ISC S3

Define data breaches, service disruptions, and compliance risks.

• Data Breaches: Unauthorized access, acquisition, or disclosure of sensitive, protected, or confidential data.\n• Service Disruptions: Events or attacks (like DDoS) that cause systems, networks, or applications to become unavailable to authorized users, hindering operations.\n• Compliance Risks: The risk of legal penalties, financial forfeiture, or material loss an organization faces when it fails to act in accordance with industry laws, regulations, or prescribed internal controls.

Identify some examples of threat agents.

Threat agents (or actors) include: Cybercriminals, hacktivists, state-sponsored actors, malicious insiders (employees/contractors), accidental insiders (human error), and automated bots.

Describe the concept of network-based attacks.

Network-based attacks target the network infrastructure, communication protocols, or data in transit between devices, looking to exploit vulnerabilities in network services or configurations rather than individual system files.

Identify some examples of methods and mechanisms related to network-based attacks.

• Denial of Service (DoS / DDoS)\n• Man-in-the-Middle (MitM) attacks\n• Packet sniffing / Eavesdropping\n• IP Address Spoofing\n• Port scanning

Identify some examples of methods and mechanisms related to application-based attacks.

• SQL Injection (SQLi)\n• Cross-Site Scripting (XSS)\n• Buffer overflow\n• Remote Code Execution (RCE)\n• Brute-force / Credential stuffing

Define host-based attacks and identify some examples of host-based attacks.

• Definition: Attacks directed against a single, specific computer host or endpoint rather than the network layout itself.\n• Examples: Malware installations (viruses, worms, trojans), ransomware encrypting local drives, spyware/keyloggers, and local privilege escalation.

Identify some examples of social engineering attacks.

• Phishing (Email)\n• Spear phishing (Targeted email)\n• Smishing (SMS) / Vishing (Voice)\n• Baiting / Tailgating\n• Pretexting

Identify some examples of physical (on-premises) attacks.

• Tailgating / Piggybacking through secure doors\n• Dumpster diving for paper documentation\n• Hardware theft (laptops, servers, flash drives)\n• Planting unauthorized physical keyloggers or rogue USB devices

Identify some examples of supply chain attacks.

• Compromising third-party vendor software updates (e.g., SolarWinds)\n• Inserting malicious code into open-source software libraries\n• Tampering with hardware components during manufacturing or transit

Identify the stages of a cyberattack.

1. Reconnaissance (Gathering intelligence)\n2. Weaponization & Delivery (Creating and sending the exploit)\n3. Exploitation & Installation (Executing code and planting malware)\n4. Command & Control (C2 - Establishing remote access)\n5. Actions on Objectives (Exfiltrating data or disrupting systems)

Identify specific risks to cloud computing.

• Data loss / Leakage due to weak access controls\n• Insecure Application Programming Interfaces (APIs)\n• Misconfigured cloud storage buckets\n• Shared technology vulnerabilities (hypervisor escapes)\n• Lack of visibility / Limited control over infrastructure

Identify specific risks to mobile technologies.

• Unsecured public Wi-Fi connections\n• Lost or stolen physical devices lacking remote wipe features\n• Malicious mobile apps (sideloading)\n• Outdated mobile operating systems bypassing patch management

Identify specific risks to the Internet of Things (IoT).

• Weak, hardcoded, or default passwords\n• Inability to easily patch or update firmware\n• Device spoofing and unauthorized network entry\n• Lack of built-in encryption for data in transit

Identify the phases typically involved in threat modeling.

1. Identify Objectives (What needs protection)\n2. Deconstruct the System (Mapping architecture, data flows, and trust boundaries)\n3. Identify Threats (Locating potential entry points and vulnerabilities)\n4. Identify Vulnerabilities (Evaluating weaknesses)\n5. Mitigate and Respond (Implementing countermeasures)

Identify three commonly used methodologies for threat models.

1. STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege)\n2. PASTA (Process for Attack Simulation and Threat Analysis)\n3. DREAD (Damage, Reproducibility, Exploitability, Affected users, Discoverability)

Identify the three internal control objective groups in the COSO framework.

The three objective groups (ORC) are:\n1. Operations Objectives: Relate to the effectiveness and efficiency of an entity's operations.\n2. Reporting Objectives: Relate to internal and external financial and non-financial reporting reliability, timeliness, and transparency.\n3. Compliance Objectives: Relate to adherence to applicable laws and regulations.

Identify the five components of the COSO internal control framework.

The five components (CRIME) are:\n1. Control Environment: The tone at the top and organizational standard for internal control.\n2. Risk Assessment: The identification and analysis of risks to achieving objectives.\n3. Control Activities: Policies and procedures that ensure management's directives are carried out.\n4. Information and Communication: Identification, capture, and exchange of information to support controls.\n5. Monitoring Activities: Ongoing or separate evaluations to ascertain whether controls are functioning.

Describe the concept of security policies and what they outline.

Security policies are high-level statements and directives issued by senior management that define an organization's commitment to security. They outline security objectives, assign responsibilities, establish acceptable behaviors, and define consequences for non-compliance.

Describe the concept of an acceptable use policy (AUP).

An Acceptable Use Policy (AUP) is a formal agreement outlining the constraints, rules, and practices that an employee or user must agree to in order to access the corporate network, internet services, and IT assets.

Describe the concept of a bring-your-own-device (BYOD) policy.

A BYOD policy governs the deployment, management, and security of employee-owned personal devices (smartphones, laptops, tablets) used to access sensitive corporate systems, data, and networks.

Describe the concept of network segmentation or isolation.

Network segmentation is the practice of splitting a larger computer network into smaller, isolated subnetworks (segments). It improves performance and security by preventing lateral movement of threat actors if one segment is compromised.

Define a virtual private network (VPN).

A Virtual Private Network (VPN) creates a secure, encrypted connection (or tunnel) over a less secure network, such as the public internet, to protect data in transit between remote users and a private corporate network.

Describe the concept of system hardening and identify four examples of system hardening.

• Concept: Securing a system by reducing its surface of vulnerability and minimizing its attack surface.\n• Examples: (1) Changing default administrative credentials, (2) Disabling unnecessary ports and services, (3) Removing unused software/applications, (4) Keeping patches and operating systems fully updated.

Identify some of the more prevalent practices related to authorization and authentication in access management.

Prevalent practices include: Implementing the Principle of Least Privilege (PoLP), Separation of Duties (SoD), role-based access control (RBAC), automatic account lockouts after failed attempts, and enforcing strong password complexity rules.

Identify the various authentication technologies available to secure access to confidential data.

• Multi-Factor Authentication (MFA) combining something you know, have, or are\n• Biometric scanners (fingerprint, facial recognition)\n• Single Sign-On (SSO)\n• Security tokens / Authenticator apps\n• Smart cards / Digital certificates

Define vulnerability management and the common tools to facilitate vulnerability management.

• Definition: The cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating software flaws and system vulnerabilities.\n• Common Tools: Automated vulnerability scanners (e.g., Nessus), patch management software, and asset management discovery tools.

Describe the concept of defense in depth related to common layered solutions.

Defense in Depth is a security strategy that implements multiple layers of redundant defensive controls throughout an information system. If one security control layer fails, subsequent layers (e.g., firewalls, physical controls, encryption, endpoint security) are in place to block the attack.

Identify the tactics employed by organizations as preventive controls.

Preventive controls are designed to deter or stop an unwanted event before it occurs. Tactics include: Firewalls, MFA, physical locks, antivirus/antimalware software, security awareness training, and encryption.

Describe the concepts of detective controls and corrective controls.

• Detective Controls: Designed to identify and discover security incidents or errors after they have occurred (e.g., log reviews, intrusion detection systems (IDS), bank reconciliations).\n• Corrective Controls: Designed to remedy, reverse, or fix the damage resulting from an identified incident and restore systems to normal operations (e.g., system backups, disaster recovery plans, patch installation).

