CYBER501x Cybersecurity Fundamentals Quiz 1

UNIT 1: Question 1
True or False: Information Security is a subset of cybersecurity.

• True
• False

UNIT 1: Question 2

Indicate the color of "hat" worn by each type of hacker by typing the appropriate letter next to the definition.

W = White, G = Gray, B = Black

Hacks into systems with malicious intent

Hacks into systems, without permission, and requests payment to fix vulnerabilities

Hacks into systems, with permission, to uncover vulnerabilities so they can be fixed




UNIT 1: Question 3

What is always going to be the weakest link of any cybersecurity system?

• Firewalls
• Malware
• Humans
• Encryption

Which type of hacking does not involve any technology?

• DDoS
• Penetration Testing
• Social Engineering
• White Hat Hacking

UNIT 1: Question 5
How do the growth rates of attack sophistication and intruder technical knowledge compare?

• Attack sophistication is growing more quickly
• Intruder technical knowledge is growing more quickly
• They are growing at the same rate
• They are both declining

UNIT 1: Question 6

Why is the MySpace hack still relevant today?

• Existing pages will be defaced
• People reuse passwords
• Credit card information might still be the same

UNIT 1: Question 7

True or False: Cybersecurity involves protecting data while it is in transit, while it is being processed, and when it is at rest.

• True
• False

UNIT 1: Question 8


Which two breaches started when a third-party’s credentials were compromised? (Select two)

• Home Depot
• Chase
• Target
• Houston Astros

UNIT 1: Question 9

The first hack of the Ukraine Power Grid started when an employee:

• Clicked on a link from PayPal
• Opened a Microsoft Word document correct
• Responded to spam
• Got fooled by a phone call and gave out confidential information verbally

UNIT 1: Question 10

If integrity hacks become prevalent, a direct result could be an increase in:

• The amount of malware
• The amount of Internet of Things devices affected
• The amount of time hackers can lurk on a network undetected correct
• The number of ransomware attacks incorrect

If you would like to learn more about the cybersecurity fundamentals and gain more insights than Security for Everyone (S4E) provides excellent services on different areas. With S4E: Education you get to understand different scenarios with quizzes and real-world attack situation.

A Guide to Effective Threat Hunting

Cybercriminal organizations today steal information because they see profit from it. It is where the money is. And waiting for an intrusion to occur is no longer an option. We need to proactively search for would‐be intruders and signs of potential future intrusions. This is what Threat Hunting is.

Threat hunting can be defined as a proactive approach to detect and respond to any unauthorized activity that occurs in an your environment. It is the pursuit of the evidence that attackers leave behind when they’re conducting reconnaissance, attacking with malware, or exfiltrating sensitive data.

Factors that motivates cyberattacks are as follows

- Financial gain
- Political statement
- Theft of intellectual property
- Disruption of critical infrastructure
- Revenge
- Fame

Just because intruders are not seen or technology hasn’t raised any alert of their presence doesn’t mean they aren’t there. The absence of security alerts only means that security mechanisms haven’t detected intrusion. Attackers, patient and resourceful, could get into virtually any organization provided they followed time‐proven techniques of research, reconnaissance, stealthy intrusion, and quiet exfiltration. The concept of assumption of breach accepts the very real possibility that intruders are already inside your networks and systems, regardless of your defenses and your ability (or inability) to detect them.

Attackers will often employ a path of least resistance to break into an organization, but no matter how they can get in, they consider it a win. Some of the methods used in attacks are following
- Stealthy malware
- Hacking the people
- Hacking the systems
- Recruiting insiders

Threat hunting should be systematic and hunters need to carefully and continuously look for anything that could be evidence of intrusion. Threat hunting needs to be instilled as a process that security teams make and schedule time for. The types of threat attributes that are hunted include the following:
- Processes: look for processes with certain names, file paths, checksums, and network activity
- Binaries: look for binaries with certain checksums, file names, paths, metadata, specific registry modifications, and many other characteristics
- Network activity: specific domain names and IP addresses
- Registry key modifications: registry key additions and modifications

