Deck 27: Data Breaches

Question 1

A student at the MSA University hacked into the university's official Web site and stole some confidential information about the scholarship program. This incident is an example of ________.

A) a data breach
B) asynchronous communication
C) key escrow
D) a sequence flow

Answer 1

A

Question 2

Each type of data breach is different because hackers are continually developing new tools and techniques that enable them to steal more data.

Answer 2

True

Question 3

An exploit is a type of attack vector used by hackers.

Answer 3

True

Question 4

A group of hackers use a targeted phishing attack to breach a company's firewalls and hack into its security system. Which of the following techniques have the hackers used?

A) pretexting
B) IP spoofing
C) spear phishing
D) phone phishing

Question 5

Direct costs of handling a data breach do not include paying for detection of the breach.

Question 6

Spear phishing is used by organizations to monitor traffic passing through their internal network.

Question 7

Stuart works for a financial brokerage. His job involves handling sensitive client information such as financial details. Stuart illegally transfers details of some clients from his office computer to his personal email ID, to misuse later. With reference to this situation, Stuart is guilty of ________.

A) exfiltrating
B) carding
C) hardening
D) pretexting

Question 8

Attack vectors refer to the ways hackers attack a target.

Question 9

Explain how hackers use information stolen from data breaches for credit card forgery.

Question 10

A group of hackers decide to steal credit card details of the users of Swift Shopping Inc., a leading e-commerce company. They infect the security system of the company's third-party vendor and gain access into its internal network. They compromise an internal Windows server of the company and use a malware to extract customer data. Which of the following is illustrated in this scenario?

A) hardening
B) carding
C) pretexting
D) data breaching

Question 11

________ refers to the process of placing a small charge on a credit card to ensure it is working.

A) Hoarding
B) Carding
C) Phishing
D) Credit card hijacking

Question 12

According to the reports in Ponemon's 2014 Cost of Data Breach Study, organizations are more likely to lose larger amounts of data than smaller amounts of data.

Question 13

Which of the following is a direct cost of handling a data breach?

A) loss of reputation
B) abnormal customer turnover
C) legal fees and consultation
D) increased customer acquisition activities

Question 14

Explain how data breach occurs with an example.

Question 15

Sam is a hacker who makes money by stealing and selling credit cards. He has targeted the employees of a local firm and is looking for details such as names, addresses, dates of birth, social security numbers, credit card numbers, or health records. In this case, Sam is looking for ________.

A) firewall security measures
B) business continuity plans
C) malware definitions
D) personally identifiable information

Question 16

Stolen credit card information is validated through a process called carding.

Question 17

Bob, a hacker, encountered a vulnerability in a bank's firewall when he was trying to hack into its Web site. Which of the following can Bob use to take advantage of this liability?

A) exploit
B) attack vector
C) carding
D) wardriver

Question 18

Personally identifiable information includes a person's bank account numbers, personal identification numbers, email address, and social security numbers.

Question 19

The first step in protecting oneself from data breaches is ________.

A) securing credit and debit card details
B) understanding how they happen
C) learning the technologies used for these activities
D) installing necessary software to protect from possible breaches

Question 20

Which of the following is TRUE of the measures to be taken by an organization in the event of a data breach?

A) The organization must delay informing its users so that the occurrence of data breach remains private.
B) The organization must not involve additional technical or law enforcement professionals, as it may lead to further damage to its data.
C) The organization must destroy the evidence of the breach to avoid future security problems.
D) The organization must respond quickly to mitigate the amount of damage hackers can do with the stolen data.

Question 21

Organizations need to understand the body of regulatory law relative to the type of information they store because they will be held accountable for implementing those standards.

Question 22

The Federal Information Security Management Act (FISMA) details the procedures to be followed by a federal agency in case an organization fails to ensure the minimum security requirements for its data and systems.

Question 23

Data breach notifications should state that the existing security policies and procedures are inadequate and that changes are being made to prevent similar breaches in the future.

Question 24

Despite data breach, organizations should refrain from informing their users immediately as it will lead to mass user defection.

Question 25

Which of the following regulatory laws requires data protection for health care institutions?

A) the Gramm-Leach-Bliley Act (GLBA)
B) the Federal Information Security Management Act (FISMA)
C) the Health Information Portability and Accountability Act (HIPAA)
D) the Health Maintenance Organization Act of 1973

Question 26

Data extrusion helps organizations secure their data from possible data breaches.

Question 27

Which of the following regulatory laws requires data protection for financial institutions?

A) the Family Educational Rights and Privacy Act (FERPA)
B) the Federal Information Security Management Act (FISMA)
C) the Gramm-Leach-Bliley Act (GLBA)
D) the Health Information Portability and Accountability Act (HIPAA)

Question 28

Performing a walkthrough should be done as part of a business continuity planning session.

Question 29

The ________ is a regulatory law that provides protection for student education records.

A) Family Educational Rights and Privacy Act (FERPA)
B) Equal Educational Opportunities Act of 1974
C) Smith-Lever Act of 1914
D) Federal Information Security Management Act (FISMA)

Question 30

The Gramm-Leach-Bliley Act (GLBA) is a universal regulatory law that applies to all types of industries.

Question 31

Decisions on how to respond to a data breach are most effective if they are made when the breach is happening.

Question 32

Adam owns and manages a large insurance company. In order to protect his organization from data breach, Adam has to ensure that he has incorporated the security measures required by the ________.

A) Family Educational Rights and Privacy Act (FERPA)
B) Federal Information Security Management Act (FISMA)
C) Payment Card Industry Data Security Standard (PCI DSS)
D) Gramm-Leach-Bliley Act (GLBA)

Question 33

Which of the following should be done by employees to protect against data breaches?

