CYSE 200T
Discussion: According to the researchers, what percentage of criminal justice programs include cybercrime coursework in their curriculum?
20%
In the context of the NIST Framework, which best describes the "Framework Profile"?
Aligning business functions, categories & sub-categories with business requirements, risk tolerance and resources of the organization.
An organization should have an incident response team available for anyone that discovers or suspects an incident. A possible structure for such an incident response team includes:
All of the above
Stakeholder protection needs and security concerns associated with the system need to be properly identified and addressed primarily in the Cybersecurity department, not in the entire life cycle.
FALSE
The Predictability aspect contains that all stakeholders are required to know the technical details about how a system processes Pll.
FALSE
The minority (less than 30%) of people uses a storing method like paper, files, electronic devices, or a password manager.
FALSE
The most basic definition of Cyber Harassment entails the repeated pursuit of an individual using electronic or Internet-capable devices.
FALSE
The social stigma associated with membership in the white power movement forced the members to abandon the internet as a critical resource and mainly participate in secret meetings.
FALSE
The three usability characteristics that users want from passwords are that is hard to remember, each system should have an own password and it should rarely change.
FALSE
When an organization is considering to establish a Cyber Security program, the first step is to conduct a risk assessment.
FALSE
When asked how secure the most frequently used password less than 20% answered with "completely" or "very" secure.
FALSE
Which group has been identified as the top threat to public safety within the United States.
FAR RIGHT GROUPS
The very nature of cyber technology is that related crimes are usually limited to state or national borders.
False
Patterns for Cyber Offenders: Half the females in this study committed which type of cyber crime?
Fraud
What is an important requirement in order to achieve security objects?
Fully integrate systems security engineering into systems engineering and its specialties
Digital Forensics refers to investigations of cyber, computer, electronic, or other types of cybercrimes.
True
The notion of "Social Construction" refers to...
the possibility that certain crimes are socially constructed as illegal acts
Human ICT evolution may be visualised as a three-stage rocket: Prehistory, History and Hyperhistory
true
Several models of radicalization identify the importance of cognitive openings. Those who are exposed to radicalized messages during a personal crisis or a period with a ____________ are receptive to new world views, as key to initiating the radicalization process.
SENSE OF LODGING
____ involves using the same key to both encrypt and decrypt data.
SYMETRIC-KEY
Which of the following is not considered a source of threat against critical infrastructure?
Script kitties: younger individuals working as a hobby to disrupt the power grid
Which of the following best describes an Access Control List?
A list of users who have the ability to take specific actions.
In the context of cybersecurity, which best describes the use of a "framework"
A set of standards, guidelines and best practices
Which of the following best describes a software-based firewall?
A software firewall runs on the operating system and intercepts packets as they arrive to a computer
What is an important difference between traditional forms of stalking and Cyber Stalking?
ALL OF THE ABOVE
How much time do people spent on the generation of a password.
BETWEEN A FEW MINUTES AND A COUPLE DAYS
Which cipher involves putting the message into rows of a fixed size?
COLUMNAR TRANSPOSITION CIPHER
An organization should have an incident response team available for anyone that discovers or suspects an incident. A possible structure for such an incident response team includes:
Central incident response system
An event is any observable occurrence in a system or network, which include a user connecting to a file share or a server receiving a request for a web page.
True
Which state is the only one that doesn't have statutes specifically addressing Cyber Stalking and Cyber Harassment (CH/CS)?
NEBRASKA
One of its advantages of cyptography is that it can give us ____
NON-REPUDATION
What is NOT a role of security system engineering.
Provide everybody that has access to the systems with sufficient information how to ensure system security.
Which of the following activities is NOT part of the "identify" function in the cybersecurity frame work?
Provide your employees safe passwords
Select all possible ways how systems are modified.
