We all know that management needs to get smarter about cybersecurity. Just take any headline of the past couple of weeks to see mistakes made by some very large organizations who have been hit with ransomware, had to deal with public data exposure, or found evidence that hackers had been living inside their networks for months. So in the interests of public service, feel free to distribute this short quiz. You can grade it on a curve, or use it as a teachable moment, for better cybersecurity practice.

1. Which is the best password security policy?
   1. Everyone’s passwords must be replaced after 60 days
   2. You can’t reuse one of the same passwords you used in the last year
   3. All passwords must be at least 16 characters long and contain symbols too
   4. Users don’t need to know their passwords because we have SSO logins
   5. I have no idea how to answer this question
2. Have you ever searched for potential data breaches about you or your company on the dark web?
   1. No, what is the dark web?
   2. Yes, using Tor and Onion sites
   3. Yes, and I track this using a third-party security service in near real-time
   4. Yes, we have developed our own tracking tools for this purpose
   5. I have no idea how to answer this question
3. How often do you run phishing simulations and awareness drills?
   1. We built our own and run them every week
   2. We built our own a year ago, but no one knows how to run them
   3. We use a third-party vendor and run them every quarter
   4. We were told by our auditors to run them but haven’t implemented them yet
   5. I have no idea how to answer this question
4. Who provides your DNS services for your company?
   1. Your ISP
   2. Your cloud provider (Google Cloud DNS, AWS Route 53, Microsoft Azure DNS or similar)
   3. Google Public DNS, Cisco/OpenDNS, Quad9 or similar
   4. Cloudflare, Akamai’s Enterprise Threat Protector, NS1 Domain Security Suite or similar
   5. Don’t know the answer
5. Which is the most secure password?
   1. “Every good boy deserves favor” (passphrase)
   2. “E!bTzQZK4TCjadS4” (random collection of 16 or more characters)
   3. “Fido1234” (my dog’s name with some numbers appended, something easy to recall)
   4. Any password secured with a one-time code generator like Google Authenticator
   5. Any password secured with an SMS code
   6. I have no idea how to answer this question
6. When an employee leaves my company, you do the following:
   1. I have an automated way to audit my Active Directory listings and other network access controls
   2. Someone on my staff sends an email HR to terminate their login sometime after their last workday
   3. I have automated mechanisms that outboard their access
   4. I use manual methods to terminate their access on my SSO
   5. None of the above
7. Check how many of these authentication options you personally use for your account logins
   1. SMS texts of one-time codes
   2. Authenticator smartphone apps (like Google Authenticator, Duo or Authy)
   3. Hardware keys such as SecurID or Yubikey
   4. FaceID, TouchID or equivalent on your smartphone
   5. Risk-based methods that use geolocation or other factors
   6. None other than your user name and password
8. A cyberconsultant calls saying your software contains malware. What do you do next?
   1. Call your lawyer
   2. Call your PR department
   3. Call your IT department
   4. Call the FBI
   5. Ignore the call
9. What part of your computer infrastructure are protected by CASB and CSPM products?
   1. Servers in your data center
   2. Servers in your cloud
   3. Laptops that you brought home at the beginning of the pandemic
   4. I don’t know what you are talking about
10. One of your end-users is hit with ransomware. What is your next step?
    1. Call your lawyer
    2. Open a Bitcoin account pronto and get ready to transfer funds
    3. Call your PR department
    4. Call your IT department
    5. Call the FBI
    6. I have no idea how to answer this question
11. What is DLP?
    1. Data Loss Prevention
    2. Data level parallelism
    3. Dark Lord Potter
    4. Data leak protection
    5. Data link protocols
    6. I have no idea how to answer this question
12. You get an email from your IT department with a note saying you have to update critical network software, and please install the attached file. What do you?
    1. Click on the attachment and install it.
    2. Call your friend in another department and check and see if they got a similar email.
    3. Call your IT person to make sure the email is legit.
    4. Delete the email immediately.
    5. I have no idea how to answer this question
13. Do you have the following people on retainer?
    1. Cybersecurity law firm
    2. MSSP to handle ransomware response
    3. Accountant with a bitcoin access
    4. None of the above
14. When was the last time you looked at your cybersecurity insurance policy terms?
    1. Last year when we got hacked
    2. Every year when it is time to renew it to ensure the terms are acceptable
    3. We don’t have such a policy
    4. Our corporate parent has a policy but I don’t know the specific terms
15. Do you know what aspect of your cybersecurity refer to DKIM, SPF and DMARC?
    1. Your web servers
    2. Your email servers
    3. Your programmers writing more secure code
    4. Your personnel database servers
    5. I have no idea what you are talking about
16. How did you test your disaster recovery plan?
    1. We simulated a partial cloud failure and saw what needed fixing
    2. We simulated a partial app failure and saw what needed fixing
    3. We have a full-fledged disaster recovery site and conducted an all-hands drill offsite
    4. We did none of these things
    5. We did all of these things
17. What is a watering hole attack?
    1. When your laptop computer is infected with malware while you are at the water cooler.
    2. When your laptop computer crashes because you left some questionable content on it
    3. When your laptop computer visits a questionable website and you get infected with malware.
    4. I have no idea how to answer this question
18. What does a red team do?
    1. Put out management fires between conflicting policies or employees
    2. Find malware that is a potential threat
    3. Find employees that are downloading porn
    4. I have no idea how to answer this question
19. What additional security measures have you put in place since the beginning of the pandemic?
    1. VPNs
    2. Zero-trust networks
    3. Passwordless access using biometrics
    4. Encrypted emails
    5. None of the above