Information Security Management Examination (SG) | Section A Attack Mitigation and Business Continuity 06

The answer is directory traversal, an attack that abuses relative paths and the like to reach files outside the published area.

The answer is buffer overflow, an attack that writes data beyond the area reserved for it, aiming to cause abnormal behaviour or execute arbitrary code.

The answer is supply chain attack, a technique of compromising a subcontractor or a software supplier in order to reach their business partners.

The answer is targeted attack, an attack aimed at a particular organisation or individual, carried on persistently while gathering information about them.

The answer is EDR, a mechanism that continuously monitors endpoint behaviour and supports the detection, investigation of and response to compromise.

The answer is SIEM, a mechanism that aggregates logs from many devices and correlates them to detect security events.

The answer is SOAR, a mechanism that links and automates incident response procedures and supports analysis and handling.

The answer is DLP, a mechanism that identifies confidential information and prevents it being sent or taken outside improperly.

The answer is MDM, a mechanism for centrally managing the settings and applications of smartphones and the like, and wiping them if they are lost.

The answer is CASB, a mechanism that gives visibility into how cloud services are used and mediates the application of policy.

The answer is CSPM, a mechanism that continuously evaluates the settings of a cloud environment and detects dangerous configurations.

The answer is vulnerability assessment, the activity of investigating, with tools and the like, whether known weaknesses are present in a system.

The answer is penetration testing, the activity of trying real attack techniques with permission to verify whether intrusion is possible and what the impact would be.

The answer is CVSS, a scheme for scoring the severity of a vulnerability on a common scale.

The answer is CVE, the numbering scheme that identifies published vulnerabilities uniquely.

The answer is CSIRT, the team that gathers information from inside and outside the organisation and responds to security incidents.

The answer is digital forensics, the techniques and procedures for collecting and analysing devices and logs with care to preserve evidence.

The answer is chain of custody, recording who handled evidence and when, so that its identity and integrity can be accounted for.

The answer is RTO, the target time within which operations or systems are to be restored after a disaster.

The answer is RPO, the target stating up to which point in time data is to be recovered after a failure.