Cpp Some Concept (phase Xiv)

While phishing attacks, malware infections, and weak passwords are common and important threats to information security, the most frequently overlooked threat is inadvertent disclosure.

Sensitive information such as confidential personal details in employee files can be considered sensitive but not proprietary. Company logo design, employee handbook policies, and publicly available product pricing information can be considered proprietary or not as sensitive as personal information in employee files.

A fiduciary is a person entrusted with sensitive company information, not an automated system, legal document, or public figure.

Sensitive obsolete prototypes can pose a risk of being reverse engineered if not properly destroyed, potentially leading to the compromise of intellectual property or sensitive information.

Personally Identifiable Information needs to be safeguarded through clear markings and specific instructions for various scenarios to ensure privacy and security.

Competitive intelligence is primarily used to keep senior management informed of market changes and prevent unexpected developments.

The correct answer is 20 years because patents typically last for 20 years from the date of the first filing. This allows inventors to have a period of exclusivity to benefit from their inventions before others can freely use or replicate them.

Proprietary information refers to data or knowledge that a company wants to keep confidential to maintain a competitive edge or protect its operations. This can include customer lists, manufacturing processes, business plans, etc.

A non-disclosure agreement is typically required for all employees to protect confidential information. Restricting it to certain roles or departments could leave other employees with access to sensitive information without legal protection.

OPSEC, short for Operations Security, is a systematic approach to safeguarding sensitive information. Phishing, Spoofing, and Social Engineering are forms of cyber attacks that aim to deceive individuals into revealing confidential information.

Registering intellectual property rights ensures legal protection and gives the right holders exclusive rights to their creations, preventing others from using or profiting from them without permission.

While trademarks require registration for legal protection, copyrights, patents, and trade secrets can still hold legal standing without registration.

As cybercrime continues to evolve, security professionals must adapt and acquire a practical understanding of the new logical security paradigm to effectively combat these growing threats.

Script kiddies are individuals who use scripts or tools created by others to launch attacks without fully understanding the technical aspects of hacking.

Data mining is the process of discovering patterns in large datasets. While web scraping involves extracting data from websites, big data analytics focuses on analyzing large and complex datasets, and machine learning involves the use of algorithms to learn from data.

Access control to information systems encompasses the processes of identifying users, verifying their identities, determining what actions they are allowed to perform, and tracking their activities. Encryption, intrusion detection, data backup, firewall configuration, network scanning, security patching, penetration testing, password complexity, multi-factor authentication, single sign-on, and data loss prevention are important aspects of information security, but they do not specifically define access control measures.

Convergence is the correct term that refers to the integration of security resources for maximizing benefits, while the other options - Divergence, Isolation, and Fragmentation - do not represent the concept described in the question.

Incorporating improved response and recovery capabilities can help mitigate the risks associated with SCADA systems being exposed to the vulnerabilities of the internet by enhancing the system's ability to react and recover from potential cyber attacks or breaches.

IP video surveillance systems are vulnerable to various threats, including tampering and destruction of recordings. This can compromise the integrity and security of the surveillance data.

The correct answer highlights the risks associated with creating unauthorized accounts and potential compromise of the system through an infected PC. The incorrect answers focus on different aspects such as physical security, software maintenance, and technological dependencies to provide a variety of plausible dangers that are not the main concerns in this context.

The key objectives of an organisation's ISS program are to protect against compromise, unauthorised change, and unavailability by implementing security measures and policies.

The correct term for a flaw or weakness in an information system's design, implementation, or operation and management is known as an 'Information systems vulnerability'. While data breach, software bug, and network breach are related to security incidents, they do not specifically refer to the inherent weakness in the system itself.

Residual Risk is determined by multiplying the Threats and Vulnerabilities, then dividing by the Countermeasures in place. The correct answer reflects this formula accurately.

After authentication comes authorization in the process of logical access control, where the system determines the actions or tasks that the authenticated user is permitted to perform.

Virtual threats often enter computer networks through various malicious methods such as USB peripheral device attachment, hacking, malware, phishing, and social engineering. Downloading legal software updates, reading emails from known sources, and regularly updating antivirus software are not common ways for virtual threats to enter computer networks.

Social engineering involves manipulating people into performing certain actions or divulging confidential information that can compromise security. While the other options are also common IS vulnerabilities, social engineering specifically focuses on exploiting human behavior rather than technical flaws.

The 'salami effect' crime is most common in the banking sector due to the large number of financial transactions and accounts that can be targeted for small amounts of money, making it harder to detect.

Encrypting sensitive files is considered the most reliable protection method because it ensures that even if the data is accessed, it will be unreadable without the encryption key.