SECURITY POLICIES AND COMPLIANCE
1 1. DATA BREACH PREVENTION STRATEGIES
Problem 1. A company implemented a data breach prevention strategy that reduced the prob-
ability of a data breach from 0.10 to 0.04. If the company was experiencing an average of 8 data
breaches per year before the new strategy, how many data breaches could be expected per year
after implementing the new strategy?
Problem 2. A company has incurred a total cost of 100,000duetoadatabreach.Afterimplementinganewdatabreachpreventionstrategythatreducedtheprobabilityofabreachby60
Problem 3. Company A has identified that the cost of preventing a data breach is 50,000.Ontheotherhand, theaveragecostof adatabreachis200,000.
With this information, calculate the cost savings per year if the new data breach prevention strategy
reduces the probability of a breach from 0.15 to 0.06.
Solution 1. a) Before the new strategy implementation, the company expected 8 data breaches
per year. The probability of a data breach reduced from 0.10 to 0.04, which means the new ex-
pected number of data breaches can be calculated as:
New expected data breaches =Probability of data breach after new strategy ×Number of breaches before new strategy
= 0.04 ×8
= 0.32
So, the company can expect approximately 0.32 data breaches per year after implementing the
new strategy.
b) After the implementation of the new data breach prevention strategy, the probability of a
breach reduced by 60
New expected cost of a data breach =Probability of data breach after strategy ×Total cost before strategy
program@epstopdf
program@epstopdf
Therefore, the expected cost of a data breach following the new strategy implementation is
40,000.
c) The cost savings per year can be calculated by finding the difference between the cost without
the new strategy (based on the previous probability of a breach) and the cost with the new strategy:
Cost savings per year = (Probability of breach before new strategy −Probability of breach after new strategy)×Average cost of a data breach
program@epstopdf
program@epstopdf
program@epstopdf
Therefore, the company can expect to save 18,000peryearwiththenewdatabreachpreventionstrategy.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
2 2. ROLE-BASED ACCESS CONTROL
Problem 2. A company has implemented role-based access control (RBAC) for its information
systems. The company has three roles: Administrator, Manager, and Employee. The following
table shows the permissions associated with each role:
Role Permissions
Administrator Create, Read, Update, Delete
Manager Read, Update
Employee Read
For a specific task, the access control policy allows only one role to perform the task.
a) What role(s) can perform the task of deleting data from the system? b) If a user can read
and update data, what role should they belong to? c) Which role has the most privileges in this
RBAC system?
Solution 2. a) To perform the task of deleting data from the system, a role must have the
’Delete’ permission. Therefore, only the Administrator role has the ’Delete’ permission. Hence, the
Administrator role can perform the task of deleting data from the system.
b) If a user can read and update data, they must have both ’Read’ and ’Update’ permissions.
From the table, we see that the Manager role has both ’Read’ and ’Update’ permissions. Therefore,
the user should belong to the Manager role.
c) The role with the most privileges in this RBAC system is the Administrator role, as it has
permissions to Create, Read, Update, and Delete data.
3 3. CLOUD SECURITY COMPLIANCE
Problem 3. A company is considering moving its data storage to a cloud service provider. The
company has a strict security policy that requires all data transfer to be encrypted using AES-256
encryption. The cloud service provider offers two encryption options: AES-128 and AES-256. The
company decides to go with AES-256 encryption to comply with their security policy.
a) If the ciphertext length for AES-128 encryption is 128 bits, calculate the ciphertext length for
AES-256 encryption.
b) The company has 1 TB (1,024 GB) of data to transfer to the cloud. Calculate the size of the
ciphertext when using AES-256 encryption.
c) If the company’s secure key management policy includes a 256-bit key for AES-256 encryp-
tion, calculate the number of possible keys that can be generated.
Solution 3. a) The key length for AES-128 encryption is 128 bits, which means the ciphertext
length is also 128 bits. Since the company wants to use AES-256 encryption, the ciphertext length
will also be 256 bits.
b) To calculate the size of the ciphertext for 1 TB of data, we first need to convert 1 TB into bits.