Identify the four components to manage risk under the NIST Special Publication 800-39.

The four components are:\n1. Frame Risk: Establishes the context for risk-based decisions and organizational risk tolerance.\n2. Assess Risk: Identifies, analyzes, and estimates the level of risk to organizational operations and assets.\n3. Respond to Risk: Determines and implements consistent, organization-wide courses of action to address identified risks.\n4. Monitor Risk: Continuously tracks risks and evaluates the effectiveness of response measures over time.

Identify the key items generally included in a Security Assessment Report (SAR).

A SAR generally includes: An executive summary of the organization's security posture, a detailed list of identified vulnerabilities and weaknesses, an assessment of the risks associated with those vulnerabilities, and recommended remediation plans or corrective actions.

Describe the benefits to organizations resulting from the security assessment process.

Benefits include: Identifying and mitigating hidden vulnerabilities before exploitation, validating the operating effectiveness of current controls, ensuring compliance with relevant legal and regulatory frameworks, and providing senior management with data-driven insights to optimize security investments.

Regarding security awareness, what are the three generally relevant categories of personnel ...

The three categories are:\n1. General Users: Standard employees who need baseline training on basic cyber hygiene and common threats.\n2. Privileged Users: IT admins, managers, or personnel with elevated system access requiring advanced security protocols.\n3. Executives / Senior Leadership: High-level decision-makers who require specialized training on strategic risk, compliance, and highly targeted attacks like BEC (Business Email Compromise).

Identify the components of a successful security awareness program.

A successful program includes: Clear management backing and policy definition, regular and interactive training sessions, automated phishing simulation exercises, continuous reinforcement via newsletters or signage, and metric tracking to measure behavior improvement.

Identify some examples of metrics included in phishing simulations.

Common simulation metrics include: Click-through rate (percentage of users who clicked the malicious link), reporting rate (percentage of users who correctly flagged the email), compromise rate (users who entered credentials or downloaded attachments), and training completion time.

Describe the differences between confidentiality and privacy in the context of cybersecurity.

• Confidentiality: Focuses on protecting sensitive information (corporate secrets, trade secrets, data) from unauthorized access or disclosure.\n• Privacy: Focuses on the rights of individuals regarding how their personal information (PII) is collected, processed, stored, used, and shared by an organization.

Define and provide basic examples of personal identifiable information (PII).

• Definition: Any information that can be used to distinguish or trace an individual's identity, either alone or when combined with other personal or identifying information.\n• Examples: Full name, Social Security Number (SSN), driver's license number, passport number, biometric records, and financial account numbers.

Identify common safeguards utilized by organizations to manage PII and proprietary informa...

Common safeguards include: Data minimization (only collecting what is strictly needed), implementing robust data encryption (both at rest and in transit), role-based access control (RBAC), regular data classification audits, and formal data retention/destruction schedules.

Identify three of the most common data obfuscation applications to help protect confidentia...

The three most common applications are:\n1. Encryption: Using mathematical algorithms and cryptographic keys to render data unreadable without the proper decryption key.\n2. Tokenization: Replacing sensitive data elements with non-sensitive equivalents (tokens) that have no extrinsic value.\n3. Data Masking: Altering or hiding specific data characters (e.g., hiding all but the last four digits of a credit card number: ************1234).

Describe symmetric and asymmetric encryption.

• Symmetric Encryption: Uses a single, shared private key to both encrypt and decrypt data. It is highly efficient for large data sets but presents key distribution challenges.\n• Asymmetric Encryption: Uses a mathematically linked public-private key pair. The public key encrypts the data, and only the corresponding private key can decrypt it. It resolves key distribution issues but is more computationally resource-intensive.

Identify two of the most common cipher techniques that encode unencrypted messages into ...

The two primary cipher techniques are:\n1. Stream Ciphers: Encrypts data one bit or one byte at a time in a continuous stream (highly efficient for real-time data or communications).\n2. Block Ciphers: Encrypts data in fixed-size blocks (e.g., 128-bit blocks) simultaneously (highly secure for structured data storage, such as AES).