What threat hunting is not
- Acquiring or analyzing threat intelligence
- Installing tools and waiting for alerts
- Reporting on incidents or intrusions
- Incident forensics

Skills required in threat hunting team
- Operating system internals
- Endpoint application behavior
- Threat hunting tools
- Incident response procedures

Technology: Getting the Necessary Tools in Place
- Complete endpoint visibility
- Obtaining the necessary network event data
- Threat intelligence gathering
- Integrating your information
- Data correlation and analytics tools

Traits of Master Hunter
- Strengthen organization’s overall posture
- Be Embedded in the Environment
- Research
- Developing Intuition. Intuition is also about (OODA) Observe, Orient, Decide, and Act.
- Educated hunches
- Strong opinions, loosely held. The only constant is change. Be open to change in information.
- Developing Your Own Tools and Custom Integrations
- Setting Landmines. A master threat hunter thinks ahead and anticipates what a known or a potential adversary might do.

Ten Tips to Effective Threat Hunting
- Know Your Environment
- Think Like an Attacker
- Develop the OODA Mindset
- Devote Sufficient Resources to the Hunt. Personnel, Tool, and Infrastructure.
- Deploy Endpoint Intel across the Enterprise
- Supplement Endpoint Intel with Network Intel
- Collaborate across IT
- Keep Track of Your Hunts
- Hone Your Security Skills. Trainings and Conferences
- Be Aware of Attack Trends

Reference: Threat Hunting For Dummies®, Carbon Black Special Edition by Peter H. Gregory

Zero-Width Spaces to Bypass MS Office 365 Protection

Cybercriminals and email scammers are using simple technique in the wild to bypass security features of Micorsoft Office 365. This includes Safe Links that was designed to protect users from phishing and malware attacks. Security researcher have been warning about this techniques.

As a part of Advanced Threat Protection (ATP) solution Safe Links has been included by Microsoft in Office 365. This works by replacing all URLs in an incoming email with Microsoft-owned secure URLs. When users click on a link included in an email, Safe Links sends to Microsoft owned domain that checks for any suspicions. If anything is detected then it warns users else directs to that link.

However, researchers at the cloud security company Avanan have revealed how attackers have been bypassing both Office 365's URL reputation check and Safe Links URL protection features by using Zero-Width SPaces (ZWSPs). Zero-Width are non-printing Unicode characters used to enable line wrapping in long words. All modern web browsers supports this and most applications take them as regular space. This is not visible to the eye.

1. ​ (Zero-Width Space)
2. ‌ (Zero-Width Non-joiner)
3. ‍ (Zero-Width Joiner)
4.  (Zero-Width No-Break Space)
5. ０ (Zero-Width Digit Zero)

Attackers are using multiple zero-width spaces within malicious URL in phishing emails which Microsoft does not recognize. And when users clicked on the link Microsoft did not find it suspicious and directs to the link. This is when users were landed to credentials harvesting phishing website. Link to demonstration can be found here.

How the URL looks to Microsoft Security: http‌s://go‌ogle.co‌m/

How it looks to users: https://google.com

Cyber Resilience

Achieve Cyber Resilience in seven easy steps

Steps 1: System Hygiene

Establish a proactive and systematic process for managing standard system hygiene.

Steps 2: Develop Plan

Create cross-functional team of senior management to plan for cyber security events and consider hypothetical attacks.

Steps 3: Map out Risk Profile

Study cyber pattern and attack modes to develop a tailored approach to protecting company assets.

Steps 4: Assess and Measure

Focus on rough figures, not precise estimates and avoid analysis paralysis.

Steps 5: Mitigate Risk

Invest in risk mitigation measures to protect company assets at greatest risks

Steps 6: Cyber Insurance

Obtain cyber insurance to provide contingent capital and specialized assistance in the event of attack.