1 TB = 1,024 GB = 1,024 * 8 bits = 8,192 bits
Since the ciphertext length for AES-256 encryption is 256 bits, the size of the ciphertext for
encrypting 1 TB of data will be 8,192 bits.
c) For a 256-bit key used in AES-256 encryption, the number of possible keys that can be
generated is given by 2256.
Therefore, the number of possible keys = 2256 = 1.1579209e+77.
4 4. SECURITY POLICY ENFORCEMENT
Problem 4. Company XYZ has implemented a security policy that requires all employees to
use complex passwords that are at least 8 characters long and contain at least one uppercase
letter, one lowercase letter, one digit, and one special character.
The company’s security audit found the following password characteristics for a sample of 10
employees:
Employee 1: abcd1234 Employee 2: P@ssw0rd Employee 3: security Employee 4: 56789123
Employee 5: C0mp!exP@ss Employee 6: Password1 Employee 7: Newpassword Employee 8:
StarWarEmployee9 : 123456789Employee10 : S3cur!ty
a) Determine how many employees are not compliant with the company’s password policy.
b) Calculate the percentage of employees who are fully compliant with the password policy.
c) Identify the employee with the strongest password based on the criteria provided.
Solution 4. a) To determine how many employees are not compliant with the password policy,
we need to check each employee’s password against the policy requirements.
- Employee 1: abcd1234 (Not compliant) - Employee 2: P@ssw0rd (Compliant) - Employee 3:
security (Not compliant) - Employee 4: 56789123 (Not compliant) - Employee 5: C0mp!exP@ss
(Compliant) - Employee 6: Password1 (Compliant) - Employee 7: Newpassword (Not compliant)
- Employee 8: StarWar(Compliant)−Employee9 : 123456789(Notcompliant)−Employee10 :
S3cur!ty(Notcompliant)
Out of the 10 employees, 5 are not compliant with the company’s password policy.
b) Percentage of employees who are fully compliant:
Number of compliant employees = 5 Total number of employees = 10
Percentage = 5
10 ×100% = 50%
c) To identify the employee with the strongest password, we need to consider the complexity
criteria given. The strength of a password can be measure based on the number of characters,
presence of uppercase letters, lowercase letters, digits, and special characters.
Based on the given passwords: - Employee 5: C0mp!exP@ss has 11 characters, including
uppercase, lowercase, digit, and special character. This password is the strongest among the
given passwords.
Therefore, Employee 5 has the strongest password according to the criteria provided.
5 5. INSIDER THREAT DETECTION
Problem 5. Company XYZ has implemented an insider threat detection system that can identify
abnormal patterns in employees’ access to sensitive data. The system flags an alert if an employee
accesses more than 100 sensitive files in a single day. The system has detected the following
numbers of flagged alerts over the past week: 120, 90, 105, 130, 95, 110, 115.
a) Calculate the mean number of flagged alerts per day for this week.
b) Determine the standard deviation of the number of flagged alerts per day.
c) If the company sets a threshold of 2 standard deviations above the mean as a point of con-
cern, how many flagged alerts would trigger an investigation?
Solution 5.
a) To calculate the mean number of flagged alerts per day for the week, we first find the sum of
the number of flagged alerts:
(120 + 90 + 105 + 130 + 95 + 110 + 115) = 765.
Then, we divide this sum by the number of days (7) to find the mean:
Mean =765
7= 109.
Therefore, the mean number of flagged alerts per day for this week is 109.
b) The standard deviation of the number of flagged alerts per day can be calculated using the
formula:
σ=sPn
i=1(xi−¯x)2
n−1,
where xiis the number of flagged alerts for each day and ¯xis the mean.
Substitute the values into the formula:
σ=r(120 −109)2+ (90 −109)2+ (105 −109)2+ (130 −109)2+ (95 −109)2+ (110 −109)2+ (115 −109)2
6.
After calculation, we find σ≈12.07.
c) The threshold for triggering an investigation is set at 2 standard deviations above the mean.
Therefore, the threshold is:
Threshold =Mean + 2 ×Standard Deviation = 109 + 2 ×12.07 = 133.14.
