Computer_security

qas: question: What must an operator deviate from to harm the computer?
answers: text: secure procedures
is_impossible: no

question: What is computer security also known as?
answers: text: cybersecurity or IT security
is_impossible: no

question: What is the protection of information systems?
answers: text: Computer security
is_impossible: no

question: What are the ways an operator can malpractice?
answers: text: intentional, accidental, or due to them being tricked
is_impossible: no

question: What is the practice that includes controlling physical access to hardware?
answers: text: Computer security
is_impossible: no

question: What is the necessity of having an IT?
is_impossible: yes

question: What can be caused by neglecting a computer security system?
is_impossible: yes

question: What does the IT security protect?
is_impossible: yes

question: How can a computer be attacked?
is_impossible: yes

question: How does IT security work?
is_impossible: yes

question: What is the theft or damage to hardware or software?
is_impossible: yes

question: Protecting a device from harm requires deviating from what procedures?
is_impossible: yes

question: What does computer security misdirect?
is_impossible: yes

question: What types of harm can come through network access?
is_impossible: yes

question: Why would IT security partake in malpractice?
is_impossible: yes

question: When did Public Safety Canada partner with Stop.Think. Connect?
is_impossible: yes

question: Which two models in computer systems enforce privilege separation?
is_impossible: yes

question: When did the incident in Stuxnet happen?
is_impossible: yes
context: Computer security, also known as cybersecurity or IT security, is the protection of information systems from theft or damage to the hardware, the software, and to the information on them, as well as from disruption or misdirection of the services they provide. It includes controlling physical access to the hardware, as well as protecting against harm that may come via network access, data and code injection, and due to malpractice by operators, whether intentional, accidental, or due to them being tricked into deviating from secure procedures.

qas: question: What are attacks designed to make a machine or network unavailable to its intended users?
answers: text: Denial of service attacks
is_impossible: no

question: What does deliberately entering the wrong password enough consecutive times cause?
answers: text: the victim account to be locked
is_impossible: no

question: What are attacks where innocent systems are fooled into sending traffic to the victom called?
answers: text: reflection and amplification attacks
is_impossible: no

question: What does DDoS stand for?
answers: text: Distributed denial of service
is_impossible: no

question: How can a network attack from a single IP address be blocked?
answers: text: by adding a new firewall rule
is_impossible: no

question: What happens if an attacker enters the wrong password into an account enough times?
is_impossible: yes

question: What is the point of making network resources unavailable to users?
is_impossible: yes

question: Why is it difficult to defend against DDos?
is_impossible: yes

question: Other than being locked out what other methods are used in DDos?
is_impossible: yes

question: What causes multiple attacks?
is_impossible: yes

question: What allows a machine to be accessed by its user?
is_impossible: yes

question: What is done to a password to lock out all users at once?
is_impossible: yes

question: How is a DDoS from multiple locations defended?
is_impossible: yes

question: What is an IP address?
is_impossible: yes

question: What are zombie computers on a botnet?
is_impossible: yes

question: What month is Cyber Security Awareness Month?
is_impossible: yes

question: What transmissions does NarusInsight listen to?
is_impossible: yes

question: What can voice recognition not be used for?
is_impossible: yes
context: Denial of service attacks are designed to make a machine or network resource unavailable to its intended users. Attackers can deny service to individual victims, such as by deliberately entering a wrong password enough consecutive times to cause the victim account to be locked, or they may overload the capabilities of a machine or network and block all users at once. While a network attack from a single IP address can be blocked by adding a new firewall rule, many forms of Distributed denial of service (DDoS) attacks are possible, where the attack comes from a large number of points – and defending is much more difficult. Such attacks can originate from the zombie computers of a botnet, but a range of other techniques are possible including reflection and amplification attacks, where innocent systems are fooled into sending traffic to the victim.

qas: question: What were researchers in 2011 able to use as a successful attack vector?
answers: text: a malicious compact disc in a car's stereo system
is_impossible: no

question: In cars with built-in voice recognition features, what can the onboard microphones be used for?
answers: text: eavesdropping
is_impossible: no

question: Wifi, bluetooth, and cell phone networks are examples of what?
answers: text: a potential entry point for malware or an attacker
is_impossible: no

question: Assuming access has been gained to the car's internal controller area network, what is it possible to do?
answers: text: disable the brakes and turn the steering wheel
is_impossible: no

question: What network is used to contact concierge and emergency assitance services as well as getting navigational and entetainment information?
answers: text: the cell phone network
is_impossible: no

question: What makes cars a risk for computerized attacks?
is_impossible: yes

question: How were researchers able to eavesdrop in a car?
is_impossible: yes

question: Why are cars with more technology at a higher risk for attack?
is_impossible: yes

question: What increases the likelihood of a car being attacked?
is_impossible: yes

question: What entry points are viable for malware and attackers?
is_impossible: yes

question: What does an external controller area network control?
is_impossible: yes

question: When were self-driving cars built?
is_impossible: yes

question: What networks prevent malware in connected cars?
is_impossible: yes

question: What did researchers use to prevent attacks in 2011?
is_impossible: yes

question: What can voice recognition not be used for?
is_impossible: yes

question: Who has used programs such as Carnivore and NarusInsight to eavesdrop on the systems of internet service providers?
is_impossible: yes

question: How can a cell phone increase computer security?
is_impossible: yes

question: Who does the FBI and NSA use Carnivore and Naruslnight to eavesdrop on?
is_impossible: yes
context: If access is gained to a car's internal controller area network, it is possible to disable the brakes and turn the steering wheel. Computerized engine timing, cruise control, anti-lock brakes, seat belt tensioners, door locks, airbags and advanced driver assistance systems make these disruptions possible, and self-driving cars go even further. Connected cars may use wifi and bluetooth to communicate with onboard consumer devices, and the cell phone network to contact concierge and emergency assistance services or get navigational or entertainment information; each of these networks is a potential entry point for malware or an attacker. Researchers in 2011 were even able to use a malicious compact disc in a car's stereo system as a successful attack vector, and cars with built-in voice recognition or remote assistance features have onboard microphones which could be used for eavesdropping.

