Identify and Assess Cybersecurity Threats Flashcards

Which of the following is the most common initial step in a cyberattack?

Answer: Phishing attack

Phishing attacks are the most common initial step in cyberattacks because they exploit human vulnerability rather than technical flaws. Attackers send deceptive emails or messages to trick individuals into revealing sensitive information or clicking malicious links, thereby gaining initial access to systems or networks. This often serves as the gateway for more sophisticated attacks, making it a prevalent starting point.

What does a vulnerability assessment primarily aim to identify?

Answer: System weaknesses and exposures

A vulnerability assessment is a systematic process of identifying security weaknesses and exposures within an organization's IT infrastructure, applications, and systems. Its primary goal is to discover potential entry points for attackers and assess the risk associated with these vulnerabilities. This proactive approach helps organizations prioritize and remediate security flaws before they can be exploited, strengthening their overall security posture.

Which tool is commonly used for network threat detection?

Answer: IDS

An Intrusion Detection System (IDS) is specifically designed to monitor network traffic and/or system activities for malicious activity or policy violations. It analyzes patterns and signatures to detect potential threats, generating alerts when suspicious behavior is identified. This makes it a primary tool for actively identifying and signaling network threats.

Which framework helps in understanding and classifying cyber threats?

Answer: MITRE ATT&CK

The MITRE ATT&CK framework is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It provides a structured way to understand and classify how attackers operate, enabling organizations to develop more effective threat detection, prevention, and response strategies. This framework is invaluable for mapping and analyzing cyber threats.

Why is asset classification important in threat assessment?

Answer: It identifies critical systems to secure first

Asset classification involves categorizing an organization's assets based on their value, sensitivity, and criticality to business operations. This process is crucial in threat assessment because it allows security teams to prioritize protection efforts. By identifying critical systems first, resources can be allocated effectively to secure the most vital components, maximizing security posture.

Which of the following best defines threat intelligence?

Answer: Understanding and anticipating cyber threats

Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications, and actionable advice about an existing or emerging menace or hazard to assets. Its core purpose is to help organizations understand the landscape of cyber threats, anticipate potential attacks, and make informed decisions to protect their systems proactively. It moves beyond raw data to provide actionable insights.