Thus, any number of flagged alerts beyond 133 would trigger an investigation.
6 6. AUDIT LOG MANAGEMENT
Problem 6. Company XYZ has implemented an audit log management system to monitor and
record all activities on their network. The system has logged the following information for the past
week:
- Monday: 50 login attempts, 20 failed and 30 successful - Tuesday: 60 login attempts, 25 failed
and 35 successful - Wednesday: 45 login attempts, 15 failed and 30 successful - Thursday: 55
login attempts, 18 failed and 37 successful - Friday: 70 login attempts, 30 failed and 40 successful
- Saturday: 40 login attempts, 10 failed and 30 successful - Sunday: 30 login attempts, 5 failed
and 25 successful
a) Calculate the success rate for each day in percentage. b) Calculate the overall success
rate of login attempts for the week. c) If the company defines a threshold of 80% success rate as
acceptable, did the company meet the threshold for the week?
Solution 6. a) To calculate the success rate for each day, we use the formula:
Success Rate = Number of Successful Attempts
Total Number of Attempts ×100%
•Monday: 30
50 ×100% = 60%
•Tuesday: 35
60 ×100% ≈58.33%
•Wednesday: 30
45 ×100% ≈66.67%
•Thursday: 37
55 ×100% ≈67.27%
•Friday: 40
70 ×100% ≈57.14%
•Saturday: 30
40 ×100% = 75%
•Sunday: 25
30 ×100% ≈83.33%
b) To calculate the overall success rate for the week, we sum up all successful and total attempts
for the week:
Total Successful Attempts = 30 + 35 + 30 + 37 + 40 + 30 + 25 = 227
Total Attempts = 50 + 60 + 45 + 55 + 70 + 40 + 30 = 350
Overall Success Rate = 227
350 ×100% ≈64.86%
c) The company did not meet the threshold of 80% success rate for the week.
7 7. SECURITY INCIDENT RESPONSE PLANNING
Problem 7. A company’s Security Incident Response Plan includes the following key steps:
1. Detection and Analysis of Security Incidents 2. Containment, Eradication, and Recovery 3.
Notification and Communication 4. Post-Incident Activities
If the company experiences a data breach incident with the following timeline: - Incident detec-
tion: Day 0 - Incident confirmed: Day 2 - Containment started: Day 3 - Full eradication: Day 5 -
Notification to affected parties: Day 7 - Post-incident analysis and reporting: Day 10
Calculate the duration (in days) of each step and the total duration from incident detection to
post-incident activities.
Solution 7. Given the timeline: - Detection to Confirmation: Day 2 - Day 0 = 2 days - Confir-
mation to Containment: Day 3 - Day 2 = 1 day - Containment to Eradication: Day 5 - Day 3 = 2
days - Eradication to Notification: Day 7 - Day 5 = 2 days - Notification to Post-Incident Activities:
Day 10 - Day 7 = 3 days
Therefore, the durations of each step are: - Detection and Analysis: 2 days - Containment,
Eradication, and Recovery: 5 days - Notification and Communication: 2 days - Post-Incident Activ-
ities: 3 days
The total duration from incident detection to post-incident activities is: 2 + 1 + 2 + 2 + 3 = 10
days.
8 8. ENCRYPTION PROTOCOLS
Problem 8. Suppose a company wants to securely transmit confidential customer data over
the internet. The company decides to use the AES encryption algorithm with a key size of 256 bits.
a) How many possible keys are there in AES-256?
b) If the company can try 1 million different keys per second, how long would it take to exhaust
all possible keys?
c) If the company decides to use a key-sharing protocol requiring a new key every month, how
many years of operation can they have before needing to recycle a key?
Solution 8. a) The AES-256 encryption algorithm uses a key size of 256 bits. The number of
possible keys is given by 2256.