qas: question: How many organisations are estimated to maintain computer systems with effective detection systems?
answers: text: relatively few
is_impossible: no

question: What is the basic evidence gathered by that puts criminals behind bars?
answers: text: packet capture appliances
is_impossible: no

question: The primary obstacle to the eradication of cyber crime is the excessive reliance on what?
answers: text: firewalls and other automated "detection" systems
is_impossible: no

question: What is the source of the quote?
answers: text: Reuters
is_impossible: no

question: Electronic theft of data is causing more loss than what? 
answers: text: physical stealing of assets
is_impossible: no

question: What do companies rely on too much in order to keep their information safe?
is_impossible: yes

question: What do even fewer companies have set in place for their defense?
is_impossible: yes

question: What do companies have to worry about least?
is_impossible: yes

question: What is needed to catch these data stealing criminals?
is_impossible: yes

question: What is a common form of theft in companies?
is_impossible: yes

question: Most organizations have what kind of detection system?
is_impossible: yes

question: What is the name of the company that has lost more through electronic theft?
is_impossible: yes

question: What do most companies no longer rely on?
is_impossible: yes

question: Physical stealing of assets is a bigger problem than what?
is_impossible: yes

question: What do criminals use to avoid being captured?
is_impossible: yes

question: What is the standard for EAL6?
is_impossible: yes

question: Where is Clarke from?
is_impossible: yes

question: What type of plan is provided? 
is_impossible: yes
context: However, relatively few organisations maintain computer systems with effective detection systems, and fewer still have organised response mechanisms in place. As result, as Reuters points out: "Companies for the first time report they are losing more through electronic theft of data than physical stealing of assets". The primary obstacle to effective eradication of cyber crime could be traced to excessive reliance on firewalls and other automated "detection" systems. Yet it is basic evidence gathering by using packet capture appliances that puts criminals behind bars.

qas: question: Technology that is used to implement secure operating systems is one use of what term?
answers: text: computer security
is_impossible: no

question: What does EAL stand for?
answers: text: Evaluation Assurance Levels
is_impossible: no

question: What is the standard of EAL4?
answers: text: Methodically Designed, Tested and Reviewed
is_impossible: no

question: What is the standard for EAL6?
answers: text: Semiformally Verified Design and Tested
is_impossible: no

question: What is an example of a system that meets EAL6?
answers: text: Integrity-178B
is_impossible: no

question: Which system is used by the Airbus A380 and military jets?
is_impossible: yes

question: How common are the formal verification for the highest levels?
is_impossible: yes

question: In the 1980s the Department of Defense used which standards?
is_impossible: yes

question: What does Common Criteria refer to?
is_impossible: yes

question: Which level do many common operating systems meet?
is_impossible: yes

question: When was the Common Criteria defined?
is_impossible: yes

question: Who created the Common Criteria?
is_impossible: yes

question: What is the name of a system that meets the EAL4 standard?
is_impossible: yes

question: What makes it difficult for systems to use the EAL4 standard?
is_impossible: yes

question: What is an example of a system that uses the Orange Book Standards?
is_impossible: yes

question: Canadian cyberspace was boosted by who? 
is_impossible: yes

question: In what way does "connectedness begets vulnerability?" 
is_impossible: yes

question: What do companies have to worry about least?
is_impossible: yes
context: One use of the term "computer security" refers to technology that is used to implement secure operating systems. In the 1980s the United States Department of Defense (DoD) used the "Orange Book" standards, but the current international standard ISO/IEC 15408, "Common Criteria" defines a number of progressively more stringent Evaluation Assurance Levels. Many common operating systems meet the EAL4 standard of being "Methodically Designed, Tested and Reviewed", but the formal verification required for the highest levels means that they are uncommon. An example of an EAL6 ("Semiformally Verified Design and Tested") system is Integrity-178B, which is used in the Airbus A380 and several military jets.

qas: question: When was Chine's network security and information technology leadership team established?
answers: text: February 27, 2014
is_impossible: no

question: What is the reason for studying the promotion of national network security ad information technology law?
answers: text: enhanced national security capabilities.
is_impossible: no

question: What country has a network security and information technology leadership team??
answers: text: China
is_impossible: no

question: Why was China's network security team established? 
is_impossible: yes

question: What long term developments do they hope to achieve? 
is_impossible: yes

question: Why is network security under study? 
is_impossible: yes

question: Who is the leadership team? 
is_impossible: yes

question: Who is promoting the leadership team and its developments? 
is_impossible: yes

question: Who is researching microeconomic policy?
is_impossible: yes

question: Which fields unrelated to network security does China's leadership team research?
is_impossible: yes

question: Who is tasked with the short term development of network security?
is_impossible: yes

question: When were China's enhanced national security capabilities established?
is_impossible: yes

question: Online tools are meant for what by CCIRC?
is_impossible: yes

question: Where is Clarke from?
is_impossible: yes

question: What networks prevent malware in connected cars?
is_impossible: yes
context: China's network security and information technology leadership team was established February 27, 2014. The leadership team is tasked with national security and long-term development and co-ordination of major issues related to network security and information technology. Economic, political, cultural, social and military fields as related to network security and information technology strategy, planning and major macroeconomic policy are being researched. The promotion of national network security and information technology law are constantly under study for enhanced national security capabilities.

qas: question: What is the act of surreptitiously listening to a private conversation?
answers: text: Eavesdropping
is_impossible: no

question: Conversations that people eavesdrop on are typically between who?
answers: text: hosts on a network
is_impossible: no

question: Who has used programs such as Carnivore and NarusInsight to eavesdrop on the systems of internet service providers?
answers: text: the FBI and NSA
is_impossible: no

question: Eavesdropping on a closed system via the faint electro-magnetic trasmissions generated by the hardware has been referred to as what by the NSA?
answers: text: TEMPEST
is_impossible: no

question: What are machines that operate with no contact to the outside world called?
answers: text: a closed system
is_impossible: no

question: How can closed systems be eavesdropped upon?
is_impossible: yes

question: Who is guilty of eavesdropping on private conversations?
is_impossible: yes

question: Who does the FBI and NSA use Carnivore and Naruslnight to eavesdrop on?
is_impossible: yes