REACT MODIFICATION TO FIELD SYSTEMS PLANNED UPGRADES TO FIELDED SYSTEMS WHILE PLANNED UPGRADES TO SYSTES
Which of the following are NOT part of the 5 core activities of the NIST Framework?
React - Understand how to change software when an event is detected
Which of the following are considered a trend for physical threats against critical infrastructure?
Social media and new technologies are increasing the potential for security events
Most researchers agree that the process of radicalization into extremist movements cannot be explained by any one factor. One of the most influential frameworks identifies twelve mechanisms affecting radicalization at the individual, group and mass levels.
TRUE
Only a small proportion of posters among the white supremacist community have sophisticated technological backgrounds. Instead, most users demonstrate a basic degree of technological proficiency.
TRUE
The current state of legislation makes it very difficult to prove a case of Cyber Harassment beyond a reasonable doubt.
TRUE
Common elements for defining crime include which of the following?
Whether or not the behavior is Illegal, Harmful or Deviant
Discussion: According to the researchers, which are possible reasons why criminal justice programs have not more fully embraced cybersecurity offerings.?
all of the above
Ethics was a matter of rational and disembodied autonomous subjects, rather than a matter of social beings. ICTs challenge the long held ethical assumptions by calling for notions of
distributed responsibility
The Onlife Manifesto aims to prevent further conversation on the way in which a hyperconnected world calls for rethinking the referential frameworks on which policies are built.
false
The increased focus and public dialogue on security issues is forcing the creation of less resilient IT infrastructure due to overloaded IT Staff.
false
What term is used to refer to the new experience of a hyperconnected reality within which it is no longer sensible to ask whether one may be online or offline?
one life
What factor does it depend on if an event had an impact?
All of the above are correct
Select all elements that are part of the privacy engineering objectives.
MANAGEABILITY Predictability DISASSOCIABILITY
The largest and most consequential physical event on infrastructure to date was on Pacific Gas & Electric's (PG&E) Metcalf Substation (500 kilovolts [kV]) in California when it was attacked in April 2013 by snipers. Which of the following measures did PG&E NOT take to mitigate such events in the future?
Increased night vision surveillance
How does a Target Profile aid in buying decisions for an organization?
It can be used to inform or contribute to a decision about buying a product or service, in terms of cyber security.
Which of the following apply to Password Security
all of the above.
The National Infrastructure Protection Plan (NIPP) 2013 mentions several approaches to managing risks. Ideally, individual decisions should be based on the importance of the affected infrastructure, the cost of the mitigation measure(s), and the expected amount of risk reduction resulting from implementing the measure(s). The groupings included in NIPP 2013 are:
1 identify, deter, detect, disrupt, and prepare for threats and hazards; 2) Reduce vulnerabilities; 3) Mitigate consequences
Place the following steps in proper order when considering establishing a cybersecurity program.
1.Prioritize and Scope 2.Orient 3.Create a CURRENT profile 4.Conduct a Risk Assessment 5.Create a TARGET profile 6.Determine, analyze and prioritize gaps 7.Implement the Action Plan
Which of the following best describes the function of a firewall?
A firewall protects all company servers and computers by stopping packets from outside the organizations network that do not meet a strict set of criteria.
___________ is a weakness that could be used to harm the business.
A vulnerability
Which of the following is NOT considered an appropriate use of Framework Profiles.
ALL OF THE ABOVE
Select all acts and behavior that Cyber Harassment via email, instant messages or other means typically involves.
ALL THE ABOVE
Select all elements of the multidisciplinary approach that protecting privacy requires:
ALL THE ABOVE
When Chief Security Officers were asked "What should be the most important advances in security in the coming few years", which of these were their answers concerning securing end-to-end communication?
ALL THE ABOVE
Which of the following is not considered an action to take when considering software design?
Address the quality of people testing your software.
Label theory is concerned with which of the following?
All of the above
Something that might adversely affect the information your business needs to run is called a threat. The most common threats include:
All of the above
Which of the following are true regarding the 2015 Ukraine Cybersecurity Event?
