IT Security: Defense against the digital dark arts. Week6: Creating a Company Culture for Security | 20 Question and Answers (A+ guide solution)

What are some examples of security goals that you may have for an organization? Check all that apply. - to prevent unauthorized access to customer credentials to protect customer data from unauthorized access; These are super important goals. Safeguards or systems should be implemented to help achieve them. It's important to distinguish between a discrete goal and the mechanisms or defense systems that help you to achieve these goals. Defenses on their own aren't goals, but they allow us to work towards these goals. Which of these would you consider high-value targets for a potential attacker? Check all that apply. - customer credit card information authentication databases; Customer credit card data is really valuable to attackers, since it can be a hot commodity in the shadier areas of the internet. The same goes for authentication databases, since this could provide attackers with usernames and passwords that might give them access to accounts on other websites and services. What's the purpose of a vulnerability scanner? - it detects vulnerabilities on your network and systems; A vulnerability scanner will scan and evaluate hosts on your network. It does this by looking for misconfigurations or vulnerabilities, then compiling a report with what it found. What are some restrictions that should apply to sensitive and confidential data? Check all that apply. - it can be stored on encyrpted media only; Sensitive data should be treated with care so that an unauthorized third-party doesn't gain access. Ensuring this data is encrypted is an effective way to safeguard against unauthorized access. What's a privacy policy designed to guard against? - misuse or abuse of sensitive data; Privacy policies are meant to govern the access and use of sensitive data for authorized parties. You're interested in using the services of a vendor company. How would you assess their security capabilities? Check all that apply. - ask them to provide any penetration testing or security assessment reports