question: Who uses the programs Carnivore and Naruslnsight?
is_impossible: yes

question: What is eavesdropping?
is_impossible: yes

question: What programs do ISPs use to eavesdrop on the FBI?
is_impossible: yes

question: What is a conversation between hosts on a network called?
is_impossible: yes

question: What is special about hosts on a network?
is_impossible: yes

question: What transmissions does NarusInsight listen to?
is_impossible: yes

question: What program does the FBI use to eavesdrop on closed systems?
is_impossible: yes

question: How are exit procedures implemented?
is_impossible: yes

question: When did the incident in Stuxnet happen?
is_impossible: yes

question: What can an attacker install to your computer in order to collect personal data?
is_impossible: yes
context: Eavesdropping is the act of surreptitiously listening to a private conversation, typically between hosts on a network. For instance, programs such as Carnivore and NarusInsight have been used by the FBI and NSA to eavesdrop on the systems of internet service providers. Even machines that operate as a closed system (i.e., with no contact to the outside world) can be eavesdropped upon via monitoring the faint electro-magnetic transmissions generated by the hardware; TEMPEST is a specification by the NSA referring to these attacks.

qas: question: What are desktop computers and laptops commonly infected with?
answers: text: malware
is_impossible: no

question: Constructing a botnet to attack another target is an example of the activity of what?
answers: text: malware
is_impossible: no

question: Activity trackers are an example of what?
answers: text: Quantified Self devices
is_impossible: no

question: What could wifi, bluetooth, and cellphone network on devices be used as?
answers: text: attack vectors
is_impossible: no

question: What could be remotely activated after a sucessful breach?
answers: text: sensors
is_impossible: no

question: What do malware programs intend to collect from laptops and computers?
is_impossible: yes

question: What is the secondary interest of an attacker using malware?
is_impossible: yes

question: Why do gadgets that have GPS or collect data about your habits put you at risk for an attack?
is_impossible: yes

question: What could be collected from your devices by an attacker?
is_impossible: yes

question: What are cameras, microphones, GPS receivers, compasses and accelerometers considered?
is_impossible: yes

question: What is the name of the malware that affects activity trackers?
is_impossible: yes

question: What is another name for malware?
is_impossible: yes

question: How are Quantified Self Devices breached?
is_impossible: yes

question: What sensitive information do wifi networks carry?
is_impossible: yes

question: What type of information is rarely collected from a laptop?
is_impossible: yes

question: What type of intrusion did the crackers use to gain access to Rome Laboratory?
is_impossible: yes

question: Firewalls and exit procedures are considered what?
is_impossible: yes

question: What has using ACLs to confine programs proven?
is_impossible: yes
context: Desktop computers and laptops are commonly infected with malware either to gather passwords or financial account information, or to construct a botnet to attack another target. Smart phones, tablet computers, smart watches, and other mobile devices such as Quantified Self devices like activity trackers have also become targets and many of these have sensors such as cameras, microphones, GPS receivers, compasses, and accelerometers which could be exploited, and may collect personal information, including sensitive health information. Wifi, Bluetooth, and cell phone network on any of these devices could be used as attack vectors, and sensors might be remotely activated after a successful breach.

qas: question: What does ACL stand for?
answers: text: access control lists
is_impossible: no

question: ACLs and capability based security are two security models capable of what?
answers: text: enforcing privilege separation
is_impossible: no

question: A host computer tricked into indirectly allowing access to restricted files is known as what?
answers: text: the confused deputy problem
is_impossible: no

question: The confused deputy problem and the problem of not guaranteeing only one person has access are resolved by what?
answers: text: capabilities
is_impossible: no

question: What must designers of systems that are ACL based do?
answers: text: take responsibility to ensure that they do not introduce flaws
is_impossible: no

question: What has using ACLs to confine programs proven?
is_impossible: yes

question: How can a computer with ACL be tricked?
is_impossible: yes

question: Which two models in computer systems enforce privilege separation?
is_impossible: yes

question: Can an ACLs limit access to one person?
is_impossible: yes

question: What is the total number of security models in a computer system?
is_impossible: yes

question: When is an ACL most secure?
is_impossible: yes

question: What prevents ACLs from giving access to only one person?
is_impossible: yes

question: What do ACLs promise?
is_impossible: yes

question: Who is not responsible for the flaws in an ACL system?
is_impossible: yes

question: What does the IT security protect?
is_impossible: yes

question: How are clicks routed back to the top level page?
is_impossible: yes

question: Which part of a Linux computer is the firewall built into?
is_impossible: yes
context: Within computer systems, two of many security models capable of enforcing privilege separation are access control lists (ACLs) and capability-based security. Using ACLs to confine programs has been proven to be insecure in many situations, such as if the host computer can be tricked into indirectly allowing restricted file access, an issue known as the confused deputy problem. It has also been shown that the promise of ACLs of giving access to an object to only one person can never be guaranteed in practice. Both of these problems are resolved by capabilities. This does not mean practical flaws exist in all ACL-based systems, but only that the designers of certain utilities must take responsibility to ensure that they do not introduce flaws.[citation needed]

qas: question: In what year did over a hundred intrusions made into the Rome Laboraroty?
answers: text: 1994
is_impossible: no

question: How were hackers able to obtain unrestricted access to Rome's networking systems?
answers: text: Using trojan horses
is_impossible: no

question: How were hackers able to penetrate connected networks?
answers: text: by posing as a trusted Rome center user
is_impossible: no

question: What is the Rome Laboratory?
answers: text: the US Air Force's main command and research facility
is_impossible: no

question: Who does the Goddard Space Flight Center belong to?
answers: text: National Aeronautics and Space Administration
is_impossible: no

question: What did the hackers obtain?
is_impossible: yes

question: Why were the hackers untraceable?
is_impossible: yes

question: Posing as a trusted Rome Center user what did hackers use?
is_impossible: yes

question: Intrusion hackers were thought to be who?
is_impossible: yes

question: How were hackers able to go undetected? 
is_impossible: yes

question: Who were the crackers identified as?
is_impossible: yes

question: When was the Rome Laboratory created?
is_impossible: yes

question: What were the intruders unable to access?
is_impossible: yes

question: What did the 1994 breach of the National Aeronautics and Space Administration's Goddard Space Flight Center also give the crackers access to?
is_impossible: yes

