Which category classifies identified threats that do not have defenses in place and expose the application to exploits?
Answer(s): C
The category that classifies identified threats with no defenses in place, exposing the application to exploits, is Unmitigated Threats. This term refers to vulnerabilities for which no countermeasures or mitigations have been implemented. These threats are critical because they represent actual weaknesses that attackers can exploit. In the context of secure software design, it's essential to identify these threats early in the SDLC to ensure that appropriate security controls can be designed and implemented to protect against them.
Taxonomy of Cyber Threats to Application Security and Applicable Defenses1.OWASP Foundation's Threat Modeling Process2.Mitigating Persistent Application Security Threats3.
In which step of the PASTA threat modeling methodology is vulnerability and exploit analysis performed?
Answer(s): B
In the PASTA (Process for Attack Simulation and Threat Analysis) threat modeling methodology, vulnerability and exploit analysis is performed during the Attack modeling step. This step involves identifying potential threats and vulnerabilities within the system and understanding how they could be exploited.Attack modeling is a critical phase where the focus is on simulating attacks based on identified vulnerabilities. It allows for a deep understanding of the threats in the context of the application's architecture and system design.During this phase, security analysts use their knowledge of the system's technical scope and application decomposition to simulate how an attacker could exploit the system's vulnerabilities. This helps in prioritizing the risks and planning appropriate mitigation strategies. The goal of attack modeling is not just to identify vulnerabilities but also to understand the potential impact of exploits on the system and the business, which is essential for developing a robust security posture.
The information provided is aligned with the PASTA methodology as described in resources such as VerSprite1 and the OWASP Foundation2. These sources detail the seven stages of PASTA, with attack modeling being a key component of the process.
Which privacy impact statement requirement type defines how personal information will be protected when authorized or independent external entities are involved?
The privacy impact statement requirement that defines how personal information will be protected when authorized or independent external entities are involved is best categorized under Third party requirements. This aspect of privacy impact assessments ensures that personal data is safeguarded even when it is necessary to involve third parties, which could be service providers, partners, or other entities that might handle personal information on behalf of the primary organization. These requirements typically include stipulations for data handling agreements, security measures, and compliance checks to ensure that third parties maintain the confidentiality and integrity of the personal information they process.
Guide to undertaking privacy impact assessments | OAIC1 A guide to Privacy Impact Assessments - Information and Privacy2 Personal Information Protection Law of China: Key Compliance Considerations3 Privacy Impact Assessment - General Data Protection Regulation (GDPR)4 Privacy impact assessment (PIA) - TechTarget5
A public library needs to implement security control on publicly used computers to prevent illegal downloads.Which security control would prevent this threat?
Authentication is the most effective control for the scenario because it directly addresses who is using the public computers:User Identification: Authentication requires users to identify themselves (e.g., library card, login credentials) before accessing the computers. This links actions to specific individuals, making it easier to control unauthorized activity.Policy Enforcement: Combined with other controls (e.g., content filtering), authentication enables the library to implement policies restricting downloads. If users violate the policy, their identities can be used for consequences.Deterrent: Knowing they can be identified discourages users from attempting illegal downloads.
Which privacy impact statement requirement type defines processes to keep personal information updated and accurate?
Data integrity requirements within a privacy impact statement ensure that personal information is maintained in an accurate and up-to-date manner. This involves establishing processes to regularly review and update personal data, as well as correct any inaccuracies. These requirements are crucial for maintaining the trustworthiness of the data and ensuring that decisions made based on this information are sound and reliable.
The Office of the Privacy Commissioner of Canada's guide on the Privacy Impact Assessment process emphasizes the importance of accuracy and currency of personal information1. The European Union's General Data Protection Regulation (GDPR) outlines principles for data processing, including the necessity for data to be accurate and kept up to date2. The General Data Protection Regulation (GDPR) also includes provisions for data protection impact assessments, which involve documenting processes before starting data processing3.
Post your Comments and Discuss WGU Secure-Software-Design exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Secure-Software-Design content, but please register or login to continue.