Steps 7: Get Started

Get started with a rough plan. Becoming resilient to cyber risk starts with a single step.

CyberAwareness

How to become CyberAware?

• Identify Threats

First understand what are the cyber threats to your infrastructure. This includes both internal and external one. Internal could involve various threats posed by inappropriate use of privilege access or lack of awareness.

• Identify Vulnerabilities

Make a list of all critical systems and servers in your organization. Understand the consequence of cyber threat on these system. Moreover, understand the capabilities and limitations of existing protection measures.

• Assess risk exposure

Determine the likelihood of vulnerabilities that are being exploited by external threats and/or being exposed by inappropriate use.

• Develop protection and detection measures

Reduce the likelihood of vulnerabilities being exploited through protection measures and reduce the potential impact of a vulnerability being exploited.

• Establish contingency plans

Develop a response plan to reduce the impact of threats to your organization.

• Respond to cyber security incidents

Respond to cyber threats that are realized using response plan. Also, assess the impact of the effectiveness of the response plan and re-assess threats and vulnerabilities

Artificial Intelligence and Cyber Security

If you look into the trend of cyber attacks in recent years, it has increased drastically resulting in massive disruptive effects like interrupting commerce, shutting down hospitals and airports, and holding people and organizations ransom for their data. The bitter truth is what adversary has done to our privacy and the fear they keep us in. We never know when they will use their evil prowess to destroy us. This is the evil reality, and to combat and fight against such attacks we need expert machines that can help our security professionals.

Daily we see the cyber battle against organized crime, terrorists, thieves, etc. There are criminal enterprises who prey on our businesses and lives by exploiting people around the world. Cybersecurity is the only defense against these challenges. However, a perfect defense is not possible to create and the preventative measure will not always work as adversarial techniques evolve each day. Thus, a correct detective mechanism is required and significant assistance is needed to make security professionals more efficient and expand their intelligence. AI has come to help.

Artificial Intelligence (AI) is the ability of machines to perform tasks that would require intelligence if performed by humans. Its primary goal is to provide answers from massive archives of data. Smart machines are good at analyzing data using pattern recognition. Pattern recognition is a branch of machine learning and uses supervised and/or unsupervised learning methods to find patterns in data. Supervised learning allows for training of AI using labeled/classified data while unsupervised learning uses unlabeled/unclassified data. Deep learning is a branch of AI and an unsupervised machine learning that uses neural network and emulates human brains. It learns, collects information (data mining), and understands patterns.

Cybersecurity professionals use analytics to detect anomalies in network patterns, network traffic, and normal user activities. Exploits are identified by their signatures which works well with known patterns of attack. However, in the real world, there are many unknowns than knowns. So, cybersecurity has moved on from a signature based detection to behavioral based where each entity is scored based on their network's activities. This is called predictive analysis.

One of the goals of using AI in cybersecurity is to reduce out false positives. Computers, on their own, even really smart ones, fall prey to the false positive. But, using the insights of a computer in partnership with a human in a type of hybrid approach lowers the risk that non-malicious network use will be seen as a false positive. Because the AI is always learning, it can also learn from its human partner. The security researcher examines the alerts provided by the smart security system and determines which are and aren’t false positives. Those results are fed back to the AI, making it smarter. In time, the AI will report fewer false positives. 

In conclusion, artificial intelligence (AI) applied to cybersecurity provides security professionals with an augmented ability to protect endpoints, data, and networks. It provides insight to quickly and cost-effectively stop intrusions or even prevent them before they happen.

Firmware Security: An Overlooked Threat

Top Cyber Threats

Signs of Infected PC

How CEO Fraud Impacts You

A Cybercriminal's Path To Your Data

Social Engineering Red Flags

5 CEO Fraud Awareness Warning Signs

What you can do to Combat Cyber Attacks

Framework for Threat Intelligence

Common Online Threats

Security Operation Center

Major Modern Cars Security Risk

Cyber Warrior

Periodic Table of Data Privacy