ISM 3004 EXAM 4 QUESTIONS ANSWERED CORRECTLY LATEST UPDATE 2026

ISM 3004 EXAM 4 QUESTIONS ANSWERED CORRECTLY LATEST UPDATE 2026 Three reasons to secure data - Answers 1. It's the most valuable asset. 2. Privacy Regulations. 3. Systems can be hijacked. What are digital identities and why protect them? - Answers Log-in credentials such as usernames and passwords. To protect your identity. What is a zero day exploit? - Answers Everyday vulnerability becomes known to the world, because bad guys are using it to break into other people's systems. A hole in the software that is unknown to the vendor. This security hole is then exploited by hackers before the vendor becomes aware and hurries to fix it. According to the PWC report, what is the annual growth rate for security incidents? - Answers 66% Reading: Biggest hack in history. How did hackers get in ? - Answers An employee opened a bad email. Reading: Biggest Hack in History. What damage was suffered? - Answers In a matter of hours, 35,000 computers were partially wiped or totally destroyed. Without a way to pay them, gasoline tank trucks seeking refills had to be turned away. Saudi Aramco's ability to supply 10% of the world's oil was suddenly at risk. Employees had to use typewriters since they could not use the computer to prevent the virus from spreading further. What does it mean for something to be vulnerable? - Answers Susceptible to attack or harm. What are the broad categories of IT vulnerability? - Answers Physical Technological Human Percentage of laptops lost over their service life? - Answers 7% Stolen Veteran's Affairs laptop incident: What data was exposed, what was the impact? - Answers One laptop stolen! Exposure: name, SSN, birth date for 26.5 million people. Lawsuit settlement: 20 Mil Individual impact: ID theft Percentage of smartphones lost EACH YEAR? - Answers 5% About _____% of lost smartphones had sensitive data? - Answers 60% Were the lost smartphone protected? - Answers NO As a rule of thumb, each data record lost costs a company about $_____? - Answers $200 _____% of companies surveyed suffered loss of sensitive/confidential information from lost flash drives? - Answers 70% What is Shoulder Surfing? - Answers Acquiring sensitive information just by looking over somebody's shoulder. How do attackers use shoulder surfing? - Answers Stealing confidential data. Stealing mobile devices. A company's dumpster can be a "_________________________" to cybercriminals. - Answers Gold Mine of Information What kinds of information might be in a company's 'dumpster'? - Answers Pre-attack research What kinds of things actually contain the desired information from dumpster diving? - Answers Phone Lists, Print outs, and media How would the cyber-criminal use the information from the dumpster dive? - Answers SELL IT What risk must be considered when disposing of obsolete equipment? - Answers Computers and copy machines at risk due to their hard drives. As one example, why was one healthcare company over $1 million? - Answers Improper photocopy equipment disposal. What is a bug? - Answers A programming flaw or oversight that can be exploited. Is it reasonable to expect that large software systems would be truly and totally bug-free? Why? - Answers NO. There are millions of lines of codes that could contain bugs. What can an attacker do with a bug? - Answers Run undesired programs. Unauthorized data access. Gain full control. What are the three user password vulnerabilities? - Answers Sticky Notes: writing the passwords down. Guessable: people who know you. Lack on complexity: too simple. What are the root causes of problems with user passwords? - Answers Easily remembered. Resistant to change. Why are default password a potential security problem? - Answers Weak. Easily guessable. Doesn't change network identifier. Organizations spend most of their IT security dollars protecting _________________________. - Answers castle walls. These are corporate sites. Mobile devices are largely unprotected because they spend much time ________________________. - Answers Outside the castle walls. 