Securing Spaces · ⁨Melindungi Ruang⁩

AP Cybersecurity · ⁨AP Keamanan Siber⁩ · Topic 2 · ⁨Topik 2⁩

View Slides · ⁨Lihat Salindia⁩ Train · ⁨Latih⁩

2.1

Cyber Foundations · ⁨Dasar-dasar Siber⁩

Syllabus · ⁨Silabus⁩

Learning Objective	Essential Knowledge
2.1.A Identify social engineering attacks.	2.1.A.1 Social engineers use psychological tactics to manipulate targets into taking a desired action. 2.1.A.2 Pretexting is when adversaries create a believable reason to contact a target. 2.1.A.3 Authority is when adversaries impersonate someone with power over a target or pretend to relay instructions from that person. 2.1.A.4 Intimidation is when adversaries state negative consequences if demands aren’t met. 2.1.A.5 Consensus is when adversaries create social pressure by making a target believe everyone else is doing a desired action. 2.1.A.6 Scarcity is when adversaries create a sense of limited availability. 2.1.A.7 Familiarity is when adversaries pretend to be or know someone close to a target to establish trust. 2.1.A.8 Urgency is when adversaries create a deadline that requires quick action by a target to avert negative consequences.
2.1.B Identify types of adversaries.	2.1.B.1 Script kiddies are low-skilled adversaries who use tools developed by others without understanding how the tools work. They are often motivated by greed or a desire for recognition. 2.1.B.2 Hacktivists are motivated by social, political, or personal causes. They compromise computers and networks to support their cause or stop perceived harm, believing their goals justify their illegal methods. 2.1.B.3 Insider adversaries are unique threats because they have legitimate credentials and access to systems and data. They can be recruited by malicious third parties and can be motivated by greed or revenge. 2.1.B.4 Cyberterrorists are motivated by politics or beliefs and seek to disrupt entire communities, regions, or nations through cyberattacks (e.g., attacking a power grid, water treatment plant, or other civil infrastructure). They can act independently or on behalf of governments or criminal organizations. 2.1.B.5 Transnational criminal organizations seek financial gain primarily by deploying ransomware and stealing corporate intellectual property (IP) to sell in illegal markets.
2.1.C Describe the phases of a cyberattack.	2.1.C.1 Cyberattacks aim to disrupt, harm, steal, or destroy devices, networks, or data. Adversaries work in phases, which may not all be used in every attack. The phases are: i. Reconnaissance ii. Initial access iii. Persistence iv. Lateral movement v. Taking action vi. Evading detection 2.1.C.2 In the reconnaissance phase of an attack, adversaries gather as much information as possible about their target, often using open source intelligence (OSINT), which is freely available information. 2.1.C.3 In the initial-access phase of an attack, adversaries establish a foothold on the target’s computer, often through social engineering or compromised or weak credentials. 2.1.C.4 After gaining access during an attack, adversaries establish persistence to maintain access without needing to regain it. They may use a command and control (C2) protocol to send commands to the device and receive output, often through malware like a remote access trojan (RAT) or rootkit. 2.1.C.5 In the lateral-movement phase of an attack, adversaries try to escalate their privileges by accessing computers and user accounts with elevated permissions to services and data. 2.1.C.6 In the taking-action phase of an attack, adversaries act on their objectives by collecting targeted data, exfiltrating it, and disrupting services or destroying data. 2.1.C.7 In the final phase of an attack, many adversaries try to evade detection by removing or editing log files and erasing other files they may have planted on devices (e.g., malware).
2.1.D Describe the risk assessment process.	2.1.D.1 Risk occurs when a threat can exploit a vulnerability to compromise an asset. 2.1.D.2 An asset is anything valuable. Assets include financial resources, intellectual property, data, digital infrastructure, physical property, and reputation. 2.1.D.3 Risk assessment considers two factors: The likelihood of an attack against a specific vulnerability The severity of the projected damage from an attack against a specific vulnerability 2.1.D.4 The likelihood of a vulnerability being exploited depends on many factors, including: The value of the target: Adversaries are more likely to attack targets they perceive as valuable. The level of skill required to exploit the vulnerability (i.e., the difficulty): Vulnerabilities with well-documented exploits often require less skill and can be carried out by more adversaries. The motivation and capabilities of likely adversaries: Highly motivated and skilled adversaries are more likely to be able to perform more complex exploits. 