Week 3 - Risk and an introduction to human factors

Question 1

Define risk?

Answer 1

the degree of impact from a threat and the likelihood of that threat occurring.

Question 2

Two terms used to quantify risk?

Answer 2

impact
likelihood

Question 3

Quantify risk - summarise impact

Answer 3

measure of the degree of harm to assets by a breach

Question 4

Quantify risk - summarise likelihood

Answer 4

considered in relation to threat and vulnerability levels. the higher the levels, the higher the likelihood.

Question 5

Risk management - what are the three categories once identified and quantified?

Answer 5

acceptable
limited or no impact

tolerable
ALARA as low as reasonably achievable- as low as possible to meet standards.

ALARP as low as reasonably practicable - further action no worth it

intolerable
threats must be eliminated or systems abandoned.

Question 6

Define the human factor

Answer 6

socio-technical the interaction of human and security technologies.

the individual
the job
the organisation

Question 7

Define social engineering

Answer 7

the act of deceiving an individual into revealing information that can be us to gain confidence and trust

Question 8

Principles of social engineering psych reciprocity

Answer 8

people tend to return favors

Question 9

Principles of social engineering psych scarcity

Answer 9

time sensitive such as job offers or discounts

Question 10

Principles of social engineering psych authority

Answer 10

people tend to obey authority figures

Question 11

Principles of social engineering psych commitment and consistency

Answer 11

people don’t like to go back on their word and will continue a task even if risky

Question 12

Principles of social engineering psych liking

Answer 12

people can be persuaded to perform a task if they like the person asking

Question 13

Principles of social engineering psych consensus

Answer 13

people will copy behaviours especially if they see the other benefiting.

Question 14

social engineering techniques phishing

Answer 14

untargeted attempts to solicit personal information from a victim

Question 15

social engineering techniques spear-phishing

Answer 15

a targeted form of phishing

Question 16

social engineering techniques whaling

Answer 16

spear-phishing aimed at senior executives in an organisation

Question 17

social engineering techniques vishing

Answer 17

(voice phishing) is a related attack vector where the attacker solicits information from the victim in a phone call

Question 18

social engineering techniques smishing

Answer 18

conducts the attacks using messaging services such as SMS

Question 19

social engineering techniques pretexting

Answer 19

a scenario is created to coax valuable information

Question 20

social engineering techniques impersonation

Answer 20

impersonating of someone else to gain access

Question 21

social engineering techniques baiting

Answer 21

victims are enticed to compromise their security, the attack relies on greed (USB, disk, free links)

Question 22

social engineering techniques quid-pro-quo

Answer 22

victims willingly give away information for an immediate reward.

Question 23

social engineering techniques water-holing

Answer 23

like animals grazing around a water hole, victims tend to gather around a specific website or board. the attacker then inject malware on all visiting computers

Question 24

social engineering techniques tailgating (piggybacking)

Answer 24

a physical attack to bypass physical security such as locked doors.

Question 25

What is pen testing?

Answer 25

breaking into security controls to expose weaknesses as part of the auditing process.

Question 26

what are the three categories of pen testing. **black box**

Answer 26

**black box** with no information, a pen tester will use step 1 of the cyber kill chain (reconnaissance). this simulates external attack an may not always discover every weakness.

Question 27

what are the three categories of pen testing. **grey box**

Answer 27

a partial view of the system is provided, this allows pen testers faster access. this can mimic a previous attack and simulates an insider threat.

Question 28

what are the three categories of pen testing. **white box**

Answer 28

comprehensive insight is given and high level permissions. specialist cyber security tools are used. simulates insider and outsider threats. expensive and time consuming and is within a scope so not all part of the system is tested.