Week 4 (Detailed)

What is the key organisational requirement for an effective InfoSec programme

Support from senior management

What is the CIO primarily responsible for

Advising senior executives on strategic planning affecting information management

What is the CISO primarily responsible for

Assessing managing and implementing information security in the organisation

Who does the CISO usually report to

The CIO

Why is the CISO role not just technical

It balances security business needs budget and compliance

What is shadow IT

Software and tools used without approval from IT

What dilemma can ransomware create for a CISO

Choosing between quick recovery and payment versus risk based decisions and long term resilience

What dilemma can insider threats create

Balancing rapid action on suspicion with an ethical internal investigation

Who may be part of an information security project team

A champion team leader policy developers risk specialists security professionals system administrators and end users

What is the purpose of an information security project team

To bring together technical and non technical expertise needed for security work

What is an information security policy

An organisational rule defining acceptable and unacceptable behaviour

What does a security policy protect

The organisation's assets

What is a security standard

A detailed statement of what must be done to comply with policy

What do practices procedures and guidelines explain

How to comply with policy

What makes a security policy effective

It is distributed read understood agreed to and enforced consistently

What is a practice in security governance

A commonly followed way of complying with policy

What is a procedure in security governance

Step by step instructions for carrying out a task

What is a guideline in security governance

Recommended advice that helps people follow policy

What is an example of a password policy

Use strong passwords and change them frequently

What is an example of a password standard

Require at least ten characters including uppercase lowercase number and special character

What does SETA stand for

Security Education Training and Awareness

What is the main purpose of SETA

To reduce accidental security breaches by improving awareness skills and knowledge

What is security education intended to achieve

Deep long term understanding of security concepts and principles

Who is security education often aimed at

IT staff security professionals and management

What is an example of security education

Degree programmes certifications and courses on risk management or compliance

What is security training intended to achieve

Teach people to perform specific security tasks and follow procedures

Who is the audience for security training

All staff especially people handling sensitive systems or data

What are examples of security training

Handling classified information recognising phishing and reporting incidents

What is security awareness intended to achieve

Build a security minded culture and keep employees alert to threats

Who should receive security awareness

Everyone in the organisation

What are examples of security awareness activities

Posters newsletters short videos awareness campaigns and simulated phishing

What are the overall goals of SETA

Reduce human error support compliance and improve organisational resilience

How does awareness differ from training

Awareness helps people recognise threats while training teaches specific responses and skills

How does training differ from education

Training develops practical response skills while education builds deeper understanding and insight

How does education support continuous improvement

It gives people background knowledge to understand processes and improve them

How is awareness commonly assessed

True or false and multiple choice questions

How is training commonly assessed

Problem solving that applies learned skills

How is education commonly assessed

Essays that interpret learning

What is the typical impact timeframe of awareness

Short term

What is the typical impact timeframe of training

Intermediate

What is the typical impact timeframe of education

Long term

What is defence in depth

A layered security strategy using multiple overlapping defences to protect data systems and networks

What is the goal of defence in depth

Layer people processes and technology so attackers face more barriers and detection

Why is defence in depth resilient

If one layer fails another layer may still protect the system

What does physical security protect

Hardware and facilities from unauthorised physical access

What are examples of physical security controls

Locks access cards CCTV guards and biometric systems

What does network security protect

Data as it travels through networks

What are examples of network security controls

Firewalls IDS or IPS VPNs and network segmentation

What does perimeter security do

Controls who enters the outer boundary of the IT environment

What are examples of perimeter security controls

Secure gateways DMZs email and web filtering and DDoS protection

What does endpoint security protect

Devices such as laptops servers and mobile phones

What are examples of endpoint security controls

Antivirus endpoint detection and response and device encryption

What does application security ensure

Software is designed and maintained securely

What are examples of application security controls

Input validation secure coding and web application firewalls

What does data security protect

Information that is stored or transmitted

What are examples of data security controls

Encryption data masking access control backup and recovery

What is identity and access management intended to ensure

Only authorised users can access systems and data

What are examples of identity and access management controls

Multi factor authentication role based access control and least privilege

What does monitoring and response achieve

Fast detection of and response to security incidents

What are examples of monitoring and response controls

SIEM systems logging and a security operations centre

What does the human layer of defence in depth cover

Secure user practices through policies procedures and awareness

How can layered controls respond to a network attack

A firewall may block it and IDS or IPS may detect it if the firewall fails

How can endpoint protection help if an attacker reaches a device

It can block malware

How can multi factor authentication help if credentials are stolen

It can block an unauthorised login

How can encryption help if an attacker accesses data

It can prevent the attacker from reading stolen data

What are the benefits of defence in depth

Redundancy resilience visibility and compliance

What are limitations of defence in depth

It can be costly and complex with overlapping tools and ongoing integration and maintenance needs

What are the two broad categories of AI security threats

Adversarial use of AI and vulnerabilities in AI systems

How can attackers use AI for social engineering

They can create convincing phishing messages voice clones and video deepfakes

How can AI support automated vulnerability research

It can analyse code identify potential zero day vulnerabilities and help generate polymorphic malware

What is prompt injection

Crafted input that attempts to override an AI system's instructions

What is indirect prompt injection

Malicious instructions hidden in content such as web pages or documents read by an AI agent

What is data poisoning

Corrupting training or fine tuning data to cause misclassification or introduce backdoors

What is data or model leakage

Unintended disclosure of sensitive information such as intellectual property personal data or credentials

Why must security governance adapt to AI

Traditional governance and security frameworks still apply but need to address AI specific risks

What new AI governance roles may be needed

AI safety officers data privacy leads for training data and AI system owners

What should AI roles and responsibilities clarify

Who owns risk data technical controls and accountability when an AI system fails or is attacked

What is a key policy concern with shadow AI

Staff may submit proprietary code or data to public language models

What AI security guidance can organisations provide

Acceptable use policies technical deployment standards and secure prompt engineering guidelines

How can SETA reduce AI related risks

Teach staff to recognise deepfakes and AI generated phishing and avoid blindly trusting AI outputs

What is trust bias in AI use

Blindly trusting AI output including output that may contain hallucinations

How can defence in depth be applied to AI systems

Use input validation guardrails model security output filtering monitoring logging and data isolation

What is the key message about awareness and compliance

Awareness alone does not guarantee compliance and sustainable programmes must build a security cultur