question: What type of intrusion did the crackers use to gain access to Rome Laboratory?
is_impossible: yes

question: What are attacks designed to make a machine or network unavailable to its intended users?
is_impossible: yes

question: What types of measures do computer security firms rarely use today?
is_impossible: yes

question: What does the IT security protect?
is_impossible: yes
context: In 1994, over a hundred intrusions were made by unidentified crackers into the Rome Laboratory, the US Air Force's main command and research facility. Using trojan horses, hackers were able to obtain unrestricted access to Rome's networking systems and remove traces of their activities. The intruders were able to obtain classified files, such as air tasking order systems data and furthermore able to penetrate connected networks of National Aeronautics and Space Administration's Goddard Space Flight Center, Wright-Patterson Air Force Base, some Defense contractors, and other private sector organizations, by posing as a trusted Rome center user.

qas: question: When did The Impact Team successfully breach Ashley Madison?
answers: text: July of 2015
is_impossible: no

question: What is the name of the parent company that created Ashley Madison?
answers: text: Avid Life Media
is_impossible: no

question: When did the Avid Life Media CEO resign?
answers: text: After the second data dump
is_impossible: no

question: What was in the first data dump?
answers: text: emails from the company's CEO
is_impossible: no

question: What website, in addition to Ashley Madison, was Avid Media instructed to take offline?
answers: text: Established Men
is_impossible: no

question: Why was the website to be removed? 
is_impossible: yes

question: How did the site remain functional after the data breach? 
is_impossible: yes

question: What was the response from people using the service? 
is_impossible: yes

question: Was the Goal of the Impact Team carried out? 
is_impossible: yes

question: Were other sites compromised in addition to Ashley Madison? 
is_impossible: yes

question: Who was the CEO of Ashley Madison?
is_impossible: yes

question: When was Ashley Madison taken down?
is_impossible: yes

question: When was Established Man taken offline?
is_impossible: yes

question: How large was the data dump of the CEO's emails?
is_impossible: yes

question: Why was the customer data dumped first?
is_impossible: yes

question: What do companies have to worry about least?
is_impossible: yes

question: Online tools are meant for what by CCIRC?
is_impossible: yes

question: What can voice recognition not be used for?
is_impossible: yes
context: In July of 2015, a hacker group known as "The Impact Team" successfully breached the extramarital relationship website Ashley Madison. The group claimed that they had taken not only company data but user data as well. After the breach, The Impact Team dumped emails from the company's CEO, to prove their point, and threatened to dump customer data unless the website was taken down permanently. With this initial data release, the group stated “Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers' secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online.”  When Avid Life Media, the parent company that created the Ashley Madison website, did not take the site offline, The Impact Group released two more compressed files, one 9.7GB and the second 20GB. After the second data dump, Avid Life Media CEO Noel Biderman resigned, but the website remained functional.

qas: question: According to goverment officials, what has the failure of the private sector to solve efficiently the cybersecurity problem created?
answers: text: a crucial need for regulation
is_impossible: no

question: Where was the RSA Security Conference held?
answers: text: San Francisco
is_impossible: no

question: Who believes that government intervention would affect innovation?
answers: text: executives from the private sector
is_impossible: no

question: Who said "industry only responds when you threaten regulation"?
answers: text: R. Clarke
is_impossible: no

question: What is a virtual space free of any government intervention?
answers: text: cyberspace
is_impossible: no

question: What is the polemical problem presented? 
is_impossible: yes

question: What is considered vital of the internet? 
is_impossible: yes

question: Who currently runs cyberspace? 
is_impossible: yes

question: Is the cyberspace industry under attack or threatened by regulation? 
is_impossible: yes

question: Who believes they are better at improving cyberspace? 
is_impossible: yes

question: What do most people agree on in regards to internet security?
is_impossible: yes

question: Why did R. Clarke want to avoid government intervention?
is_impossible: yes

question: Where is government intervention most common?
is_impossible: yes

question: Why is threatening an industry unhelpful according to Clarke?
is_impossible: yes

question: Where is Clarke from?
is_impossible: yes

question: Why would IT security partake in malpractice?
is_impossible: yes

question: What industrial equipment effected after receiving malicious commands?
is_impossible: yes

question: How can a network attack from a single IP address be blocked?
is_impossible: yes
context: The question of whether the government should intervene or not in the regulation of the cyberspace is a very polemical one. Indeed, for as long as it has existed and by definition, the cyberspace is a virtual space free of any government intervention. Where everyone agree that an improvement on cybersecurity is more than vital, is the government the best actor to solve this issue? Many government officials and experts think that the government should step in and that there is a crucial need for regulation, mainly due to the failure of the private sector to solve efficiently the cybersecurity problem. R. Clarke said during a panel discussion at the RSA Security Conference in San Francisco, he believes that the "industry only responds when you threaten regulation. If industry doesn't respond (to the threat), you have to follow through." On the other hand, executives from the private sector agree that improvements are necessary, but think that the government intervention would affect their ability to innovate efficiently.

qas: question: When did Public Safety Canada unveil Canada's Cyber Security Strategy?
answers: text: October 3, 2010
is_impossible: no

question: What outlines the ongoing implementation of the Cyber Security Strategy?
answers: text: The Action Plan 2010–2015 for Canada's Cyber Security Strategy
is_impossible: no

question: What outlines the responsibilities and provides a plan for coordination during a cyber incident?
answers: text: The Cyber Incident Management Framework for Canada
is_impossible: no

question: Canadian cyberspace was boosted by who? 
is_impossible: yes

question: Multiple departments were involved in what? 
is_impossible: yes

question: What type of plan is provided? 
is_impossible: yes

question: Why was a cyber security plan unveiled in October of 2010? 
is_impossible: yes

question: Who is the security measure meant to help the most? 
is_impossible: yes

question: When was Public Safety Canada founded?
is_impossible: yes

question: How many departments does the new strategy involve?
is_impossible: yes

question: Who created the Action Plan?
is_impossible: yes

question: What was the predecessor to Canada's Cyber Security Strategy?
is_impossible: yes