Identify five safeguards that should be in place to protect data-at-rest.

Safeguards include: (1) Full disk or database encryption, (2) Strong logical access controls (MFA and Least Privilege), (3) Physical security measures for servers and data centers, (4) Regular, securely stored, and tested data backups, and (5) Endpoint protection tools like firewalls and device-level security configuration.

Identify the steps of performing a walk-through.

1. Plan and Scope: Identify the specific transaction type or system process to review.\n2. Trace a Transaction: Trace a single transaction or event from its initial entry point completely through to final reporting.\n3. Interview Personnel: Observe and talk to staff performing the tasks to verify standard procedures match documented policies.\n4. Document Findings: Record notes, system screenshots, and evidence to identify any potential control gaps or variances.

Define an incident response plan (IRP).

An Incident Response Plan (IRP) is a formal, written document that provides instructions and structured procedures for an organization to detect, respond to, contain, mitigate, and recover from a cybersecurity incident or cyberattack.

Depending on an entity's size and business model, different structures may be better suited for adoption. What models are reommended by NIST

Different structures for an Incident Response Team (IRT/CSIRT) include:\n1. Centralized Team: A single, core team handles incident response for the entire organization (best for smaller, single-location entities).\n2. Distributed Team: Multiple distinct response teams, each responsible for a specific physical location or business unit (best for large, decentralized entities).\n3. Coordinated Team: A central team provides guidance and oversight, but local teams handle actual execution (hybrid approach).

Identify the factors that organizations should consider when selecting the appropriate structure and staffing models for incident response teams under NIST computer secuirty incident handling guide.

Factors include: (1) The geographic distribution and location of corporate facilities, (2) The overall size, complexity, and structure of the organization, (3) Available internal IT/security staff and expertise, (4) Funding and budget constraints, and (5) The likelihood and expected frequency of security incidents.

Define event, cybersecurity event, adverse event, incident, computer security incident, and cyber security incident in a cybersecurity context.

• Event: Any observable occurrence in a system, network, or environment.\n• Cybersecurity Event: An event that impacts or involves information security or a system configuration.\n• Adverse Event: An event with a negative consequence or negative outcome.\n• Incident / Computer Security Incident: A violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.\n• Cyber Incident: An unauthorized act or event on an information system that jeopardizes its security, integrity, or availability.

What are the seven widely recognized steps in responding to incidents?

1. Preparation (Establishing policies, tools, and the response team)\n2. Detection and Identification (Alerting and determining if an incident occurred)\n3. Containment (Limiting the scope and spread of the attack)\n4. Analysis and Investigation (Determining the root cause and extent of damage)\n5. Eradication (Removing the threat, malware, or compromised elements from the environment)\n6. Recovery (Restoring affected systems and returning to normal business operations)\n7. Lessons Learned / Post-Incident Activity (Documenting findings to improve future response)

Identify some common methods of testing when organizations periodically test whether IRP plans respond as expected to both hypothetical and actual cybersecuirty threats.

Common testing methods include:\n1. Tabletop Exercises: Discussion-based walkthroughs of hypothetical cyber scenarios with key stakeholders.\n2. Walkthroughs / Checklists: Reviewing documented steps and checklists to ensure clarity and role assignments.\n3. Simulations: Practical, operational exercises where technical teams respond to a simulated attack in a controlled or sandbox environment.\n4. Parallel / Live Testing: Full-scale execution of the plan, sometimes including system cutovers, to evaluate real-time coordination.

Identify some of the most common losses related to a cyberattack that are typically covered by cyber insurance.

Commonly covered losses under cyber insurance include: (1) Data breach forensic investigation costs, (2) Business interruption losses and lost revenue, (3) Cyber extortion and ransomware payments, (4) Legal defense costs, notification expenses, and public relations management, and (5) Regulatory fines and penalties (where permitted by law).