2.1.D.5 The severity of an attack is often measured by financial cost, which can also include reputational and operational impacts. Illustrative examples for 2.1.D.5: A hacktivist is passionate about illegal fishing practices supported by a local food production company. The main webpage of this food production company would be a high-value target for this hacktivist; defacing the webpage to expose the company’s support of illegal fishing would provide no financial gain to the adversary, but would allow them to raise awareness about an issue that motivates them. 2.1.D.6 The result of a risk assessment can be quantitative or qualitative. Quantitative risk assessment assigns a numeric value to a vulnerability based on a numeric scale (e.g., 1–10) or quantifiable impact, which could be financial (e.g., a $10,000 annual risk). Illustrative examples for 2.1.D.6: Low, medium, high, severe Unlikely low impact, likely low impact, unlikely high impact, likely high impact 2.1.D.7 Risk assessment documentation should include: Vulnerable assets and their value Descriptions of likely threats to the assets Details of specific vulnerabilities for specific assets and how they would be exploited An explanation of the severity of damage (financial, operational, reputational, etc.) if a specific asset were compromised, and the likelihood of that compromise occurring A final rating, quantitative or qualitative, for each risk identified Illustrative examples for 2.1.D.7: Scaled score (e.g., 1–10) Monetary value (e.g., a $10,000 risk vs. a$100,000 risk)
2.1.E Identify strategies for managing risk.	2.1.E.1 Once a risk has been identified and assessed, an organization has four options for managing that risk: i. Avoid ii. Transfer iii. Mitigate iv. Accept 2.1.E.2 Risk avoidance stops the activity that is generating the risk. If the activity is a critical part of an organization’s mission or purpose, then avoidance is not possible. 2.1.E.3 Risk transference places the burden of the risk on another entity, such as an insurance company, a government, or consumers. 2.1.E.4 Risk mitigation implements security controls to reduce the likelihood or impact of a risk. 2.1.E.5 Residual risk is the risk that remains after an organization has gone through avoidance, transference, and mitigation. The residual risk is the level of risk that an organization is willing to accept. Risk acceptance acknowledges the fact that absolute security is unattainable. 2.1.E.6 To conserve financial resources and employee capacity, an organization will often favor solutions that are cost effective and easy to implement and maintain. Cost-effective solutions cost less to install and maintain than the expected loss from an attack.
2.1.F Identify types of security controls.	2.1.F.1 Security controls address at least one of the following principles: Confidentiality ensures that only authorized individuals, systems, or processes can access data. Systems lacking confidentiality are vulnerable to data theft or destruction. Integrity ensures data are accurate and trustworthy. Systems lacking integrity are vulnerable to data manipulation. Availability ensures data and services are accessible to authorized individuals when needed. Systems lacking availability may experience unexpected downtime. 2.1.F.2 Security controls can be classified by type. Physical controls provide security in the physical space and include locks, fences, and cameras, bollards, and security guards. Technical controls provide security in the digital space and include firewalls, anti-malware software, and encryption. Managerial controls provide rules, guidelines, policies, and procedures that specify what security should be in place and include password policies, regular access reviews, and incident response plans (IRPs). 2.1.F.3 Security controls can be classified by function. Preventative controls address potential vulnerabilities with the goal of stopping an adversary from attacking and include locks and encryption. Detective controls help identify attacks when they occur and include intrusion detection systems (IDSs), cameras, and security incident and event management (SIEM) systems. Corrective controls fix problems and help restore systems to an operational state and include vulnerability patching, repairing a broken card reader, and intrusion prevention systems (IPSs).
2.1.G Explain why a defense-in-depth security strategy is necessary to optimally protect an organization.	2.1.G.1 A defense-in-depth strategy, or layered defense, uses multiple types of security controls to protect sensitive data and systems. 2.1.G.2 A defense-in-depth strategy allows an organization to address different types of threats, each with a security control most suited to mitigate it. 2.1.G.3 A defense-in-depth strategy allows for resilience in data protection so when one security control is bypassed by an adversary, another security control may still prevent access to the data or system or limit the damage done to the data or system. 2.1.G.4 Layers in a defense-in-depth strategy can include human, physical, network, device, application, and data.

Source: College Board AP Course and Exam Description · ⁨Sumber: Deskripsi Kursus dan Ujian College Board AP⁩

English

Before defending a system, you need a shared language. This section builds it.

Every security control protects at least one part of the CIA triad 信息安全三要素 - the three goals of security:

Confidentiality 保密性 - only authorised people can read the data.
Integrity 完整性 - the data is accurate and unaltered.
Availability 可用性 - the data and services are there when needed.