question: When was the Speech from the Throne?
is_impossible: yes

question: What is a conversation between hosts on a network called?
is_impossible: yes

question: Whan was NCAZ founded?
is_impossible: yes

question: What is the standard for EAL6?
is_impossible: yes
context: On October 3, 2010, Public Safety Canada unveiled Canada’s Cyber Security Strategy, following a Speech from the Throne commitment to boost the security of Canadian cyberspace. The aim of the strategy is to strengthen Canada’s "cyber systems and critical infrastructure sectors, support economic growth and protect Canadians as they connect to each other and to the world." Three main pillars define the strategy: securing government systems, partnering to secure vital cyber systems outside the federal government, and helping Canadians to be secure online. The strategy involves multiple departments and agencies across the Government of Canada. The Cyber Incident Management Framework for Canada outlines these responsibilities, and provides a plan for coordinated response between government and other partners in the event of a cyber incident. The Action Plan 2010–2015 for Canada's Cyber Security Strategy outlines the ongoing implementation of the strategy.

qas: question: What is a potential attack vector for utilities such as the power grid?
answers: text: The Internet
is_impossible: no

question: What demonstrated equipment controlled by computers not connected to the internet can also be vulnerable?
answers: text: the Stuxnet worm
is_impossible: no

question: When did the Computer Emergency Readiness Team investigate 79 hacking incidents at energy companies?
answers: text: 2014
is_impossible: no

question: What department does the Computer Emergency Readiness Team belong to?
answers: text: the Department of Homeland Security
is_impossible: no

question: How did the Stuxnet worm infect industrial equipment?
answers: text: via removable media
is_impossible: no

question: What division was part of the Department of Homeland Security?
is_impossible: yes

question: Can computers not attached to the internet be attack by a virus?
is_impossible: yes

question: What industrial equipment effected after receiving malicious commands?
is_impossible: yes

question: What type of damage was dealt to the industrial equipment?
is_impossible: yes

question: What controls the functions of our utilities such as telecommunications, power grid, nuclear power plants, etc?
is_impossible: yes

question: What controls computer functions?
is_impossible: yes

question: Who created the Stuxnet worm?
is_impossible: yes

question: When was the Stuxnet worm created?
is_impossible: yes

question: What was infected in the 79 hacking incidents at energy companies?
is_impossible: yes

question: How many people were on the Computer Emergency Readiness Team?
is_impossible: yes

question: When are microchip vulnerabilities removed?
is_impossible: yes

question: What functions as a counterpart document to the National Strategy and Action Plan for Critical Infrastructure?
is_impossible: yes

question: What is an exit procedure?
is_impossible: yes
context: Computers control functions at many utilities, including coordination of telecommunications, the power grid, nuclear power plants, and valve opening and closing in water and gas networks. The Internet is a potential attack vector for such machines if connected, but the Stuxnet worm demonstrated that even equipment controlled by computers not connected to the Internet can be vulnerable to physical damage caused by malicious commands sent to industrial equipment (in that case uranium enrichment centrifuges) which are infected via removable media. In 2014, the Computer Emergency Readiness Team, a division of the Department of Homeland Security, investigated 79 hacking incidents at energy companies.

qas: question: Firewalls and exit procedures are considered what?
answers: text: "preventive" measures
is_impossible: no

question: What is defined as a way of filtering network data between a host or network and another network?
answers: text: A firewall
is_impossible: no

question: What does a physical firewall consist of?
answers: text: a separate machine filtering network traffic
is_impossible: no

question: What type of machines normall have a firewall?
answers: text: permanently connected to the Internet
is_impossible: no

question: What compromises mainly preventative measures?
answers: text: computer security
is_impossible: no

question: Computer security is mostly comprised of what?
is_impossible: yes

question: How are firewalls implemented?
is_impossible: yes

question: Which system has a built in firewall?
is_impossible: yes

question: What is another form of having a firewall connected?
is_impossible: yes

question: Which part of a Linux computer is the firewall built into?
is_impossible: yes

question: What types of measures do computer security firms rarely use today?
is_impossible: yes

question: What type of machine rarely uses firewalls?
is_impossible: yes

question: What is an exit procedure?
is_impossible: yes

question: How are exit procedures implemented?
is_impossible: yes

question: What type of OS does not use the operating system kernel?
is_impossible: yes

question: What was the loss estimated for covert attacks in 2003?
is_impossible: yes

question: Where was the RSA Security Conference held?
is_impossible: yes

question: Who disagreed with the saying "Connectedness begets vulnerability"?
is_impossible: yes
context: Today, computer security comprises mainly "preventive" measures, like firewalls or an exit procedure. A firewall can be defined as a way of filtering network data between a host or a network and another network, such as the Internet, and can be implemented as software running on the machine, hooking into the network stack (or, in the case of most UNIX-based operating systems such as Linux, built into the operating system kernel) to provide real time filtering and blocking. Another implementation is a so-called physical firewall which consists of a separate machine filtering network traffic. Firewalls are common amongst machines that are permanently connected to the Internet.

qas: question: What has caused serious financial damage?
answers: text: security breaches
is_impossible: no

question: Data made public who is available to estimate the cost of an incident?
answers: text: the organizations involved
is_impossible: no

question: What is the amount of losses estimated from worms and viruses in 2003?
answers: text: $13 billion
is_impossible: no

question: Who produces estimates of worldwide losses attributable to security breaches?
answers: text: Several computer security consulting firms
is_impossible: no

question: What is the underlying methodology of finding worldwide estimates for losses fur to security breaches?
answers: text: basically anecdotal
is_impossible: no

question: What was the loss estimated for covert attacks in 2003?
is_impossible: yes

question: What forms of attack were responsible for the loss?
is_impossible: yes

question: What information is used to estimate the cost of the incident?
is_impossible: yes

question: How wide-scale were the losses?
is_impossible: yes

question: Why is difficult to estimate loss in this situation?
is_impossible: yes

question: How much did firms save in 2003 from preventing attacks?
is_impossible: yes

question: When was the standard model for estimating the cost of a breach established?
is_impossible: yes

question: What data is not made public when an organization is breached?
is_impossible: yes

question: What was the minimum estimate of losses due to security breaches in the US in 2003?
is_impossible: yes

question: Why are loss estimates rarely challenged?
is_impossible: yes

question: How did the site remain functional after the data breach? 
is_impossible: yes

question: Why was China's network security team established? 
is_impossible: yes

question: How did the Stuxnet worm infect industrial equipment?
is_impossible: yes
context: Serious financial damage has been caused by security breaches, but because there is no standard model for estimating the cost of an incident, the only data available is that which is made public by the organizations involved. "Several computer security consulting firms produce estimates of total worldwide losses attributable to virus and worm attacks and to hostile digital acts in general. The 2003 loss estimates by these firms range from $13 billion (worms and viruses only) to $226 billion (for all forms of covert attacks). The reliability of these estimates is often challenged; the underlying methodology is basically anecdotal."

