Admin convinces management to buy expensive encryption citing vague threats.

(a)  

An agency publishes technical specs of its encryption system.

(a)  

Developers avoid reporting software bugs to avoid attention.

(a)  

Startup spends ₱3M to protect data worth ₱500k.

(a)  

Employees fall for phishing simulation offering concert tickets.

(a)  

Developers skip testing logout functionality.

(a)  

Encrypted health app crashes, blocking access.

(a)  

Bank relies on secrecy of method to protect authentication.

(a)  

Only one person understands backup, who later leaves.

(a)  

Hacker exploits an unpatched bug to inject code.

(a)  

Users write down complex passwords due to lack of training/support.

(a)  

System becomes unusable due to excessive encryption and controls.

(a)  

After disaster, backups allow company to restore in 12 hours.

(a)  

Logs reveal how firewall blocked a cyberattack.

(a)  

Two people must approve large wire transfers.

(a)  

Vulnerability is kept secret from users and developers.

(a)  

New protocol protects confidential documents.

(a)  

Developer uses old encryption just because it's unknown to attackers

(a)  

CEO claims intrusion detection isn't needed since no attacks happened yet.

(a)  

System only uses prevention but has no way to detect attacks.

(a)  

Manager uses asset value and risk to justify spending on protection.

(a)  

Testers validate roles and verify audit logging.

(a)  

Users bypass two-factor authentication due to its slowness.

(a)  

Password reset uses easy-to-guess security questions.

(a)