All of the above are true
Which of the following are not capabilities assigned to users in an Access Control System?
Assign
According to the authors, an IT multi-functional response team requires collaboration with which other areas of the company?
Communications, legal, senior decision-makers and other relevant business experts
System security is the application of engineering and management principles, concepts, criteria and techniques to optimize security within the ____________ of operational effectiveness, time and cost throughout all _________________________________. Fill in the blanks.
Constraints; stages of the system life cycle
Which best describes a BYOD (Bring Your Own Device) Plan?
Creating a BYOD policy allows employees to integrate themselves more fully into their job and can bring higher employees satisfaction and productivity.
Select all issues that need to be considered when outsourcing the incident response team.
Current and future quality of work Division of responsibilities Sensitive Information revealed to the contractor Lack of organization -specific knowledge
An incident in which a cyber attack is used as a vector to achieve effects that are beyond the computer (i.e., kinetic or other effects) is a definition of which type of threat?
Cyber attack against critical infrastructure
What is the main purpose of the problem context in the systems security engineering framework?
Enables engineering teams to focus attention on acquiring as complete an understanding of the stakeholders problem as practical.
70% of the respondents in a survey about their attitude towards password requirements indicated that they prefer passwords to stay valid for less than 30 days to insure safety.
FALSE
After applying engineering analysis and design principles to deliver a system with the capability to satisfy stakeholder requirements, system engineers are responsible for the utilization, support and retirement as well.
FALSE
Cryptography uses digital certificates. They form a trusted link between the actual person or organization, their public key, and their digital signature. Two ways to form this trusted link is with certificate authorities and root certificates.
FALSE
More than 45% of the DOC employees have to manage more than 15 accounts at work.
FALSE
Risk can be managed and consequently companies are able to eliminate it.
FALSE
Since privacy and security are closely related, it is often beneficial to share leadership resources between these two disciplines.
FALSE
The ultimate objective of systems security engineering is to achieve absolut assurance that the system is adequately secure relative to all stakesholder´s obejctives. This implies that a system can be declared secure by observation.
FALSE
Which is NOT part of the The Four tiers of the NIST Framework Maturity Model?
FULL
Catastrophe bonds (commonly called "cat bonds") are...
Financial instruments designed to help manage the financial risks associated with potentially devastating natural disasters, such as hurricanes, earthquakes, floods, and typhoons
Incidents should not be handled on a first-come first serve basis but instead be prioritized based on relevant factors. Select all factors that influence the decision which incident to address first.
Functional impact of the incident Information impact of the incident Recoverability from the incident
are used to either encrypt or decrypt data, and in some situations they can act in a similar way to passwords.
KEYS
What does NOT represent a problem that can arise from processing Pll?
LOSS OF PRIVACY
The Recover Function helps an organization resume normal operations after an event. Select all activities that can be part of the recover function.
Make full backups of important business data and information. Make incremental backups. Consider cyber insurance. Make improvements to processes, procedures and technologies.
Which of the following are not identified as one of the key trends are impacting the grid and its components, assets, and systems?
Moore's law that the number of transistors on a chip doubles every year whole the costs are halved
Select the three contexts within which the activities are conducted, according to the systems security engineering framework.
PROBLEM SOLLUTION TRUSWORTHINESS
Which of the following is not considered to be a vulnerability to critical assets?
Power sub-stations
A major component of cyber security is encryption, which means any threat to this concept is a cross-system vulnerability of the greatest magnitude.
TRUE
Alarmingly employees seem to have a false perception of security around their work-related accounts. Around 35% perceive no major consequences if their passwords were compromised.
TRUE
Another key issue is that confidentiality, authenticity, integrity and non-repudiation all rely on the presumption that a private key has not been compromised.
TRUE
Cryptography is the art, science, practice and study of securing communications.