qas: question: Microchips vulnerabilities are introduced when?
answers: text: during the manufacturing process
is_impossible: no

question: What offers an alternative to soft-ware only computer security?
answers: text: hardware-based or assisted computer security
is_impossible: no

question: What can hardware be a source of?
answers: text: insecurity
is_impossible: no

question: What is required in order for hardware to be compromised?
answers: text: physical access (or sophisticated backdoor access)
is_impossible: no

question: What step can increase computer security?
is_impossible: yes

question: What is used in physical access of a computer?
is_impossible: yes

question: What causes hardware to be insecure?
is_impossible: yes

question: How can a cell phone increase computer security?
is_impossible: yes

question: What physical device is used as a passkey for your computer?
is_impossible: yes

question: When are microchip vulnerabilities removed?
is_impossible: yes

question: Dongles less secure because of what?
is_impossible: yes

question: What is an example of software-only computer security?
is_impossible: yes

question: What is required to compromise a software-only computer?
is_impossible: yes

question: What type of vulnerability is hardware-based computer security impervious to?
is_impossible: yes

question: How are exit procedures implemented?
is_impossible: yes

question: What demonstrated equipment controlled by computers not connected to the internet can also be vulnerable?
is_impossible: yes

question: How did the Stuxnet worm infect industrial equipment?
is_impossible: yes
context: While hardware may be a source of insecurity, such as with microchip vulnerabilities maliciously introduced during the manufacturing process, hardware-based or assisted computer security also offers an alternative to software-only computer security. Using devices and methods such as dongles, trusted platform modules, intrusion-aware cases, drive locks, disabling USB ports, and mobile-enabled access may be considered more secure due to the physical access (or sophisticated backdoor access) required in order to be compromised. Each of these is covered in more detail below.

qas: question: What does CCIRC stand for?
answers: text: Canadian Cyber Incident Response Centre
is_impossible: no

question: Who is resposible for mitigating and responding to threats to Canada's critical infrastructure?
answers: text: CCIRC
is_impossible: no

question: Where does the CCIRC post regular cyber security bulletins?
answers: text: on the Public Safety Canada website
is_impossible: no

question: What functions as a counterpart document to the National Strategy and Action Plan for Critical Infrastructure?
answers: text: Canada's Cyber Security Strategy
is_impossible: no

question: What sort of responses are CCIRC responsible for? 
is_impossible: yes

question: What would CCIRC do in an event of a breach? 
is_impossible: yes

question: What does the CCIRC operate? 
is_impossible: yes

question: CCIRC is part of what that is much larger? 
is_impossible: yes

question: Online tools are meant for what by CCIRC?
is_impossible: yes

question: What organization is attacking Canada's infrastructure?
is_impossible: yes

question: Who runs Public Safety Canada?
is_impossible: yes

question: What document contradicts the Cyber Security Strategy?
is_impossible: yes

question: Who controls Canada's infrastructure?
is_impossible: yes

question: What do individuals use to create a cyber incident?
is_impossible: yes

question: The confused deputy problem and the problem of not guaranteeing only one person has access are resolved by what?
is_impossible: yes

question: Computer security is mostly comprised of what?
is_impossible: yes

question: What types of measures do computer security firms rarely use today?
is_impossible: yes
context: Public Safety Canada’s Canadian Cyber Incident Response Centre (CCIRC) is responsible for mitigating and responding to threats to Canada’s critical infrastructure and cyber systems. The CCIRC provides support to mitigate cyber threats, technical support to respond and recover from targeted cyber attacks, and provides online tools for members of Canada’s critical infrastructure sectors. The CCIRC posts regular cyber security bulletins on the Public Safety Canada website. The CCIRC also operates an online reporting tool where individuals and organizations can report a cyber incident. Canada's Cyber Security Strategy is part of a larger, integrated approach to critical infrastructure protection, and functions as a counterpart document to the National Strategy and Action Plan for Critical Infrastructure.

qas: question: Who said "Connectedness begets vulnerability?"
answers: text: Jay Cross
is_impossible: no

question: What organization does Jay Cross belong to?
answers: text: the Internet Time Group
is_impossible: no

question: What is the advantage of more critical infrastructure being controlled via computer programs?
answers: text: increasing efficiency
is_impossible: no

question: What is the disadvantage of more critical infrastructure being controlled via computer programs?
answers: text: exposes new vulnerabilities
is_impossible: no

question: What has led to cyberwarfare? 
is_impossible: yes

question: What is cyberterrorism? 
is_impossible: yes

question: In what way does "connectedness begets vulnerability?" 
is_impossible: yes

question: What types of test will be run? 
is_impossible: yes

question: Will cyberterrorism evolve with new technology? 
is_impossible: yes

question: Who coined the word "cyberwarfare"?
is_impossible: yes

question: What computer program controls critical infrastructure?
is_impossible: yes

question: Which infrastructures are the least vulnerable to attack?
is_impossible: yes

question: What is cyberterrorism?
is_impossible: yes

question: Who disagreed with the saying "Connectedness begets vulnerability"?
is_impossible: yes

question: How many credit card numbers were stole from Home Depot in 2014?
is_impossible: yes

question: What were researchers in 2011 able to use as a successful attack vector?
is_impossible: yes

question: Where does the CCIRC post regular cyber security bulletins?
is_impossible: yes
context: This has led to new terms such as cyberwarfare and cyberterrorism. More and more critical infrastructure is being controlled via computer programs that, while increasing efficiency, exposes new vulnerabilities. The test will be to see if governments and corporations that control critical systems such as energy, communications and other information will be able to prevent attacks before they occur. As Jay Cross, the chief scientist of the Internet Time Group, remarked, "Connectedness begets vulnerability."

