Module 2

Use the concept of integrity policies in preventing data tampering in a research database.

• Use public editing portals for collaborative contributions

• Allow overwriting of old entries without logging

• Permit temporary bypass of validation rules to speed up data entry

• Implement checksums, access audits, and version control for all database inputs

Determine the most appropriate security policy to protect confidential student records in an educational institution.

• 
  Use informal rules rather than formal policies to manage access.

• Establish an integrity policy that checks for changes in login timestamps.
  

• Implement a confidentiality policy that restricts data access to authorized personnel only.

• Apply a hybrid policy that focuses solely on system availability.
  

Describe the typical behavior of a novice hacker, or script kiddie.

• Participating in ethical hacking programs under supervision

• Using pre-written tools created by expert hackers without deep technical knowledge
  

• Avoiding high-value targets in favor of harmless experimentation

• Designing their exploits and scanning systems using custom code

Apply confidentiality policies when handling sensitive healthcare data.

• Only protect records of patients with critical conditions
  

• Encrypt all records in transit and at rest while enforcing strict access controls

• Allow shared logins among medical staff for convenience
  

• Permit printing of sensitive data without authorization

Identify the key elements of a data breach response plan for an organization.

• Focus solely on restoring services without addressing the breach.

• Conduct a post-incident review only if the breach is significant.

• Ignore the incident if no sensitive data is confirmed to be compromised.

• Establish a communication strategy for internal and external stakeholders.

Evaluate the effectiveness of access control measures in a corporate environment.

• Use generic accounts for all staff to simplify management.

• Regularly review and update access permissions based on role changes.

• Allow unrestricted access to all employees for ease of use.

• Implement a single sign-on system for all employees.

Assess the importance of training employees on cybersecurity awareness.

• Training should focus solely on technical skills, not awareness.

• Training is unnecessary as IT staff will handle all security issues.

• Regular training can help reduce the risk of phishing attacks.

• Employees should only be trained when a security incident occurs.

Identify the primary components of a cybersecurity risk assessment process.

• Limit the assessment to only high-profile assets.

• Focus only on technical vulnerabilities without considering human factors.

• Conduct assessments annually without updates in between.

• Involve stakeholders from various departments to gather comprehensive insights.

Determine the best practices for securing remote work environments.

• Encourage employees to use personal devices for work-related tasks.

• Implement a VPN to encrypt data transmitted over public networks.

• Provide minimal training on security protocols for remote workers.

• Allow unrestricted access to company resources from any location.

Evaluate the role of incident response teams in managing cybersecurity threats.

• Teams should operate independently without collaboration with other departments.

• They should focus solely on technical aspects, ignoring communication strategies.

• Incident response teams should only react after a breach has occurred.

• They play a crucial role in both prevention and response to incidents.