Therefore, the number of possible keys in AES-256 is 2256 = 1.1579209 ×1077.
b) If the company can try 1 million different keys per second, the time it would take to exhaust
all possible keys is given by:
2256
1×106keys/second = 3.67711 ×1068 seconds
Converting this into years:
3.67711 ×1068 seconds
60 ×60 ×24 ×365 seconds/year ≈1.16499 ×1061 years
So, it would take approximately 1.16499 ×1061 years to exhaust all possible keys.
c) If the company needs a new key every month, the number of years of operation before
needing to recycle a key is given by:
2256
1key/month =2256
12 keys/year =2256
12 years
Substituting the value of 2256:
1.1579209 ×1077
12 years ≈9.64934 ×1075 years
Therefore, the company can operate for approximately 9.64934 ×1075 years before needing to
recycle a key.
9 9. MOBILE DEVICE SECURITY
Problem 9.
A company has implemented a mobile device security policy that requires all employees to use
strong passcodes on their devices. The passcodes must be 8 characters long, consisting of a
combination of letters, numbers, and special characters. The company also enforces a policy that
requires devices to lock after 5 minutes of inactivity.
Given that an attacker can try to brute force the passcode on a lost device, calculate the theo-
retical maximum number of attempts they would need to successfully guess the passcode.
Solution 9.
To calculate the theoretical maximum number of attempts an attacker would need to success-
fully guess the passcode, we first need to determine the total number of possible combinations for
an 8-character passcode with letters, numbers, and special characters.
There are 26 letters in the English alphabet, 10 numerical digits (0-9), and a variety of special
characters (let’s assume 10 for simplicity). Therefore, the total number of characters an attacker
can choose from is 26 + 10 + 10 = 46.
Since the passcode is 8 characters long, the total number of possible combinations is 468.
468= 1,461,501,637,330,902,918,203,684,832
≈1.46 ×1023
So, the theoretical maximum number of attempts an attacker would need to successfully guess
the passcode is approximately 1.46 ×1023.
This demonstrates the importance of using strong passcodes and enforcing device lock after a
short period of inactivity to mitigate the risk of unauthorized access.
10 10. VENDOR RISK ASSESSMENT
Problem 10. ABC Corp is considering outsourcing their IT support services to a third-party
vendor. The vendor has a history of data breaches in the past and is located in a country known for
lax data protection laws. ABC Corp wants to conduct a risk assessment to evaluate the potential
risks associated with this vendor.
The risk assessment process will involve assigning a risk score to various aspects of the ven-
dor’s operations, such as data security measures, compliance with regulations, and location. Each
aspect will be scored on a scale of 1 to 10, with 1 indicating low risk and 10 indicating high risk.
The final risk score will be the sum of all individual aspect scores.
The vendor’s data security measures score is 8, compliance with regulations score is 6, and
location score is 9.
a) Calculate the final risk score for this vendor.
b) ABC Corp has defined a threshold of 20 for acceptable risk. Based on the final risk score
calculated in part (a), should ABC Corp proceed with outsourcing IT support services to this ven-
dor?
Solution 10.
a) The final risk score for the vendor is the sum of individual aspect scores:
Final Risk Score = 8 + 6 + 9 = 23
b) Since the final risk score (23) is higher than the defined threshold of 20 for acceptable risk,
ABC Corp should not proceed with outsourcing IT support services to this vendor. This high risk
score indicates a significant level of risk associated with the vendor, which may pose a threat to
ABC Corp’s data security and compliance efforts.
11 11. COMPLIANCE REPORTING REQUIREMENTS
Problem 11. Company XYZ is required to have quarterly compliance reports. In the last quar-
ter, they had a total of 5 security incidents. The compliance standard specifies that the number
of security incidents should not exceed 3 per quarter. Calculate the compliance rate for the last
quarter.
Solution 11. To calculate the compliance rate, we need to determine the percentage of quarters
where the number of security incidents did not exceed the specified limit.
a) Calculate the compliance rate using the formula:
Compliance Rate =1−Number of Non-Compliant Quarters
Total Number of Quarters ×100%
In this case, the number of non-compliant quarters is 1 (since the number of security incidents
exceeded the specified limit of 3), and the total number of quarters is 1.
