定量风险分析的最后一步是执行成本/效益分析，从而确定组织是否应该实施原计划。

The final step of a quantitative risk analysis is conducting a cost/benefit analysis to determine whether the organization should implement proposed countermeasure(s).

欺骗攻击会使用伪造的身份，包括使用虚假IP 地址、电子邮件地址、名称和SSID。

Spoofing attacks use falsified identities. Spoofing attacks may use false IP addresses, email addresses, names, or, in the case of an evil twin attack, SSIDs.

《国际安全港规定》的原则指出，组织必须告知个人他们如何使用收集到的个人信息。这些原则基于2000 年美国商务部发布的《国际安全港规定》，这些原则用来帮助美国公司在收集、存储、处理和传输数据时达到欧盟的标准。

三种常见的威胁建模技术的关注点分别是攻击者、软件和资产。社会工程学不包括在其中。

The three common threat modeling techniques are focused on attackers, software, and assets. Social engineering is a subset of attackers.

指纹扫描属于“你是什么”类型的因素，这可以和“你知道什么”类型的因素(密码)配对使用，从而实现多因素身份验证。用户名不是身份验证的因素。PIN 和安全问题都是“你知道什么”这一因素，它们和密码同属于一种身份验证因素，无法满足多因素身份验证的要求。

在提升特权攻击中，攻击者将有限权限的用户账户转换为具有更大权限的账户。欺骗攻击伪

In an elevation of privilege attack, the attacker transforms a limited user account into an account with greater privileges, powers, and/or access to the system. Spoofing attacks falsify an identity, while repudiation attacks attempt to deny accountability for an action. Tampering attacks attempt to violate the integrity of information or resources.

栅栏不具有检测入侵的能力。然而，它属于物理控制，具有预防入侵和阻止入侵的能力。

A fence does not have the ability to detect intrusions. It does, however, have the ability to prevent and deter an intrusion. Fences are an example of a physical control. 

Tony 通过同时使用定量和定性风险评估，会得出较好的结果。定量风险评估多用于分析金融风险，而定性风险评估则可用于分析无形风险。组合使用这两种技术可提供较全面的风险分析。

Tony would see the best results by combining elements of quantitative and qualitative risk assessment. Quantitative risk assessment excels at analyzing financial risk, while qualitative risk assessment is a good tool for intangible risks. Combining the two techniques provides a well-rounded risk picture.

RAID 级别5，也称为具有奇偶校验的磁盘条带化，需要至少三个物理硬盘。

RAID level 5, disk striping with parity, requires a minimum of three physical hard

disks to operate.

安全意识训练属于行政控制。防火墙和入侵检测系统是技术控制，保安则是物理控制。

Awareness training is an example of an administrative control. Firewalls and intrusion detection systems are technical controls. Security guards are physical controls.

专利和商业秘密都可保护与制造过程有关的知识产权。但商业秘密只有在组织采用严格的保密措施时才使用，因此他们可通过申请专利来保护该技术。

Patents and trade secrets can both protect intellectual property related to a manufacturing process. Trade secrets are appropriate only when the details can be tightly controlled within an organization, so a patent is the appropriate solution in this case.

风险降低策略试图降低风险发生的概率和影响，部署入侵防御系统可降低系统遭受攻击的概率。因此，这就是一个风险降低的例子。

 Risk mitigation strategies attempt to lower the probability and/or impact of a risk occurring. Intrusion prevention systems attempt to reduce the probability of a successful attack and are, therefore, examples of risk mitigation.

灭火系统保护基础设施免受物理损坏，此外还有不间断供电技术。反病毒软件、硬件防火墙和双因素身份验证都属于逻辑控制。

Fire suppression systems protect infrastructure from physical damage. Along with uninterruptible power supplies, fire suppression systems are good examples of technology used to harden physical infrastructure. Antivirus software, hardware firewalls, and two-factor authentication are all examples of logical controls.

访问控制列表(ACL)用于确定用户的授权级别。用户名是识别工具，密码和令牌是身份验证工具。

Access control lists (ACLs) are used for determining a user’s authorization level. Usernames are identification tools. Passwords and tokens are authentication tools.

商标保护的对象包括市场中组织、产品或服务所使用的词语和符号。

Trademark protection extends to words and symbols used to represent an organization, product, or service in the marketplace.

显示的消息说明系统受到勒索软件的攻击，它可加密用户计算机中的内容来干扰用户正常使用，这属于可用性攻击。

The message displayed is an example of ransomware, which encrypts the contents of a user’s computer to prevent legitimate use. This is an example of an availability attack.

Smurf 攻击属于拒绝服务攻击，它会影响目标网络的可用性。

A Smurf attack is an example of a denial of service attack, which jeopardizes the availability of a targeted network.

书面作品(如网站内容)通常受版权法保护。商业秘密与此情况不符，因为网站的内容是在线的，而且这些内容在公司外部也是可以访问到的，不属于商业秘密。专利保护的是发明，商标保护用于表示品牌的词语和符号，这两者都和本题无关。

Written works, such as website content, are normally protected by copyright law. Trade secret status would not be appropriate here because the content is online and available outside the company. Patents protect inventions and trademarks protect words and symbols used to represent a brand, neither of which is relevant in this scenario.

否认威胁描述的是攻击者拒绝曾经做过某事，而另一方却无法反驳他。

Repudiation threats allow an attacker to deny having performed an action or activity without the other party being able to prove differently.

商标会保护代表产品或服务的特定词语和图像，但不保护计算机软件。

 Trademarks protect words and images that represent a product or service and would not protect computer software.