qas: question: When did Public Safety Canada partner with Stop.Think. Connect?
answers: text: September 27, 2010
is_impossible: no

question: When was the Cyber Security Cooperation Program launched by the Government of Canada?
answers: text: February 4, 2014
is_impossible: no

question: Who routinely updates the GetCyberSafe portal for Canadian citizens?
answers: text: Public Safety Canada
is_impossible: no

question: What month is Cyber Security Awareness Month?
answers: text: October
is_impossible: no

question: How much does the Cyber Security Cooperation Program cost?
answers: text: $1.5 million
is_impossible: no

question: STOP.THINK.CONNECT is what kind of organization? 
is_impossible: yes

question: What type of grants were given out by the Canadian Government? 
is_impossible: yes

question: What does the Cyber Security Cooperation monitor? 
is_impossible: yes

question: Why is there a cyber security month? 
is_impossible: yes

question: How are people protected online? 
is_impossible: yes

question: When was STOP.THINK.CONNECT created?
is_impossible: yes

question: How expensive is the GetCyberSafe portal?
is_impossible: yes

question: When was the Cyber Security Cooperation Program shut down?
is_impossible: yes

question: When was the GetCyberSafe portal created?
is_impossible: yes

question: When is the international Cyber Security Awareness month?
is_impossible: yes

question: What do ACLs promise?
is_impossible: yes

question: What does EAL stand for?
is_impossible: yes

question: What can infect other computers from your own?
is_impossible: yes
context: On September 27, 2010, Public Safety Canada partnered with STOP.THINK.CONNECT, a coalition of non-profit, private sector, and government organizations dedicated to informing the general public on how to protect themselves online. On February 4, 2014, the Government of Canada launched the Cyber Security Cooperation Program. The program is a $1.5 million five-year initiative aimed at improving Canada’s cyber systems through grants and contributions to projects in support of this objective. Public Safety Canada aims to begin an evaluation of Canada's Cyber Security Strategy in early 2015. Public Safety Canada administers and routinely updates the GetCyberSafe portal for Canadian citizens, and carries out Cyber Security Awareness Month during October.

qas: question: Installing keyloggers and making operating system modifications are examples of ways unauthorized users for what?
answers: text: compromise security
is_impossible: no

question: Booting a tool or another operating system from a CD Rom can bypass what?
answers: text: standard security measures
is_impossible: no

question: Disk encryption and Trusted Platform Module are designed to prevent what?
answers: text: attacks
is_impossible: no

question: An unauthorized user with physical access to a computer can likely do what?
answers: text: directly download data from it
is_impossible: no

question: What increases the safety of a computer?
is_impossible: yes

question: What can cause standard security measures to become obsolete?
is_impossible: yes

question: What is the number one cause of data theft?
is_impossible: yes

question: What can an attacker install to your computer in order to collect personal data?
is_impossible: yes

question: What can infect other computers from your own?
is_impossible: yes

question: What can an authorized user with access to a computer do?
is_impossible: yes

question: How are computers made secure?
is_impossible: yes

question: What does CD-ROM stand for?
is_impossible: yes

question: What is the name of a program designed to attack a computer?
is_impossible: yes

question: How does a user bypass a compromised security?
is_impossible: yes

question: What are zombie computers on a botnet?
is_impossible: yes

question: Online tools are meant for what by CCIRC?
is_impossible: yes

question: Who opened the BDN?
is_impossible: yes
context: An unauthorized user gaining physical access to a computer is most likely able to directly download data from it. They may also compromise security by making operating system modifications, installing software worms, keyloggers, or covert listening devices. Even when the system is protected by standard security measures, these may be able to be by passed by booting another operating system or tool from a CD-ROM or other bootable media. Disk encryption and Trusted Platform Module are designed to prevent these attacks.

qas: question: UI redress attack or User Interface redress attack is also known as what?
answers: text: Clickjacking
is_impossible: no

question: What is a malicious technique in which an attacker tricks the user into clicking on a button or link?
answers: text: Clickjacking
is_impossible: no

question: Where are the clicks meant for the top level page routed?
answers: text: some other irrelevant page
is_impossible: no

question: Where would a password typed on a seemingly authetic webpage be directed?
answers: text: into an invisible frame controlled by the attacker
is_impossible: no

question: How istricking the user accomplished in clickjacking?
answers: text: using multiple transparent or opaque layers
is_impossible: no

question: What is intended to be hijacked through a page overlay?
is_impossible: yes

question: What else can be hijacked through UI redress?
is_impossible: yes

question: What part of a webpage is meant to collect keystrokes?
is_impossible: yes

question: Why can the user not see the other page used by the attacker?
is_impossible: yes

question: Where is are the passwords and information stored by the attacker?
is_impossible: yes

question: What is avoiding a UI redress attack called?
is_impossible: yes

question: How are clicks routed back to the top level page?
is_impossible: yes

question: How is an legitimate webpage created?
is_impossible: yes

question: What is another name for hijacking keystrokes?
is_impossible: yes

question: Where is a user redirected to after putting in their password?
is_impossible: yes

question: STOP.THINK.CONNECT is what kind of organization? 
is_impossible: yes

question: When did Public Safety Canada partner with Stop.Think. Connect?
is_impossible: yes

question: How did the Stuxnet worm infect industrial equipment?
is_impossible: yes
context: Clickjacking, also known as "UI redress attack or User Interface redress attack", is a malicious technique in which an attacker tricks a user into clicking on a button or link on another webpage while the user intended to click on the top level page. This is done using multiple transparent or opaque layers. The attacker is basically "hijacking" the clicks meant for the top level page and routing them to some other irrelevant page, most likely owned by someone else. A similar technique can be used to hijack keystrokes. Carefully drafting a combination of stylesheets, iframes, buttons and text boxes, a user can be led into believing that they are typing the password or other information on some authentic webpage while it is being channeled into an invisible frame controlled by the attacker.

