Which of the following is not a category used in the ATT&CK matrix when profiling threat actors and activities? Select one: a. Location b. Initial Access c. Defense Evasion d. Discovery Which of the following refers to recovering resources from backup after a security incident? Select one a. Reconstitution of Resources b. Restoration of Permissions C. Restoration of Capabilities and Services d. Patching eletes fo epecific astination

Which of the following is not a category used in the ATT&CK matrix when profiling threat actors and activities? Select one: a. Location b. Initial Access c. Defense Evasion d. Discovery Which of the following refers to recovering resources from backup after a security incident? Select one a. Reconstitution of Resources b. Restoration of Permissions C. Restoration of Capabilities and Services d. Patching eletes fo epecific astination

Principles of Information Security (MindTap Course List)

6th Edition

ISBN:9781337102063

Author:Michael E. Whitman, Herbert J. Mattord

Publisher:Michael E. Whitman, Herbert J. Mattord

Chapter5: Risk Management

Section: Chapter Questions

Problem 5E

See similar textbooks

Similar questions

Book title: Cybersecurity Essentials - Charles J. BrooksChapter 1 - Infrastructure security in the Real world From the information provided in the second scenario, consider the NIST functions detailed in this section and then write what to observe as they relate to each category. 1. Policy creation sample ofmanaging access to authorized devices and resources based on the following items (NIST PR.AC-1). 2. Method creation sample of controlling physical access to secured assets (NIST PR.AC-2). 3. Action plan creation sample of informing and training general employees (NIST PR.AT-1). 4. Plan sample of helping privileged users understand their job roles and responsibilities (NIST PR.AT-2). (Refer to screenshot for reference)
Which of the following is true regarding vulnerability appraisal? a. Vulnerability appraisal is always the easiest and quickest step. b. Every asset must be viewed in light of each threat. c. Each threat could reveal multiple vulnerabilities. d. Each vulnerability should be cataloged.
After reading the case presented in the module, write a short response to the following discussion questions and ethical decision making scenario. Discussion Questions Before the discussion at the start of this chapter, how do Fred, Gladys, and Charlie each perceive the scope and scale of the new information security effort? Did Fred’s perception change after that? How should Fred measure success when he evaluates Gladys’ performance for this project? How should he evaluate Charlie’s performance? Which of the threats discussed in this chapter should receive Charlie’s attention early in his planning process?
q16- Which of the following statements are FALSE regarding the process of managing cyber security incidents? a. Weaknesses that are identified as leading to the incident are remediated during the containment phase. b. The containment phase is concerned with limiting the ongoing damage from the incident. c. An incident report is produced as part of the Lessons Learned phase. d. An event must be classified as an incident before a response is mobilised.
Which of the following statements are FALSE regarding the process of managing cyber security incidents? a. The containment phase is concerned with limiting the ongoing damage from the incident. b. An incident report is produced as part of the recovery phase.. c. Weaknesses that are identified as leading to d. An event must be classified as an incident before a response is mobilis
In this section, you will prepare a risk mitigation plan using SimpleRisk. Before using SimpleRisk, you will create a paper-based plan. You will need to create three security controls in your risk mitigation plan: one control that reduces the asset value, one that reduces the vulnerability severity, and one that reduces the threat impact. Your security controls should also include examples of both strategic and tactical controls. You can refer to the following table for a clearer picture of the requirements. Security Control Reduces Level (strategic/tactical) Asset value Vulnerability severity Threat Impact Define three security controls designed to mitigate the risk associated with a recent leak of sensitive information that was stored in cleartext files. Once you have identified your security controls, use SimpleRisk to create a Risk Mitigation plan. You do not need to perform a management review in this section.
Question 5 Complete the first task in the Authorize step of the NIST RMF for the following controls- DDoS Mitigation; Vulnerability Management; Data Discovery and Classifacation. Full explain this question and text typing work only
Make sure you submit your proposal for a security education program. Artifacts that have been finished and polished are supposed to have all their parts. The input that was used to create it should be reflected in its final form. The proposal will include an executive summary, a communication plan, an introduction, the proposal's policies and procedures, the proposal's main body, the proposal's main body, the policies and procedures, the recommended remedies to security weaknesses, and the strategies to constantly monitor the company for hostile conduct.
Which of the following steps in the SQUARE process does the following explanation belong to: This step becomes important when there are diverse stakeholders. Group of answer choices Elicit security requirements. Perform risk assessment. Select elicitation technique. Develop artifacts.
Write up a case that pertains to one of the laws mentioned in the course content or another law that is relevant to the cybersecurity landscape. Make sure to include your references. You should use what you learned about Google Hacking to find actual court documents that detail the case, the charges levied, and results of the case. Finding pertinent primary sources of information in this field can be quite a challenge. Pick a case that has occurred in the last 7 years and summarize the main points of the case. Explain which laws were cited in the case and go into detail about why they were applied. You may need to take a closer look at the law in question to describe this. Explain the verdict of the case and your opinion of the ruling based on the law. In your opinion, does the law need reform or will it still apply in the future. Why or why not.
In this project, design your own case study involving a hypothetical cybersecurity scenario. After coming up with your case outline, you must identify: 1. The various types of stakeholders potentially affected by the case, and the differentstakes/interests they have in the outcome.2. The different types of cybersecurity professionals or practitioners that might be involved in a case like this, and their specific responsibilities.3. The potential benefits and risks of harm that could be created by effective or ineffective cybersecurity practices in the case, including ‘downstream’ impacts.4. The ethical challenges most relevant to this case 5. The ethical obligations to the public that such a case might entail for the cybersecurity professionals involved.6. Any potential in the case for disparate impacts on others, and how those impacts might affect the lives of different stakeholders 7. The ethical best-case scenario (the best outcome for others that the cybersecurity practitioners…
Assume that a security model is needed for the protection of information in your class. Using the CNSS model, examine each of the cells and write a brief statement on how you would address the three components occupying that cell.