虚拟专用网(VPN)在不安全的网络(例如互联网)上通过加密提供安全的通信信道。如果在两个办公室之间建立VPN 连接，则一个办公室中的用户可通过使用互联网，安全地访问位于另一办公室服务器上的内容。数字签名能提供不可否认性，但无法保证保密性。虚拟LAN(VLAN)仅在本地网络上提供网络分段，不涉及互联网。数字内容管理关注的是Web 内容，这与本题所说的文件服务器上的共享文件关系不大。

廉价磁盘冗余阵列(RAID)使用额外的硬盘驱动器来保护服务器，使得服务器在单个设备出现故障的情况下仍可正常工作。负载均衡和服务器集群可以增强稳定性，但需要添加服务器。计划备份可防止数据丢失，但在硬盘驱动器发生故障时无法提供服务。

Redundant Array of Inexpensive Disks (RAID) uses additional hard drives to protect the server against the failure of a single device. Load balancing and server clustering do add robustness but require the addition of a server. Scheduled backups protect against data loss but do not provide immediate access to data in the event of a hard drive failure.

散列(Hashing)允许用户通过计算来验证文件没有被修改过。访问控制列表(ACL)和只读属性有助于防止未经授权的修改，但它们无法验证文件未被修改过。防火墙是网络安全控制，同样无法验证文件的完整性。

Hashing allows you to computationally verify that a file has not been modified between hash evaluations. ACLs and read-only attributes are useful controls that may help you prevent unauthorized modification, but they cannot verify that files were not modified. Firewalls are network security controls and do not verify file integrity.

不要求专利必须由美国公民发明。但专利发明必须是新的、非显而易见的、有用的。

There is no requirement that patents be for inventions made by American citizens. Patentable inventions must, on the other hand, be new, nonobvious, and useful.

当威胁与脆弱性相关时，存在风险。这种关系可使用等式“风险=威胁*脆弱性”来描述。

Risks exist when there is an intersection of a threat and a vulnerability. This is described using the equation Risk = Threat * Vulnerability.

由于继续提供公共NTP 服务会产生风险，因此HAL System 决定停止提供该项服务。该公司通过停止服务来消除NTP 滥用所带来的风险，属于风险规避策略。

HAL Systems decided to stop offering the service because of the risk. This is an example of a risk avoidance strategy. The company altered its operations in a manner that eliminates the risk of NTP misuse.

路由器访问控制列表、加密、防火墙规则都属于技术控制。数据分类属于行政控制。

Router ACLs, encryption, and firewall rules are all examples of technical controls. Data classification is an administrative control.

Ben 应该对数据进行加密，为数据提供额外的保护来作为补偿控制。组织已经制定了额外对策，因此他不应该反对异常行为或未授权删除数据。购买保险可能转移一些风险，但不是缓解控制

Ben should encrypt the data to provide an additional layer of protection as a compensating control. The organization has already made a policy exception, so he should not react by objecting to the exception or removing the data without authorization. Purchasing insurance may transfer some of the risk but is not a mitigating control.

在风险接受策略中，组织认为不采取行动是管理风险最有利的途径。

 In a risk acceptance strategy, the organization decides that taking no action is the most beneficial route to managing a risk.

安全培训的目的是向工作人员提供具体知识，以便他们履行职责。培训一般针对一群人，这群人的工作职能一般是相似的，所用到的具体知识也是相似的。

Security training is designed to provide employees with the specific knowledge they need to fulfill their job functions. It is usually designed for individuals with similar job functions.

安全意识是信息安全的最低标准。不管组织中的人员工作是什么，他们都应该强化安全意识。

 Awareness establishes a minimum standard of information security understanding. It is designed to accommodate all personnel in an organization, regardless of their assigned tasks.

风险是威胁和脆弱性的结合，威胁是试图破坏系统安全的外部力量。在本题中，脆弱性指系统的内部漏洞，也就是没打补丁。此时，如果黑客(威胁)尝试针对未修补的服务器(漏洞)的SQL 注入攻击，会引起网站崩溃。

在灾难发生时，预估财产损失值占总资产的比重称为暴露因子。它是用预估的财产损失值除以资产总值计算出来的，这种情况下，预估损失为500万美元，除以1000万美元的总价值，结果为50%。

The exposure factor is the percentage of the facility that risk managers expect will be damaged if a risk materializes. It is calculated by dividing the amount of damage by the asset value. In this case, that is $5 million in damage divided by the $10 million facility value, or 50%.

年度发生率(ARO)是风险分析师预期在任何一年内发生风险的次数。这种情况下，分析师预期龙卷风每200 年一次，也即每年0.005 次。

The annualized rate of occurrence is the number of times that risk analysts expect a risk to happen in any given year. In this case, the analysts expect tornados once every 200 years, or 0.005 times per year.

年化损失预期值是通过将单一损失预期(SLE)乘以年度发生率(ARO)计算的。这种情况下，SLE 为5000000 美元，ARO 为0.005。将这些数字相乘得到的ALE 为25000美元。

The annualized loss expectancy is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). In this case, the SLE is $5,000,000 and the ARO is 0.005. Multiplying these numbers together gives you the ALE of $25,000.

信息泄露攻击依赖于私人的、机密的或受控信息的泄露。嵌入在HTML代码中的编程注释是这种类型的攻击实例。

Information disclosure attacks rely upon the revelation of private, confidential, or controlled information. Programming comments embedded in HTML code are an example of this type of attack.

保密协议(NDA)通过要求员工不得与第三方共享机密信息，从而保护组织的敏感信息，NDA 通常在员工离开公司后仍然有效。

Nondisclosure agreements (NDAs) protect the confidentiality of sensitive information by requiring that employees and affiliates not share confidential information with third parties. NDAs normally remain in force after an employee leaves the company.