sensitive information
Direct pretexting:
face-to-face communication
- Attacker’s confidence or body language is important
Indirect pretexting:
Over some communication medium
over the phone or through e-mail
Pretexting requires…
strong communication and psychological skills, specialized knowledge, and a quick mind in order to be successful
Phishing happen mostly through…
mail, texting, or phone calls (electronic communications)
Phishing involves convincing the potential victim to click on a link in the e-mail to…
to send the victim to a fake site designed to collect personal information or credentials, or to have the victim install malware on their system
Fake sites are usually well-known websites
Some sites are cleverly crafted; thus, difficult to distinguish from the legitimate pages that they are imitating
If the fake sites are not relevant for target victims, the attack will not be ______
successful
Spear phishing is a…
targeted attack against a specific company, organization, or person
The requirements for spear fishing are…
an advanced investigation to conduct a legitimate attack
The fake site may look valid
e-mail must be seen to come from a valid sender
E.g., from human resources, a manger, the corporate IT support team, a peer, or friend
Tailgating is…
The act of following someone through an access control point
E.g., secure door
Tailgating is common in locations that use _____ access controls
technical
