Question

Question 1
In your own words, define information security and explain its relationship to cyberdefense.

Question 2
When we compare cybersecurity to the layers of an onion, we are referring to the principle of defense in depth. It presents the idea that, even if one layer of security fails, other systems may prevent a full data breach or incursion. Describe an example of this principle using any two of the defense mechanisms, techniques, or methods you’ve learned about.

Question 3
How are threats, vulnerabilities, exploits, and cyberattacks linked to each other?

Question 4
Imagine that someone proposes the following action items: identify, protect, respond, and recover. What are they referring to? What are the basic principles that each of these words entails? These terms represent the basic risk management framework used in the network security industry.

Question 5
Propose two distinct rules or regulations that would help increase security in an office that deals with secure information.

Answer 1

1) Definition and relationship
- Information security (infosec) is the practice of protecting information and the systems that process, store, or transmit it by maintaining confidentiality, integrity, and availability. It covers policies, procedures, physical and technical controls, personnel practices, and monitoring to reduce risk to data and services.
- Cyberdefense is the operational, technical side of defending computing systems and networks against digital attacks (detection, hardening, incident response, active monitoring). Cyberdefense is a major component of information security: infosec sets the goals and controls; cyberdefense implements and enforces those controls in the digital environment.

2) Defense-in-depth example (two mechanisms)
Example using multi-factor authentication (MFA) and network segmentation:
- MFA on user accounts reduces the risk that stolen passwords alone will give an attacker access to systems (protects the authentication layer).
- Network segmentation divides the network into zones (e.g., user LAN, finance VLAN, server DMZ) and enforces strict access rules between them.
If an attacker succeeds (e.g., phishes credentials for a single user), MFA can stop them from logging in. If they bypass MFA or compromise a device, segmentation limits lateral movement so the attacker cannot easily reach high-value systems. Together these layers reduce the chance of a full breach even if one control fails.

3) How threats, vulnerabilities, exploits, and cyberattacks are linked
- Threat: a potential cause of harm (e.g., a hacker group, malware, insider).
- Vulnerability: a weakness in systems, processes, or configuration (e.g., unpatched software, misconfigured server) that can be taken advantage of.
- Exploit: the technique or piece of code that takes advantage of a vulnerability (e.g., a crafted SQL injection payload, an exploit kit).
- Cyberattack: a realized attempt by a threat actor to compromise systems/assets using one or more exploits to leverage vulnerabilities and cause harm (data theft, disruption).
Chain: a threat actor identifies a vulnerability, uses an exploit to take advantage of it, and carries out a cyberattack to achieve their objective.

4) Identify, Protect, Respond, Recover — what they are and basic principles
These terms are core functions in commonly used risk-management frameworks (for example, the NIST Cybersecurity Framework). Basic principles:
- Identify: inventory assets, data, and systems; perform risk assessments; identify critical processes and stakeholders; establish governance and policies. Goal: know what you must protect and what risks exist.
- Protect: implement safeguards to reduce risk — access control and least privilege, authentication (MFA), encryption, secure configuration and patching, training and awareness, physical security. Goal: limit likelihood and impact of incidents.
- Respond: detect and act on incidents — incident response plans, playbooks, containment, eradication, communication (internal and external), forensics, legal/PR coordination. Goal: limit damage and restore control quickly.
- Recover: restore affected services and data, perform backups and tested recovery procedures, apply lessons learned, update controls and documentation. Goal: return to normal operations and reduce chance of recurrence.

5) Two proposed rules to increase office security
Rule A — Enforce least privilege and strong authentication:
- Requirement: Users get only the minimum access needed for their role; all access to sensitive systems requires MFA and unique accounts; periodic access reviews and approvals.
- Why: Reduces risk from compromised accounts or insider misuse and limits what an attacker can access.

Rule B — Mandatory device/data protection and handling rules:
- Requirement: All endpoints storing or accessing secure information must use full-disk encryption, approved endpoint protection, and up-to-date OS/app patching. Sensitive data must be classified, labeled, stored only on approved systems or encrypted containers, and securely deleted when no longer needed.
- Why: Protects data at rest and in transit, reduces impact of lost/stolen devices, and ensures consistent handling of sensitive information.

For both rules include enforcement steps: documented policy, technical controls (MFA, MDM, DLP), audits, and regular staff training and sanctions for violations.