Compliance Rate =1−1
1×100% = 0%
Therefore, the compliance rate for the last quarter is 0%.
b) Determine the compliance trend for the last 4 quarters.
For the last 4 quarters:
Quarter 1: 2 security incidents (Compliant)
Quarter 2: 4 security incidents (Non-Compliant)
Quarter 3: 3 security incidents (Compliant)
Quarter 4: 5 security incidents (Non-Compliant)
The number of non-compliant quarters is 2 out of 4 quarters.
Compliance Rate =1−2
4×100% = 50%
The compliance rate for the last 4 quarters is 50%.
The compliance trend for Company XYZ shows that they were compliant in 50% of the last 4
quarters.
12 12. EMPLOYEE TRAINING PROGRAMS
Problem 12. XYZ Corporation is implementing a new security training program for its employ-
ees. The program consists of three modules: Cybersecurity Basics, Phishing Awareness, and
Data Privacy.
The completion rates for each module are as follows: - Cybersecurity Basics: 75- Phishing
Awareness: 80- Data Privacy: 70
Assuming that the completion of each module is independent of the others, calculate the prob-
ability that an employee completes all three modules successfully.
Solution 12. Let PC B ,PP A, and PDP represent the completion rates for Cybersecurity Basics,
Phishing Awareness, and Data Privacy modules, respectively.
Given: PCB = 0.75,PP A = 0.80,PDP = 0.70.
The probability that an employee completes all three modules successfully is the product of the
probabilities of completing each module:
P(All successful) = PCB ×PP A ×PDP
= 0.75 ×0.80 ×0.70
= 0.525
Therefore, the probability that an employee completes all three modules successfully is 0.525,
or 52.5
13 13. PHYSICAL SECURITY MEASURES
Problem 13. A company is considering implementing a physical security measure to restrict
access to a server room. The measure involves installing a biometric fingerprint scanner that has
an error rate of 0.5%. If the company has 100 employees and the server room should only be
accessed by authorized personnel, what is the probability that at least one unauthorized person is
granted access when all employees try to enter the room?
Solution 13. Let’s first calculate the probability that a single employee is an unauthorized
person and incorrectly granted access by the fingerprint scanner. The error rate of the scanner is
0.5% = 0.005.
The probability that a single employee is correctly identified is 1−0.005 = 0.995. Therefore, the
probability that a single employee is an unauthorized person is 0.005.
Now, let’s calculate the probability that all 100 employees are authorized and correctly identi-
fied. Since the employees’ entries are independent events, the probability that all employees are
authorized is (0.995)100.
The probability that at least one unauthorized person is granted access is the complement of
the probability that all employees are authorized, which is 1−(0.995)100.
Calculating this probability:
1−(0.995)100 ≈1−0.6059
≈0.3941
Therefore, the probability that at least one unauthorized person is granted access when all
employees try to enter the room is approximately 0.3941, or 39.41%.
14 14. REMOTE WORK SECURITY GUIDELINES
Problem 14. A company has 100 employees working remotely from various locations. The
security policy requires all employees to use VPN (Virtual Private Network) when accessing com-
pany resources. The VPN service costs $5 per user per month. Additionally, the company invests
$500 per month in training employees on remote work security best practices. If the company’s
monthly budget for remote work security is $1,000, determine the maximum number of employees
the company can afford to provide the VPN service for.
Solution 14.
a) Let xbe the number of employees that can be provided with the VPN service. The total cost
of the VPN service for xemployees is given by 5x.
b) The total monthly cost for training employees is fixed at $500.
c) The total monthly budget for remote work security is $1,000. Therefore, the total cost of
providing the VPN service and training employees should not exceed $1,000.
Therefore, the equation representing the total cost is:
5x+ 500 = 1000
5x= 500
x= 100
Hence, the company can afford to provide the VPN service for a maximum of 100 employees.
15 15. DATA RETENTION POLICIES
Problem 15. A company has implemented a data retention policy that requires all customer
data to be stored for a minimum of 5 years before being permanently deleted. They have col-
lected customer data for the past 8 years. The company now needs to calculate the percentage of
customer data that can be permanently deleted according to their policy.