qas: question: How many computers were connected to the internet in 1988?
answers: text: 60,000
is_impossible: no

question: When was the first computer worm released?
answers: text: November 2, 1988
is_impossible: no

question: Who was the first computer worm traced back to?
answers: text: Robert Tappan Morris, Jr.
is_impossible: no

question: What is a malicious code that demands processor time and spreads itself to other computers?
answers: text: computer worm
is_impossible: no

question: Why did Morris Jr make the computer worm?
answers: text: he wanted to count how many machines were connected to the Internet
is_impossible: no

question: What types of computers were connected to the internet in 1988?
is_impossible: yes

question: On Nov 2, 1988 what caused many computers to slow down?
is_impossible: yes

question: When was the first computer worm?
is_impossible: yes

question: Who created the first computer worm?
is_impossible: yes

question: How old was the Cornell University Grad Student who created the worm?
is_impossible: yes

question: How many computers began to slow down on Nov. 2, 1988?
is_impossible: yes

question: Who tracked down the first computer worm?
is_impossible: yes

question: When was the computer worm caught?
is_impossible: yes

question: Where was the computer worm created?
is_impossible: yes

question: Which internet connected computers slowed down?
is_impossible: yes

question: What is another name for hijacking keystrokes?
is_impossible: yes

question: How does a user bypass a compromised security?
is_impossible: yes

question: What is the primary task of the Minister for Home Affairs?
is_impossible: yes
context: In 1988, only 60,000 computers were connected to the Internet, and most were mainframes, minicomputers and professional workstations. On November 2, 1988, many started to slow down, because they were running a malicious code that demanded processor time and that spread itself to other computers – the first internet "computer worm". The software was traced back to 23-year-old Cornell University graduate student Robert Tappan Morris, Jr. who said 'he wanted to count how many machines were connected to the Internet'.

qas: question: Who are Rescator?
answers: text: a Russian/Ukrainian hacking ring
is_impossible: no

question: What was stolen from Target Corporation computers in 2013?
answers: text: 40 million credit cards
is_impossible: no

question: How many credit card numbers were stole from Home Depot in 2014?
answers: text: between 53 and 56 million
is_impossible: no

question: What machines were involved in the physical security breaches that played a large role in the incident?
answers: text: self checkout machines
is_impossible: no

question: Who is Jim Walter?
answers: text: director of threat intelligence operations at security technology company McAfee
is_impossible: no

question: What was done when credit cards were stolen? 
is_impossible: yes

question: What was the main breach? 
is_impossible: yes

question: Who could have easily stopped the hacking?
is_impossible: yes

question: Unsophisticated malware was used on what? 
is_impossible: yes

question: Why was the malware uninteresting? 
is_impossible: yes

question: Who was the leader of Rescator?
is_impossible: yes

question: What was stolen from McAfee?
is_impossible: yes

question: When was the investigation concluded?
is_impossible: yes

question: Why weren't the companies warned about the threat?
is_impossible: yes

question: When was Rescator formed?
is_impossible: yes

question: Why is it difficult to defend against DDos?
is_impossible: yes

question: What website, in addition to Ashley Madison, was Avid Media instructed to take offline?
is_impossible: yes

question: Who coined the word "cyberwarfare"?
is_impossible: yes
context: In 2013 and 2014, a Russian/Ukrainian hacking ring known as "Rescator" broke into Target Corporation computers in 2013, stealing roughly 40 million credit cards, and then Home Depot computers in 2014, stealing between 53 and 56 million credit card numbers. Warnings were delivered at both corporations, but ignored; physical security breaches using self checkout machines are believed to have played a large role. "The malware utilized is absolutely unsophisticated and uninteresting," says Jim Walter, director of threat intelligence operations at security technology company McAfee – meaning that the heists could have easily been stopped by existing antivirus software had administrators responded to the warnings. The size of the thefts has resulted in major attention from state and Federal United States authorities and the investigation is ongoing.

qas: question: What does NCAZ stand for?
answers: text: Nationales Cyber-Abwehrzentrum
is_impossible: no

question: What does NCAZ take care of?
answers: text: national security aspects
is_impossible: no

question: When was NCAZ opened?
answers: text: June 16, 2011
is_impossible: no

question: Whan was NCAZ founded?
answers: text: February 23, 2011
is_impossible: no

question: What is the purpose of NCAZ?
answers: text: to detect and prevent attacks against the national infrastructure
is_impossible: no

question: Why does Berlin start a National Cyber Defense Initiative? 
is_impossible: yes

question: Why does NCAZ work closely with BSI? 
is_impossible: yes

question: Who takes care of national security?
is_impossible: yes

question: What incidents are it to prevent? 
is_impossible: yes

question: What was the Stuxnet incident? 
is_impossible: yes

question: Where is the German Minister for Home Affairs located?
is_impossible: yes

question: When did the incident in Stuxnet happen?
is_impossible: yes

question: Where is the BSI located?
is_impossible: yes

question: Who opened the BDN?
is_impossible: yes

question: What is the primary task of the Minister for Home Affairs?
is_impossible: yes

question: Why was the customer data dumped first?
is_impossible: yes

question: What website, in addition to Ashley Madison, was Avid Media instructed to take offline?
is_impossible: yes

question: Data made public who is available to estimate the cost of an incident?
is_impossible: yes
context: Berlin starts National Cyber Defense Initiative: On June 16, 2011, the German Minister for Home Affairs, officially opened the new German NCAZ (National Center for Cyber Defense) Nationales Cyber-Abwehrzentrum located in Bonn. The NCAZ closely cooperates with BSI (Federal Office for Information Security) Bundesamt für Sicherheit in der Informationstechnik, BKA (Federal Police Organisation) Bundeskriminalamt (Deutschland), BND (Federal Intelligence Service) Bundesnachrichtendienst, MAD (Military Intelligence Service) Amt für den Militärischen Abschirmdienst and other national organisations in Germany taking care of national security aspects. According to the Minister the primary task of the new organisation founded on February 23, 2011, is to detect and prevent attacks against the national infrastructure and mentioned incidents like Stuxnet.