2 examples of mobile/BYOD technical risks are: - Answers Direct data flow. Mobile Sync. Explain the problem with Direct Data Flow with Gartner research data. - Answers 25% of all corporate data traffic can go directly from the mobile device to corporate provider. Huge amount of data flowing around the world without protection. Explain the problem with Mobile Sync with Gartner research data. - Answers 40% of enterprise contact information will have leaked into Facebook such as customer information. What is Social Engineering? - Answers Process where outsiders exploit naive insiders; tricking. How is social engineering done? - Answers Take baby steps. Research your victim. Ask for help: plausible requests to the right people mentioning the right names. How does CERT define the term Insider? - Answers Current or former employee, contractor, or other partner that has or had authorized access and intentionally misused that access against the organization. Are insiders a serious threat? - Answers Yes, because 70% of incidents involve insiders. Reading: Beautiful Social Engineering Attack. What did the chemical engineer do that enabled the hacker to find him? - Answers Posted information on social media. Reading: Beautiful Social Engineering Attack. How did the hacker gain the chemical engineer's confidence? - Answers By talking to him. Reading: Beautiful Social Engineering Attack. What method did the hacker use to gain access to the target company's entire email system? - Answers An 8GB flash drive. Some people think that the attackers are just kids showing off their tech skills. True? - Answers FALSE What are the real drivers behind modern cyber-attacks. - Answers Money and power. What is the source of most malicious hacking? - Answers Cyber crime syndicates. Describe the characteristics of modern cybercrime syndicates. - Answers Large groups. Very Professional. Lots of money. Effective. Hacktivists - what characteristics typify hacktivist groups? - Answers Loose confederations of individuals dedicated to political activism, who seek publicly/fame on behalf of their political cause. What strategies do hacktivists use to accomplish their goals? - Answers Monetary pain to victims to force them to change behavior. Embarrass the target and damage their reputation. Seek to gain public support against the target. What is IP? - Answers Intellectual Property. That refers to the creations of the mind, such as inventions; literary and artistic works; designs; and symbols, names and images used in commerce - World Intellectual Property Org. Trade Secrets! The competitive advantage. Why do IP thieves typically steal it? - Answers To SELL it. What's a typical methodology for stealing IP? - Answers Gain Access: Step by Step, Social Engineering, brute force passwords, dump all passwords. Unauthorized file access. Intercept email. STAY HIDDEN. "Break into a company's IT assets, dump all the passwords, and over time, steal gigabytes of confidential information." In IP theft, one is often facing a determined human adversary. What characterizes this type of opponent? - Answers Not deterred by early failure. Repeated attacks. Variety of techniques. Significant resources from sponsors. What is malware? - Answers Bad software; disables computer systems, disrupts operations, stealing data - intended to do something harmful to you or your organization. Malware is software; must be executed to have an impact. What is a keylogger? - Answers Once it's on your computer, the malware will monitor every keystroke you type and send back to the cybercriminals. What is a bot? - Answers Remote control payload. Allows cybercriminals to do anything they want remotely. You can still operate your computer, but without your knowledge, they can send a control command to your machine whenever they want. What is Ransomware? - Answers When you execute the malware, it immediately installs on your machine and encrypts all your files with a password; sends message demanding money and giving instructions and passwords - great reason to have data backups. Types of systems targeted by malware: - Answers Computers - Windows, Mac, Linux, mobile devices. Risk posed by fraudulent mobile apps: - Answers We use these devices for high stakes activities; high level of popularity of mobile banking apps has led to unauthorized banking apps written by cybercriminals, predonminately an Android problem. Cryptowall is an example of what type of malware payload? - Answers Ransonware. What is the real cost of Cryptowall to organizations who are compromised by it? - Answers The real cost is not the ransom, it is the downtime caused by data not being accessible and IT overtime hours to fix things, and sometimes whole departments sitting on their hands. What's the FBI's advice to those organizations? - Answers If you had no backup, it was best to pay the ransom to get your files back. How do Trojans fool a user into executing them? - Answers Social engineering - the key - you are tricked to invite that malware into your computer. Do Trojans rely on software vulnerabilities to compromise a system? - Answers No. They exploit a weakness in the human character, not the computer software. Exploit human vulnerabilities, responsible for hundreds of millions of hacks every year. What is a Virus? - Answers Behaves like a biological virus - hides itself inside a host file, could be any sort of file. How do viruses and host files relate? - Answers When you become infected with a computer virus, it