Cybersecurity & Risk Management Flashcards

A retail tobacconist store experiences a ransomware attack that encrypts all customer purchase records. What is the FIRST step the owner should take?

Answer: Disconnect affected systems from the network

Isolating infected systems from the network prevents ransomware from spreading to other devices or backups.

Which type of authentication provides the strongest protection for a tobacco retail POS system login?

Answer: Multi-factor authentication (MFA)

MFA requires multiple verification factors, making unauthorized access significantly harder even if one credential is compromised.

A tobacco retailer collects customer birthdate data for age verification. Under risk management best practices, this data should be:

Answer: Retained only as long as legally required, then securely deleted

Data minimization and retention limits reduce liability and comply with privacy regulations by not holding data longer than necessary.

An employee receives an email claiming to be from a tobacco supplier asking for urgent wire payment. This is most likely a:

Answer: Business email compromise (BEC) scam

Business email compromise scams impersonate trusted contacts to trick businesses into fraudulent wire transfers.

What does the term 'least privilege' mean in a retail cybersecurity context?

Answer: Each employee only has system access needed for their specific job role

Least privilege limits each user's access to only what they need, reducing the damage potential of compromised accounts.

A tobacco shop's Wi-Fi network is used for both the POS system and customer internet access. The BEST security practice is to:

Answer: Segment them into separate networks

Network segmentation ensures that a compromised guest network cannot expose the POS or sensitive business systems.

Which regulation most directly governs how a U.S. tobacco retailer must protect customers' payment card data?

Answer: PCI DSS (Payment Card Industry Data Security Standard)

PCI DSS sets the security standards for any business that accepts, processes, or stores credit/debit card payments.