Assets, Threats, and Vulnerabilities

What is a threat actor? Hint: They “act” against your system intentionally.

You notice coworker writing down their passwords on sticky note. What's the risk?💡Hint: if I find note = direct access

How can you make this quiz more secure? 💡Hint: Even Quizs need boundaries. Don't let cyber goons in your game!

Which of the following is an example of a physical asset? 💡 Hint: Physical assets = hardware or devices you can touch!

Which of these is an example of a software asset? Hint: If it's code or a program you interact with, not physical!

Which attack relies on social engineering? 💡 Hint: Social engineering = manipulating people, not tech.

What kind of access control gives permissions based on user's job role? 💡Hint: RBACK=Role-Based Access Control/keycard

Which is NOT a step in the PASTA threat modeling framework? 💡Hint: PASTA models threats to software—not people.

What is the main goal of a CAPTCHA?💡Hint: It's that annoying but effective tool to stop bots.

What does the "P" in the PASTA threat model stand for?💡Hint: PASTA = _______ for Attack Simulation and Threat Analysis

Which tool helps detect stolen email credentials? 💡Hint: It's a free tool where you can search for breached emails.

What does the acronym 'OWASP' stand for? 💡Hint: OWASP is a nonprofit focused on improving software security.

Which of the following is a best practice to prevent phishing?💡 Hint: Suspicion = safety.

What kind of attack tries all possible password combinations until one works? 💡Hint: not subtle,it’s all-out guesswork!

What is the main benefit of Continuous Integration (CI)? 💡Hint: CI = testing every code change.

Which of the following is a logical vulnerability?💡 Hint: Logical = software-side issues, not physical things.

Which attack tries to inject malicious code into a website's database? 💡💡Hint: slipping a virus into the site's brain

What is a zero-day vulnerability? 💡Hint: It's called 'zero-day' because attackers exploit it before it's fixed.

Which of the following is NOT a step in the PASTA framework? 💡 Hint: Only one answer sounds delicious (but wrong).

What is the main goal of threat modeling? 💡Hint: Think prevent, not react.

What kind of access control uses rules set by a system administrator (not by users)?💡Hint: “Mandatory” = not up to you.

Which is an example of a technical vulnerability? Hint:Unpatched software is a gateway 4 attackers. Update or regret!

Which of the following is considered a brute force attack?💡Hint: reuses stolen usrnms/pswrds to break into other sites.

Which of the following is a vulnerability in CI/CD pipelines? 💡Hint: Secrets should never be visible in code.

What is a common use for penetration testing?💡Hint: Pen testing is like ethically hacking yourself before others do.

Which STRIDE category relates to someone pretending to be someone else? Hint:(fake IDs, fake emails, fake everything.)

What does STRIDE help identify? 💡Hint: Spoofing/Tamprng/Repudiation/Info Disclosr/Denial of Srvice/Elevation of Prvilge

Why do cybercriminals often use phishing?💡 Hint: Phishing is cheap, fast, and exploits people's trust-triple threat!

What is the purpose of the OWASP Top 10? 💡Hint: It's a global resource that helps devs avoid common mistakes.

Who might be considered a "threat actor"? 💡Hint: threat actor is anyone/anything with ability and intent to cause harm.