TRUE
If data has been signed by a private key, it can be verified by checking it with the public key.
TRUE
In a general sense, non-repudiation refers to whether an individual can dispute that they are the responsible party.
TRUE
In a survey the majority of participants (93.5%) indicated that their bureau has offered training on cybersecurity. Group of answer choicesTrue
TRUE
Privacy risk models can be used to factor the extent to which systems and processes are vulnerable to problematic data actions as well as the likelihood and its impact.
TRUE
The Disassociability element of the privacy preserving system requires that an individual´s identity or associated activities are actively protected or "blinded" from exposure.
TRUE
The current profile reflects an organization's current state of cyber security, while the target profile describes what the organization wants to become in terms of cyber security.
TRUE
The diary study conducted by Steves et al. in 2013 indicates that a user performs logins 23 times in a typical workday.
TRUE
Usability can be defined as the extend to which a product can be used by specific users to achieve specified goals with effectiveness, efficiency and satisfaction in a specified context of use.
TRUE
When conducting a Risk Assessment, an organization should start with the current risk management activities.
TRUE
n the United States, insurance is one of the principal risk management instruments, not only for aiding in recovery after a disaster but also for encouraging future investments that are more resilient to potential hazards.
TRUE
According to the researchers, a significant amount of crime is tied to...
Technology
Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event. Select the two elements of the function, risk is typically comprised of:
The adverse impacts that would arise if the circumstance or event occurs. The likelihood of occurrence
Which of the following is a key issue that helped NIST in the development of privacy engineering objectives and a risk model?
The need for more development tools that measure the effectiveness of privacy practices.
Which of the following are NOT a suggested action to take when considering a BYOD program?
The need for simpler login procedures
Who defines the scope of security in terms of the assets to which security applies and the consequences against which security is assessed?
The stakeholders
Common methods of attacks include attrition, web, email, impersonation and improper usage
True
Events with a negative consequence, such as system crashes, packet floods, unauthorized use of system privileges, unauthorized access to sensitive data, and execution of malware that destroys data, are called adverse events.
True
Likelihood is the chance that a threat will affect your business and helps determine what types of protections to put in place.
True
The incident response team can use the staffing models of performing all of its inciedent response work, partially outsourcing or fully outsourcing.
True
When selecting appropriate structure and staffing models for an incident response team, organizations should consider the need for 24/7 availability, full-time versus part-time members and the employee morale.
True
Which, according the the authors, best describes two-factor authentication.
When you log into your account from a unfamiliar computer for the first time, it sends you a text message with a code that you must enter to confirm you are really you.
When Chief Security Officers were asked "What should be the most important advances in security in the coming few years", which of these were their answers concerning Smarter Systems?
both the above
In organizations today, the role of CIO is increasingly filled by someone with an engineering background, to make sure that it is run as a part of Technology and not as a semi-separate entity.
false
Which of the following best describes a Hardware-based Firewall?
hardware firewall is a device that us connected to the network and filters packets based on as et of rules.
All of the following are true for public key cryptography except for:
it represents a systematic encryption.
What are the two categories that signs of an incident fall into?
precursors and indicators
Authentication can be accomplished by identifying someone through one or more of three factors. These factors are...
something they know, something they have, or something they are
The Neutralization theory suggests...
that individuals, while knowing right from wrong, rationalize of neutralized their behavior in or to give themselves the justification to commit a crime.
ICTs have a huge ethical, legal, and political significance.
true
If done right, security-by-design is not a burden, and should not be considered optional.
true
The incident response plan must contain details on when and how to communicate to the public about security incidents.
true
The main issue with BYOD is that most backend systems are not designed with this kind of flexibility in mind and the change from the perimeter model to a new cross-layer model of security is quite radical.
true
Although not everyone within an incident response team needs to have strong _____ and _____ skills, at least a few people within every team should possess them so the team can represent itself well in front of others.
writing and speaking