A) They should develop new exploits.
B) They should remove existing honeypots.
C) They should design methods for data extrusion.
D) They should conduct a walkthrough.

Question 34

The ________ is a regulatory law that requires security precautions for government agencies.

A) Federal Information Security Management Act (FISMA)
B) Gramm-Leach-Bliley Act (GLBA)
C) Payment Card Industry Data Security Standard (PCI DSS)
D) Family Educational Rights and Privacy Act (FERPA)

Question 35

Jobs Dot Com, an online recruitment site, was hacked into, and personal information of a number of users was stolen. What information should Jobs Dot Com include in its data breach notification to its users?

A) the costs incurred due to the breach
B) a sincere apology and an acceptance of responsibility for the incident
C) details of how the breach occurred and the reasons for the breach
D) a report on the current security measures

Question 36

Venclave Hospital is a privately-owned organization that specializes in treating neurological diseases. Which of the following regulatory laws governs the data security measures to be taken by this hospital for protecting against data breach?

A) the Health Maintenance Organization Act of 1973
B) the Health Information Portability and Accountability Act (HIPAA)
C) the Gramm-Leach-Bliley Act (GLBA)
D) the Federal Information Security Management Act (FISMA)

Question 37

Executives, managers, and all systems personnel of an organization discuss the actions to be taken by each employee in case a data breach occurs. They identify areas that would need immediate attention and assign specific responsibilities to each employee. The employees of the organization are performing a(n) ________.

A) exfiltration
B) documentation
C) walkthrough
D) case study

Question 38

Why should organizations respond quickly to data breaches?

Question 39

What are the steps involved in an organization's plan for a data breach?

Question 40

The purpose of a business continuity planning session in an organization is to ________.

A) discuss how to return the organization to normal operations as quickly as possible after a data breach
B) build plans to increase the market presence of the organization and increase its user base
C) identify new markets that will accelerate the growth of the organization
D) understand the type of information stored by the organization and implement relevant security measures as required by regulatory laws

Question 41

Which of the following is NOT a way for criminals to make money from data breaches?

A) selling a stolen purse
B) identify theft
C) extortion
D) industrial espionage

Question 42

A(n) ________ is used to examine traffic passing through an organization's internal network.

A) honeypot
B) attack vector
C) security protocols open repository
D) network intrusion detection system

Question 43

What are countermeasures? Why is it important for organizations to implement countermeasures?

Question 44

An organization can easily stop a simple SQL injection attack on its online store by additional user training, stronger vendor authentication, or an internal network intrusion detection system.

Question 45

List some of the regulatory laws that govern the secure storage of data in certain industries.

Question 46

________ are countermeasures designed to prevent sensitive data from being released to unauthorized persons.

A) Malware definitions
B) Attack vectors
C) Data loss prevention systems
D) Data extrusion prevention systems

Question 47

When planning for a data breach which of the following should be part of the process?

A) a walkthrough
B) being honest with customers
C) exfiltrating
D) perform a forensic investigation

Question 48

________ are software or procedures used to prevent an information security attack.

A) Malware definitions
B) Countermeasures
C) Exploits
D) Attack vectors

Question 49

Which of the following are NOT ways a company should handle a data breach?

A) Respond quickly.
B) Be honest about the breach.
C) Only send notification to a small number of users.
D) Notify users as soon as possible.

Question 50

Talgedco Inc., a software company, has taken several steps to secure its systems and data. The company has also installed a network intrusion detection system and data loss prevention system. Employees of this company have also been trained on the procedures to be followed to reduce the probability of a data breach. These steps taken by Talgedco are an example of ________.

A) attack vectors
B) countermeasures
C) malware
D) exfiltration

Question 51

Hackers experiment with new ________ or ways of attacking a target.

A) exploit
B) attack vector
C) carding
D) wardriver

Question 52

Which company waited four years before information their customers about a data breach?

A) Target
B) Macys
C) The IRS
D) LinkedIn

Question 53

Organizations can implement countermeasures that make data breaches impossible to occur.

Question 54

Stolen information is commonly used to pay bills.

Question 55

It is easy for organizations to prepare a list of countermeasures against many different types of attacks and take appropriate measures accordingly.

Question 56

Which of the following is a best practice for notifying users of a data breach?

A) Keep the information internal until the executive can decide how to deal with the breach.
B) Notify the clients there is no evidence their cards have been compromised.
C) Stay focused and concise.
D) Do not give out key details about the breach.

Question 57

What was one major change that happen in business because of the Target breach?

A) a shift from magnetic swipe cards to smart cards
B) the government requiring all companies to hire a CISO
C) people choosing to use cash instead of credit cards
D) companies granting all of their customers credit monitoring services

Question 58

Internal employees can steal data more easily than external hackers.

Question 59

All of these are PCI DSS requirements EXCEPT ________.

A) build a secure network
B) test networks once every ten years
C) maintain an information policy
D) protect cardholder data

Question 60

Explain the basic countermeasures to be taken by organizations to protect themselves against data breaches.

Question 61

All of the following these legal actions can occur as a consequence of a data breach EXCEPT ________.

A) lawsuits
B) fines for violating industry regulations
C) a massive reduction in consumer confidence
D) fines from payment card issuers

Question 62

If a company wants to prevent a SQL injection attack, all they have to do is train their users.

Question 63

Regulatory fines imposed after a data breach can never be higher than the financial damage done during the data breach.

Question 64

List suggestions for preventing data loss?

Question 65

Companies can implement measures that make data breaches impossible.