Identify and Assess Cybersecurity Threats Flashcards

When assessing a threat's potential impact, which factor distinguishes a high-impact threat from a low-impact one?

Answer: The degree of harm to confidentiality, integrity, or availability of critical assets

Impact is measured by the extent to which a threat event would harm the organization's critical assets in terms of the CIA triad: confidentiality, integrity, and availability.

An organization wants to understand which threat actors are most likely to target them specifically. Which activity best supports this goal?

Answer: Conducting threat actor profiling using OSINT and sector-specific intelligence

Threat actor profiling uses open-source intelligence and sector-specific threat feeds to identify which adversaries have the capability, intent, and history of targeting similar organizations.

What distinguishes a worm from a traditional virus in terms of propagation?

Answer: Worms self-replicate across networks without user interaction; viruses require a host file

Unlike viruses that require a host file and user action to spread, worms independently replicate and propagate across networks by exploiting vulnerabilities.

In a threat assessment, 'threat exposure' refers to:

Answer: The degree to which an organization's assets are accessible to identified threat actors

Threat exposure measures how accessible an organization's valuable assets are to potential threat actors, considering factors like attack surface and existing controls.

Which of the following best describes a watering hole attack?

Answer: Compromising a website frequently visited by the intended targets to deliver malware

In a watering hole attack, adversaries compromise websites that targeted victims regularly visit, turning those trusted sites into malware delivery mechanisms.

An analyst uses the Cyber Kill Chain to understand an intrusion. At which phase would credential theft using a keylogger most likely occur?

Answer: Actions on Objectives

Credential theft via a keylogger occurs during the 'Actions on Objectives' phase, after the attacker has established access and is actively pursuing their end goal.

What is the key difference between a threat assessment and a vulnerability assessment?

Answer: A threat assessment focuses on potential attackers and their capabilities; a vulnerability assessment identifies weaknesses in systems

Threat assessments analyze potential adversaries, their motivations, and attack methods, while vulnerability assessments identify specific weaknesses in systems that could be exploited.