Question 1

Since mobile devices are smaller and less complex than high powered PCs, managing employee-owned mobile devices is relatively simple.

Accepted Answer

Managing employee-owned mobile devices can be challenging due to the variety of device types, operating systems, and security concerns. It requires the implementation of a mobile device management (MDM) solution to ensure proper security, data protection, and policy enforcement.

Question 2

Social engineering tactics are used by hackers and corporate spies to trick people into revealing login information or access codes.

Accepted Answer

Social engineering is a tactic used by cybercriminals to manipulate people into divulging sensitive information such as login credentials or access codes. This can be done through various means, such as phishing emails, pretexting, or baiting, among others.

Question 3

With the number of mobile apps hitting 1.3 million in mid-2012-compared to only 75,000 apps for PCs--managing employee-owned devices is more complex and expensive.

Accepted Answer

This statement is true. As there are more mobile apps compared to PC apps, it becomes more challenging to manage employee-owned devices, which can result in increased complexity and costs.

Question 4

One source of cybersecurity threats today are hacktivists, hacker-activists or hacking for a cause) who breach networks in an attempt to gain media attention.

Accepted Answer

Hacktivists are a real and significant source of cybersecurity threats, as they breach networks to advocate for their cause or to gain media attention.

Question 5

Your textbook lists 3 challenges associated with managing employee owned mobile devices used in the work place: 1) Increased costs of managing employee owned devices, 2) Employees using the devices for non-work related activity
e.g. personal social media, texting, personal phone calls) and 3) Morale issues related to the fact that some employees will have better, more expensive devices than others.

Accepted Answer

The answer of Your textbook lists 3 challenges associated with...

Question 6

One way that hackers and corporate spies trick people into revealing login information or access codes is pretexting; use of an incentive to get a user to perform an insecure action. A common application of this practice involves offering a free app or video for clicking a link in a text message and voting for best video game. Clicking the link downloads malware.

Accepted Answer

Pretexting is a form of social engineering where attackers create a fabricated scenario or pretext to trick individuals into providing sensitive information or access to resources. It does not necessarily involve offering an incentive like a free app or video, but rather relies on creating a believable story or pretext to obtain information or access.

Question 7

Organizations are subject to national and international regulations and standards that specify how data can or cannot be collected and stored, as well as how it must be made available in the event of an audit or legal action.

Accepted Answer

Organizations need to comply with regulations and standards related to data collection, storage, and retrieval to avoid legal and financial penalties. Failure to comply with these regulations can result in loss of reputation, revenue, and public trust. It is, therefore, essential for organizations to have a robust data management strategy in place that adheres to the applicable rules and best practices.

Question 8

A stealth network attack in which an unauthorized person gains access to a network and remains undetected for a long time is referred to as a Silent Sabotage attack.

Accepted Answer

A stealth network attack in which an unauthorized person gains access to a network and remains undetected for a long time is referred to as a Stealth Attack, not Silent Sabotage.

Question 9

One way that hackers and corporate spies trick people into revealing login information or access codes is pretexting; using a story that convinces someone that it is okay to reveal secret information.

Accepted Answer

Pretexting is a common tactic used by hackers and corporate spies to acquire sensitive information from individuals. It involves creating a false pretext or story to trick someone into revealing login information, access codes, or other confidential data. This can be done through a phone call, email, or social engineering tactics. It is important to be cautious and verify the identity of the person requesting sensitive information before sharing any information.

Question 10

One way that hackers and corporate spies trick people into revealing login information or access codes is baiting; use of an incentive to get a user to perform an insecure action. A common application of this practice involves offering a free app or video for clicking a link in a text message and voting for best video game. Clicking the link downloads malware.

Accepted Answer

This is an example of baiting, where an incentive (free app or video) is offered to the user to click on a link in a text message. However, the link downloads malware instead of providing the promised incentive.

Question 11

For many organizations, cloud technologies have worsened their exposure to security risks because they cannot enforce or verify their cloud providers' cybersecurity policies.

Accepted Answer

Cloud technologies have introduced new cybersecurity challenges for organizations, including the difficulty of verifying the security controls implemented by their cloud providers. Without a clear understanding of the cloud provider's cybersecurity policies and risk management processes, organizations may be exposed to potential security threats.

Question 12

Tactics used by hackers and corporate spies to trick people into revealing login information or access codes are referred to as "password crashing".

Accepted Answer

The correct term for this tactic is "phishing".

Question 13

Cyber threats will continue to emerge, evolve, and worsen over the next 10 years and beyond.

Accepted Answer

With the ever-increasing reliance on technology and interconnectedness, cyber threats are expected to become more advanced, widespread, and damaging over time. This will necessitate a continuous effort to adapt and improve cybersecurity measures to stay ahead of cybercriminals.

Question 14

A stealth network attack in which an unauthorized person gains access to a network and remains undetected for a long time is referred to as an Advanced Persistent Threat APT) attack.

Accepted Answer

This statement is true. APT attacks are often used by hackers to gain prolonged access to a network and steal sensitive data without being detected.

Question 15

To reduce the threat of security breaches related to employee owned devices, data and ISs need to be protected from unauthorized access, including when an employee's device is lost or stolen, or an employee leaves the company.

Accepted Answer

Protecting data and ISs from unauthorized access is an important preventive measure in reducing the threat of security breaches related to employee owned devices. This includes implementing security protocols to secure data and systems in case an employee's device is lost or stolen or when an employee leaves the company.

Question 16

Cloud computing has simplified cybersecurity since most cloud based networks are more secure than private networks maintained by individual organizations.

Accepted Answer

While cloud computing can provide security benefits, it is not necessarily true that all cloud-based networks are more secure than private networks. Cybersecurity still requires proper implementation and management, regardless of the network type.

Question 17

Critical infrastructure is defined as "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters."

Accepted Answer

This is the official definition of critical infrastructure as given by the Department of Homeland Security in the United States.

Question 18

Controls placed on employee-owned devices can infringe on personal privacy. For instance, organizations could know what sites were visited or movies were watched, what was done on sick days, what texts were sent/received, and all social media activities during work hours and off-hours.

Accepted Answer

Controls placed on employee-owned devices can indeed infringe on personal privacy by allowing organizations to monitor and track various activities on the devices, both during work hours and off-hours.

Question 19

Cost savings associated with allowing employees to use their own mobile devices almost always outweigh any increased IT costs associated with IT personnel needed to manage new and existing mobile devices.

Accepted Answer

Allowing employees to use their own mobile devices (BYOD - Bring Your Own Device) can lead to cost savings in terms of hardware procurement, but it often increases IT costs due to the need for enhanced security measures, support for a wider range of devices, and potential compliance issues. These increased IT costs can sometimes outweigh the initial savings on hardware.

Question 20

In the United States and other countries, protecting consumer data is not only a good business practice, it is required by law.

Accepted Answer

Many countries have laws, regulations, and guidelines for protecting consumer data, such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. Companies that fail to comply with these laws may face legal penalties, reputational damage, and loss of consumer trust. Therefore, protecting consumer data is not only a good business practice but also a legal requirement.

Quiz 5: Cybersecurity, Compliance, and Business Continuity