Cybersecurity Threats and Mitigation Flashcards

An employee receives an urgent email that appears to be from the company's CEO, requesting an immediate wire transfer to a new vendor. The email addresses the employee by name and references a recent project. However, the CEO's email address is slightly misspelled. This is an example of what type of attack?

Answer: Spear phishing

Spear phishing is a targeted form of phishing where attackers personalize their messages for a specific individual or organization. Unlike general phishing which uses a wide-net approach, spear phishing uses specific details (like the employee's name and a recent project) to appear more legitimate and trick the victim into performing an action, such as a wire transfer.

Which of the following is a primary defense mechanism designed to prevent unauthorized traffic from entering or leaving a private network by filtering data packets based on a set of security rules?

Answer: Firewall

A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. Its fundamental purpose is to act as a barrier between a trusted internal network and untrusted external networks, such as the Internet.

A user wants to enhance the security of their online accounts beyond just a password. Which of the following methods adds a second layer of security, typically involving a code from a mobile app, a text message, or a physical token?

Answer: Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) is a security system that requires more than one method of authentication from independent categories of credentials to verify a user's identity. This adds an additional layer of security, as a compromised password alone would not be enough to grant access.

A company's e-commerce website suddenly becomes inaccessible to all customers. The IT team discovers that the web servers are being flooded with an overwhelming amount of traffic from thousands of different compromised computers around the world. What type of attack is occurring?

Answer: Distributed Denial-of-Service (DDoS)

A Distributed Denial-of-Service (DDoS) attack is characterized by an attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. The use of thousands of different compromised computers (a botnet) is the key indicator of a 'distributed' attack.

A user reports that all their important documents have been replaced with unreadable files, and a note on their desktop is demanding payment in cryptocurrency to restore them. This is a classic example of what kind of malware?

Answer: Ransomware

Ransomware is a type of malicious software that encrypts a victim's files, making them inaccessible. The attacker then demands a ransom payment, often in cryptocurrency, in exchange for the decryption key needed to restore the files.

Which of the following security principles advocates for providing users and systems with only the minimum levels of access or permissions needed to perform their job functions?

Answer: Principle of Least Privilege

The Principle of Least Privilege (PoLP) is a cybersecurity concept in which a user is given only the minimum levels of access – or permissions – needed to perform their job functions. This mitigates risk by limiting the potential damage that can be caused by a compromised account or insider threat.