Introduction to Cybersecurity Fundamentals Flashcards

Practice flashcards covering the core concepts of cybersecurity fundamentals, including legal frameworks, attack chains, defender models, and risk assessment.

What is the primary UK legislation governing hacking offences and unauthorised access to computer material?

The Computer Misuse Act 1990.

What are the three key principles that distinguish a cybersecurity professional from a criminal?

Authorisation, Intent, and Scope.

What was the average cost of a data breach according to 2023 metrics?

$$4.45\,million$$

According to the transcript, how many days does it take on average to identify and contain a breach?

277 days

What is the difference between Information Assurance and Information Security?

Information Assurance is strategy-level (governance, risk, and 'what should we do'), whereas Information Security is implementation-level (firewalls, pentesting, and 'how do we do it').

What are the six stages of the Attack Chain?

1. Phishing Email, 2. Credential Theft, 3. VPN / Remote Access Login, 4. Internal Reconnaissance, 5. Privilege Escalation, 6. Data Exfiltration / Ransomware.

In the context of the Attack Chain, which control specifically breaks the chain at the 'Credential Theft' stage?

Multi-factor authentication (MFA).

What is the CompTIA Security+ term for the attack chain concept?

The cyber kill chain (Lockheed Martin model).

Which attacker profile is described as having low skill and using pre-written tools or automated scanners?

Script Kiddies.

How is an APT (Advanced Persistent Threat) defined?

A highly skilled, long-term campaign where the attacker maintains persistent access to a target environment over months or years, often nation-state sponsored.

What are the three categories of risk behaviour regarding humans in cybersecurity?

Malicious, Negligent, and Accidental.

What does the CIA triad stand for?

Confidentiality, Integrity, and Availability.

What is the 'DAD' triad and what does each letter represent?

The attacker's objective and the inverse of CIA: Disclosure, Alteration, and Denial.

Arrange the Security Policy Hierarchy from highest to lowest level.

Policy, Standards, Procedures, Guidelines.

What are the three elements of the SUF triad that are in constant tension during security design?

Security, Usability, and Functionality.

What is the formula for calculating Cyber Risk?

$$Cyber\,Risk = Impact \times Probability$$

What is the NCSC and which government agency is it an arm of?

The National Cyber Security Centre, which is the public-facing arm of GCHQ.

What does the PCI-DSS framework govern?

It is the Payment Card Industry Data Security Standard, mandatory for any organisation that stores, processes, or transmits card data.

What is the principle of 'Defence in Depth'?

The practice of layering multiple independent security controls so that if one layer fails, others remain to detect or contain the attack.

Define the four questions of the WHWH Consultant Model.

1. What are we protecting? 2. How could I break it? 3. What's the impact? 4. How do we fix it?

What is 'Shadow IT'?

The use of unauthorised applications, services, or devices that bypass corporate security controls.

What is 'Least Privilege'?

The principle that users and systems should have only the minimum access required for their specific role.