- Welcome to lesson six, deep dive quiz.
The lesson six was all about
common threat vectors and attack surfaces.
In lesson six one,
we explored operational threat vectors.
In six two, we took a look
at third party and supply chain threat vectors.
And in lesson three we looked
at the human threat vector,
specifically at social engineering.
So we're gonna do five questions together
about the materials
that we just covered in lesson six.
Make sure you have a pencil and a piece
of paper and put me on pause
as many times as you need to.
Are you ready?
Let's go.
The root of this significant
operational issue is the use
of IT solutions that are managed outside
of and without the knowledge of the IT department.
Is this data exfiltration,
shadow IT,
vulnerable software
or default credentials?
Now, these were all operational
issues that we talked about
but which one of them describes the use
of IT solutions that are managed outside
of and without the knowledge of the IT department?
Go ahead and make your choice.
I'm gonna choose shadow IT,
because shadow IT is the use
of IT solutions that could be local, you know
on-prem or cloud-based,
but they're managed outside
of and without the knowledge of the IT department
so that they can't ever have
the opportunity to put the right controls in place.
Data exfiltration is where data leaves our environment.
Vulnerable software.
The software that has obviously vulnerabilities
and needs to be patched and default credentials
is using the default credentials
that comes standard, right,
with an application or software
or you know, a device.
And usually those can be found
because they're published on the internet.
So I'm choosing shadow IT.
Do you agree?
Let's check.
And that is correct.
All right, so the biggie,
we're gonna match the social engineering tools
and descriptions.
So the tools on the left hand side
we have a social profile, spy cams, website,
branded clothing, and a phone spoofing service.
On the right side
we have an online presence to establish legitimacy
and online presence to establish relationships.
Used to manipulate caller ID, used to substantiate
an identity or used to capture live feed.
So let's start on the right hand side this time.
Used to establish online presence,
used to establish legitimacy.
Hmm, that could be a social profile,
'cause that's online
but we know we have another option,
online presence to establish relationships.
So I think that one's gonna really work
for social profile.
Oh, you know, I forgot to tell you.
If you want, don't hesitate
to put me on pause
while you work through this and then
I'm gonna work through it as well.
So online presence to establish legitimacy,
I'm gonna go to website.
Next, use to manipulate caller ID.
Well that might has to do with my phone.
So I'm gonna come down
to my phone spoofing service.
The next I have used to capture live feeds.
That's gonna be video.
That must be a spy cam.
Online presence to establish relationships.
So I've got social media, excuse me,
social profile and branded clothing left.
I'm gonna go with social profile
and branded clothing.
Well that's used to substantiate an identity.
So we set a social profile tool.
We use it to an online presence
to establish relationships.
Our spy cams are used to capture live feed.
Our website are used to have online presence
to establish legitimacy.
Branded clothing are used
to substantiate an identity.
And a phone spoofing service
is used to manipulate caller ID.
Do you agree?
Let's check.
And those are correct.
(mouse clicking)
This is a term that describes
the sum of all threat vectors,
a threat footprint, a privilege pathway,
an attack surface or a vulnerability platform.
Now, some of these are made up terms,
pretty good made up terms,
but made up terms nonetheless.
Tell me which one is the sum of all threat vectors.
Put me on pause while you think through this, if you want.
Threat footprint, privilege pathway,
attack surface or vulnerability platform.
I'm gonna choose attack surface.
Because the attack surface
is the sum of all threat vectors.
Let's check.
And that is correct.
All right, which one of the following is not?
Not, again, we're looking for that word,
not a supply chain security risk?
Business failure, non-compliance,
limited visibility or lower pricing.
Now, in reading really carefully
the sentence is not so,
which one is not supply chain security risk?
Not just a supply chain risk
but a supply chain security risk,
business failure, non-compliance,
limited visibility or lower pricing.
Which is not a supply chain security risk?
Make that choice.
I'm gonna choose lower pricing, right?
It's not really a risk probably
to have lower pricing
but it's definitely not a security risk
but a business failure, right?
The failure of availability
would be a security risk.
Non-compliance, definitely a security risk.
Limited visibility into what's going
on is also a security risk.
Lower pricing, not a security risk.
You agree?
Let's check.
And that is correct.
All right, our last question.
This one, we're going to drag the words to complete
the sentence about influence campaign techniques.
Blank is fault or misleading
information that is deliberately spread
with the intent of deception.
Blank is when machine learning
and or artificial intelligence
is used to generate deceptive audio or video content.
And blank is a use of persistent denial,
false narrative and lying to confuse the target
and disrupt their sense of reality.
Disinformation, poisoning, gaslighting
deep fake, misinformation and pretexting.
I'll tell you that one
of these answers we actually didn't talk
about in the lesson,
but we'll talk about here.
So go ahead and put me on pause.
Go ahead and see what you put in there.
Are you ready?
All right.
Blank is false
or misleading information
that's deliberately spread,
that's gonna be disinformation.
Remember, the difference between disinformation
and misinformation is,
disinformation is deliberately spread
with the intent of deception.
Blank is when machine learning or artificial
intelligence is used to generate deceptive audio
or video content, that is going to be a deep fake.
And this last one I didn't talk about in the lesson.
So let's talk about now,
the last one is actually gaslighting.
Gaslighting is a use of persistent denial
a false narrative or lying to confuse a target
and really disrupt their sense of reality.
So gaslighting is the answer we were looking for here.
We're seeing gaslighting in social engineering.
We see gaslighting a lot
in the political arena as well.
We see gaslighting in relationships.
It's a use of that persistent denial.
No, it didn't happen that way.
No, that's not what it, you know what it does.
No, you don't understand.
No, you don't get it,
over and over again to confuse a target
and disrupt their sense of reality.
So disinformation is false
and misleading information,
deep fake generates that deceptive audio
or video content and gaslighting disrupts
our sense of reality.
Agree.
All right, let's check it.
And there we go.
Correct.
Awesome.
Five questions together.
You did perfect.
Great job.
So up next we're gonna go into lesson seven.
We're gonna explain various types of vulnerabilities.
What's a vulnerability?
You know, it's a weakness.
So we'll be explaining various types of weaknesses.
I'll see you there.