Note: Assume that all customer data is evenly distributed over the 8 years.
Solution 15. Since the company has collected customer data for the past 8 years and their
policy requires data to be stored for a minimum of 5 years, the first 3 years of data are not eligible
for permanent deletion.
Let Ttotal be the total number of years for which customer data has been collected, and Tmin be
the minimum number of years data should be stored according to the policy.
Therefore, the percentage of customer data that can be permanently deleted is given as:
Percentage for deletion =1−Tmin
Ttotal ×100%
=1−5
8×100%
=3
8×100%
= 37.5%
So, 37.5% of the customer data collected by the company can be permanently deleted accord-
ing to their data retention policy.
16 16. THIRD-PARTY DATA SHARING AGREEMENTS
Problem 16. Company XYZ has entered into a data sharing agreement with a third-party
vendor to provide access to sensitive customer information. As per the agreement, the vendor
must adhere to the following conditions:
- The vendor can only use the data for the specified purpose. - The vendor must implement
appropriate security measures to protect the data. - The vendor must notify Company XYZ of any
security breaches immediately.
If the vendor fails to comply with these conditions, Company XYZ has the right to terminate the
agreement and take legal action.
Consider that the cost of implementing security measures by the vendor is estimated to be
10,000.If thevendorbreachestheagreementbynotnotifyingCompanyXY Zof asecuritybreachandCompanyXY Zdecidestoterminatetheagreement, calculatethetotalfinancialimpactonthevendor.
Solution 16. Given: Cost of implementing security measures = 10,000
If the vendor breaches the agreement by not notifying Company XYZ of a security breach, the
agreement can be terminated. This means the vendor will incur a financial impact equal to the cost
of implementing security measures.
Therefore, the total financial impact on the vendor in case of breach = 10,000.
17 17. INCIDENT RESPONSE TEAM COORDINATION
Problem 17. In an incident response team meeting, a security analyst is tasked with calculating
the Mean Time to Detect (MTTD) for a recent security incident. The security incident was detected
by the security operations center (SOC) at 2:00 PM and was reported to the incident response
team at 2:30 PM. The incident was then fully investigated by the team, and the root cause was
identified at 4:00 PM.
a) Calculate the MTTD in hours.
b) Given that the incident started at 1:00 PM, calculate the Total Time Taken (TTT) for the
incident.
c) If the Mean Time to Resolve (MTTR) for the incident was 2 hours, calculate the Mean Time
to Recover (MTTRec), in hours.
Solution 17.
a) The MTTD is calculated as the time taken from when the incident actually started to when it
was detected. In this case:
MTTD = Detection time - Incident start time
MTTD = 2:30 PM - 1:00 PM = 1.5 hours
Therefore, the Mean Time to Detect (MTTD) is 1.5 hours.
b) The Total Time Taken (TTT) for the incident is calculated as the time from when the incident
started to when the root cause was identified:
TTT = Root cause identification time - Incident start time
TTT = 4:00 PM - 1:00 PM = 3 hours
Therefore, the Total Time Taken (TTT) for the incident is 3 hours.
c) The Mean Time to Recover (MTTRec) is calculated as the sum of the Mean Time to Detect
(MTTD) and the Mean Time to Resolve (MTTR):
MTTRec = MTTD + MTTR
MTTRec = 1.5 hours + 2 hours = 3.5 hours
Therefore, the Mean Time to Recover (MTTRec) for the incident is 3.5 hours.
18 18. SOFTWARE PATCH MANAGEMENT
Problem 18. Company XYZ has identified a critical security vulnerability in their software ap-
plication that requires an urgent patch. The patch is estimated to take 10 hours to implement and
test. The probability of a successful cyber attack exploiting this vulnerability is 15% if no patch is
applied, and only 5% if the patch is successfully implemented.
a) Calculate the expected loss without applying the patch.
b) Calculate the expected loss if the patch is successfully implemented.
c) Determine the cost savings by applying the patch.
