Cyber and Data Security Risk Flashcards

A manufacturer's operations halt for six days after ransomware encrypts its production servers, though no customer data is stolen. Which first-party cyber insurance coverage most directly responds to the lost profits?

Answer: Business interruption

Cyber business interruption coverage pays lost income and extra expense caused by a network outage.

Under the NIST Cybersecurity Framework, which function covers developing and implementing activities to take action once a cybersecurity incident is detected?

Answer: Respond

The Respond function covers containment, analysis, mitigation, and communication about a detected incident.

An organization buys a cyber policy so that a carrier pays notification and forensic costs after a breach. Which risk treatment technique is this?

Answer: Risk transfer

Insurance shifts the financial consequences of a loss to another party, which is risk transfer.

An employee receives an email that appears to come from the CFO urgently requesting a wire transfer to a new vendor account. What is this attack most commonly called?

Answer: Business email compromise

Business email compromise impersonates executives or vendors to trick employees into sending funds.

Which control is primarily detective rather than preventive?

Answer: Intrusion detection system alerts

An IDS identifies suspicious activity after it occurs rather than stopping it beforehand.

A risk manager estimates a single data breach would cost $400,000 and expects one every four years. What is the annualized loss expectancy?

Answer: $100,000

ALE equals single loss expectancy times annual rate of occurrence: $400,000 × 0.25 = $100,000.

Which practice best limits the damage a compromised user account can do inside a network?

Answer: Principle of least privilege

Least privilege gives users only the access they need, limiting what an attacker can reach through one account.