Choose the best answer for each question. Each question is worth 2 marks.
Which of the following are the three key pillars of cybersecurity?
What is a vulnerability?
Which type of attack primarily violates confidentiality?
What type of malware encrypts files and demands payment?
Which social engineering attack targets specific individuals or organizations?
What does the 'I' in CIA triad stand for?
How many elements does AAA services actually have?
What is a Zero-Day attack?
Which attack involves following an authorized person into a secure area?
What is the relationship formula for risk?
Which of these is NOT a symptom of malware infection?
What does "Defense in Depth" refer to?
Which element ensures data hasn't been modified by unauthorized parties?
What is Doxing?
In AAA services, what comes immediately after Identification?
Indicate whether each statement is True or False. Each question is worth 2 marks.
Defense in depth is used to provide a protective multilayer barrier against various forms of attack.
A threat is a weakness in the security system.
People are considered the weakest link in cybersecurity.
A breach of confidentiality always results in a breach of possession.
A breach of possession always results in a breach of confidentiality.
AAA services consists of only three elements.
Ransomware typically demands payment in cryptocurrency.
Spear phishing targets specific individuals or organizations.
Interruption attacks primarily affect confidentiality.
Wired Equivalent Privacy (WEP) uses a predefined shared secret key.
Answer each question briefly. Sample answers are provided after checking.
Explain the difference between a threat, vulnerability, and control. Provide an example of each.
Vulnerability: A weakness in the security system that could be exploited. Example: Unpatched software with known security flaws.
Threat: A potential danger that might exploit a vulnerability. Example: A hacker who could exploit the unpatched software.
Control: An action or device that removes or reduces a vulnerability. Example: Installing security patches and updates.
Relationship: Risk = Threat + Vulnerability - Control
List and briefly explain the three pillars of cybersecurity.
1. People: Users must understand and comply with security principles like using strong passwords, being cautious with email attachments, and backing up data. Security awareness training is crucial.
2. Policies: Organizations need frameworks for handling attempted and successful cyber attacks, including incident response procedures and business continuity planning.
3. Technology: Essential tools and systems needed to protect against cyber attacks, including firewalls, antivirus software, encryption tools, and access control systems.
All three must work together - technology alone cannot protect if people don't follow policies.
What are the five elements of AAA services? List them in order.
1. Identification: Claiming to be an identity (e.g., entering username)
2. Authentication: Proving that identity (e.g., entering password)
3. Authorization: Determining permissions for that identity (e.g., access control)
4. Auditing: Recording logs of events and activities
5. Accounting/Accountability: Reviewing logs to check compliance and hold subjects accountable
Describe three types of social engineering attacks and one countermeasure for each.
1. Phishing: Fraudulent emails that appear from reputable sources to steal sensitive data.
Countermeasure: Email filtering and user training to recognize suspicious emails.
2. Tailgating: Following authorized person into secure area without proper credentials.
Countermeasure: Strict badge policies, security guards, and mantrap doors.
3. Pretexting: Creating fabricated scenarios to gain trust and extract information.
Countermeasure: Verification procedures and training staff to verify caller identities.
Explain the concept of Defense in Depth and why it's important.
Definition: Defense in Depth is the use of multiple security controls in series, creating layers of protection like an onion.
How it works: If one security layer is breached, other layers continue to provide protection. Controls can be in serial (one after another) or parallel (multiple at same level) configuration.
Importance:
- No single point of failure
- Provides redundancy in security
- Creates time delays for attackers
- Multiple opportunities to detect intrusions
Example: Like airport security with multiple checkpoints: entrance screening, baggage check, metal detectors, etc.
Answer in detail. Sample answers provided after checking.
Explain the CIA triad in detail. For each element, describe what it protects against, common attacks, and protection methods.
The CIA Triad is a model designed to guide information security policies within an organization.
1. CONFIDENTIALITY - "Keeping secrets secret"
Definition: Preventing unauthorized disclosure of information.
Common Attacks:
- Password theft through keyloggers or public WiFi
- Port scanning to discover services
- Shoulder surfing at ATMs
- Eavesdropping and man-in-the-middle attacks
- Network sniffing to capture packets
- Privilege escalation
Protection Methods:
- Data encryption (at rest and in transit)
- Strong authentication (passwords, 2FA)
- Biometric verification
- Security tokens (hardware/software)
- Access control lists
2. INTEGRITY - "Maintaining accuracy and consistency"
Definition: Ensuring data hasn't been modified by unauthorized parties.
Common Attacks:
- Viruses and malware
- Logic bombs
- Unauthorized access
- Coding errors
- System backdoors
Protection Methods:
- File permissions and access controls
- Version control systems
- Checksums and hashing
- Digital signatures
- Regular backups for restoration
3. AVAILABILITY - "Accessible when needed"
Definition: Ensuring authorized users can access information when required.
Threats:
- Device failures
- Software errors
- Environmental issues (power loss, flooding)
- Denial-of-Service (DoS) attacks
- Network intrusions
Protection Methods:
- Redundancy and failover systems
- Geographic backup locations
- Disaster recovery plans
- Firewalls and proxy servers
- Web application firewalls (e.g., Cloudflare for DDoS protection)
Interconnection: The three elements work together. A comprehensive security strategy must address all three - protecting confidentiality without availability is useless, and having available data without integrity is dangerous.
Discuss the various types of malware, their characteristics, symptoms of infection, and comprehensive countermeasures organizations should implement.
Malware Definition: Any file or program designed to harm computer users.
Types of Malware:
1. Virus: Self-replicating code that attaches to legitimate files. Spreads when infected files are shared. Can corrupt or delete data.
2. Worm: Self-propagating malware that spreads across networks without user interaction. Can consume bandwidth and overload systems.
3. Trojan Horse: Disguised as legitimate software but contains malicious code. Users voluntarily install it thinking it's safe.
4. Spyware: Secretly monitors user activity and collects information like passwords, credit card numbers, browsing habits.
5. Keylogger: Records every keystroke to capture passwords and sensitive information.
6. Ransomware: Encrypts files and demands payment for decryption. Examples: WannaCry, Petya, Locky. Process involves infection → download → encryption → ransom notice → payment demand.
7. Backdoor: Creates unauthorized access points into systems for future exploitation.
8. Adware: Displays unwanted advertisements, often bundled with free software.
Common Symptoms of Infection:
- Increased CPU usage (system running hot)
- Slow computer or browser speeds
- Network connectivity problems
- System freezing or crashing
- Files being modified or deleted
- Strange files or icons appearing
- Programs running or closing automatically
- Unusual computer behavior
- Emails sent without user knowledge
Comprehensive Countermeasures:
Technical Controls:
- Install and maintain quality antivirus software
- Regular virus definition updates
- Enable firewalls at network and host levels
- Implement intrusion detection systems
- Regular security patches and updates
- Email filtering and spam protection
- Web content filtering
Administrative Controls:
- Security awareness training for all users
- Clear acceptable use policies
- Incident response procedures
- Regular security audits
User Best Practices:
- Never open attachments from untrusted sources
- Caution when downloading files
- Avoid suspicious websites
- Verify software legitimacy before installation
Data Protection:
- Regular automated backups
- Offline backup copies (air-gapped)
- Test restore procedures
- System restore points
Conclusion: Effective malware protection requires a layered approach combining technology, policies, and user awareness. No single solution is sufficient - organizations must implement comprehensive strategies addressing prevention, detection, and recovery.