Solution 18.
a) The expected loss without applying the patch can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
Without Patch: 0.15×Loss per Attack
Expected Loss = 0.15 ×100,000 = 15,000
Therefore, the expected loss without applying the patch is $15,000.
b) The expected loss if the patch is successfully implemented can be calculated as follows:
Expected Loss = Probability of Attack ×Loss per Attack
With Patch: 0.05×Loss per Attack
Expected Loss = 0.05 ×100,000 = 5,000
Therefore, the expected loss if the patch is successfully implemented is $5,000.
c) The cost savings by applying the patch can be calculated as the difference in expected losses:
Cost Savings = Expected Loss without Patch - Expected Loss with Patch
Cost Savings = $15,000 - $5,000 = $10,000
Therefore, by applying the patch, the company can save $10,000 in potential losses.
19 19. REGULATORY COMPLIANCE UPDATES
Problem 19. A company needs to comply with the Payment Card Industry Data Security Stan-
dard (PCI DSS) version 4.0, which requires all web-facing applications to use TLS 1.2 or higher for
secure communications. The company is currently using TLS 1.1. How much should the company
upgrade its current TLS version to comply with the PCI DSS 4.0 requirement?
Additional context: The company is running multiple web-facing applications that process
credit card transactions.
a) Calculate the percentage increase in security level from TLS 1.1 to TLS 1.2.
b) If TLS 1.2 is expected to provide 168-bit encryption strength, what is the percentage increase
in encryption strength compared to a 128-bit encryption used in TLS 1.1?
Solution 19.
a) The company needs to upgrade from TLS 1.1 to TLS 1.2 to comply with the PCI DSS 4.0
requirement.
TLS 1.1 provides 128-bit encryption, and TLS 1.2 is expected to provide stronger security. The
increase in security level between TLS 1.1 and TLS 1.2 can be calculated using the following
formula:
Percentage Increase in Security =New Security Level −Old Security Level
Old Security Level ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Security =128 −168
128 ×100 = −40
128 ×100 ≈ −31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides a decrease in security level by approx-
imately 31.25
b) The encryption strength of TLS 1.1 is 128-bit, while TLS 1.2 is expected to provide 168-bit
encryption.
The percentage increase in encryption strength compared to a 128-bit encryption can be cal-
culated using the formula:
Percentage Increase in Encryption Strength =New Encryption Strength −Old Encryption Strength
Old Encryption Strength ×100
Substitute the values for TLS 1.1 and TLS 1.2:
Percentage Increase in Encryption Strength =168 −128
128 ×100 = 40
128×100 ≈31.25%
Therefore, upgrading from TLS 1.1 to TLS 1.2 provides an increase in encryption strength by
approximately 31.25
20 20. SECURITY POLICY REVIEW AND REVISION PROCESS.
Problem 20. Company XYZ is planning to review and revise its security policies. The current
policy includes a requirement for employees to change their passwords every 90 days. The IT de-
partment suggests changing this requirement to every 120 days to reduce the burden on employees
while still maintaining security. If the company has 500 employees and the average cost of pass-
word reset support is 20peremployeeperyear, howmuchmoneycanthecompanysaveannuallybymakingthischange?
Given:
•Current password change requirement: every 90 days
•Proposed change: every 120 days
•Number of employees: 500
•Cost of password reset support per employee per year: 20
Solution 20.
1. Calculate the annual cost under the current policy:
With the current policy of changing passwords every 90 days, the number of password
changes per year per employee is 365/90 ≈4. Therefore, the annual cost of password
reset support per employee is 4×20 = 80 dollars.
The total annual cost for all 500 employees under the current policy is 80 ×500 = 40000
dollars.
2. Calculate the annual cost under the proposed policy:
With the proposed policy of changing passwords every 120 days, the number of password
changes per year per employee is 365/120 ≈3. Therefore, the annual cost of password reset
support per employee is 3×20 = 60 dollars.
The total annual cost for all 500 employees under the proposed policy is 60 ×500 = 30000
dollars.
3. Calculate the annual savings:
By making the proposed change to the security policy, the company can save 40000−30000 =
10000 dollars annually in password reset support costs.
