Cybersecurity & Risk Management Flashcards

A tobacco retailer's loyalty program database containing member emails and purchase history is breached. Under most U.S. state laws, the business is required to:

Answer: Notify affected customers within a legally defined timeframe

Nearly all U.S. states have data breach notification laws requiring businesses to inform affected individuals within specified timeframes.

What is 'spear phishing' as distinct from general phishing attacks?

Answer: Highly targeted phishing that uses personalized information about a specific victim

Spear phishing uses personal details about the target to craft convincing, tailored messages that are harder to identify as fraud.

When evaluating third-party vendors who access a tobacco retailer's systems, risk management best practice requires:

Answer: Conducting vendor security assessments and including security requirements in contracts

Third-party vendors can introduce supply chain risks, so assessing their security posture and contractually requiring standards is essential.

Which of the following BEST describes 'defense in depth' as a cybersecurity strategy for a retail tobacco business?

Answer: Using multiple overlapping security layers so failure of one control doesn't expose the business

Defense in depth uses layered controls so that if one security measure fails, others remain to prevent or detect attacks.

A tobacco retailer wants to ensure employees know how to respond to cybersecurity threats. The most effective ongoing measure is:

Answer: Regular security awareness training with simulated phishing exercises

Regular training with realistic simulations keeps employees vigilant and improves detection rates for real phishing and social engineering attempts.

What does 'two-factor authentication' require compared to standard password login?

Answer: A password plus a second verification factor such as a code sent to a phone

Two-factor authentication combines something you know (password) with something you have (device) or are (biometric), significantly increasing account security.

In risk management terminology, what is the difference between a 'threat' and a 'vulnerability'?

Answer: A threat is a potential harm source; a vulnerability is a weakness that can be exploited by a threat

Threats are potential events or actors that could cause harm; vulnerabilities are the weaknesses those threats exploit to cause damage.