Attacks come from different adversaries, classified by their goals. A script kiddie 脚本小子 reuses tools built by others for greed or recognition; a hacktivist 黑客活动分子 acts for a political, social, or personal cause; an insider 内部人员 already holds legitimate access and may act from revenge or greed; a cyberterrorist 网络恐怖分子 disrupts critical infrastructure like a power grid or water plant; and transnational criminal organisations 跨国犯罪组织 chase money through ransomware and stolen data.

Most attacks unfold in phases 阶段: reconnaissance 侦察 (gathering information, often from public OSINT 公开来源情报 sources), initial access, persistence, lateral movement 横向移动 (spreading to more systems by escalating privileges), taking action on the goal, and evading detection. Naming the phase an attacker has reached helps a defender choose the right response.

Social engineering: the seven tactics

Most attacks begin not with code but with social engineering 社会工程学 - psychological tricks that manipulate a person into doing what the adversary wants. The exam names seven tactics, and expects you to identify which one a scenario shows:

Tactic	The trick
Pretexting 借口	inventing a believable reason to make contact ("I'm from IT, verifying your account")
Authority 权威	posing as someone powerful, or relaying "the boss's" instructions
Intimidation 恐吓	threatening negative consequences if a demand is not met
Consensus 从众	claiming everyone else is already doing it, to create social pressure
Scarcity 稀缺	inventing limited availability ("only 2 left")
Familiarity 熟悉	pretending to be, or to know, someone close to the target
Urgency 紧迫感	imposing a tight deadline so the target acts before thinking

the common thread is that all seven bypass a target's judgement by triggering an automatic emotional response - fear, trust, haste, or the wish to fit in. The defence is the same each time: verify through a separate, trusted channel before acting.

A risk 风险 appears when a threat 威胁 can exploit a vulnerability 漏洞 to compromise an asset 资产 (anything valuable - data, money, hardware, reputation). We assess risk by weighing two things: the likelihood 可能性 of an attack and the severity 严重性 of the damage.

Likelihood itself depends on the value of the target (adversaries chase what looks worth stealing), the skill needed to exploit the vulnerability (a well-documented exploit needs little skill, so more adversaries can use it), and the motivation and capability of likely adversaries. Severity is usually measured in financial cost, but includes reputational and operational damage too.

The final rating can be written two ways, and the exam wants you to tell them apart:

quantitative 定量 - a number: a score on a scale (e.g. 1-10), or a money value (e.g. "a $10,000 annual risk").
qualitative 定性 - a label: low / medium / high / severe, or a grid such as likely-high-impact vs unlikely-low-impact.

A written risk assessment 风险评估 should record, for each risk: the vulnerable asset and its value, the likely threats, how the specific vulnerability would be exploited, the severity if it were compromised, and a final quantitative or qualitative rating.

Once a risk is measured, an organisation has four ways to manage it:

Avoid 规避 - stop the risky activity (only possible if it isn't essential).
Transfer 转移 - shift the burden to someone else, such as an insurer.
Mitigate 缓解 - add controls to lower the likelihood or impact.
Accept 接受 - live with the leftover residual risk 剩余风险, because perfect security is impossible.

Security controls are grouped two ways. By type: physical 物理 (locks, fences, guards), technical 技术 (firewalls, anti-malware, encryption), and managerial 管理 (policies and procedures). By function: preventative 预防性 (stop an attack, like a lock), detective 检测性 (spot an attack, like a camera), and corrective 纠正性 (fix and restore, like patching).

Worked example. A hospital stores patient records on an unencrypted server in an unlocked room. Rate the risk: the asset is highly sensitive (patient data, protected by law) and the vulnerability is easy to exploit (no encryption, no access control), so this is a high risk. Now classify one fix - a door lock: by type it is a physical control, and by function it is preventative (it stops entry before an attack even begins).

The best strategy layers many controls - a defense-in-depth 纵深防御 approach. If an adversary bypasses one layer, another still stands. Layers include human, physical, network, device, application, and data.

Bahasa Indonesia

Dinding monitor: pemantauan dan pencatatan jaringan membantu mendeteksi intrusi

Sebelum membela sistem, Anda memerlukan bahasa yang disepakati. Bagian ini membangunnya.

Setiap kontrol keamanan melindungi setidaknya satu bagian dari CIA triad - tiga tujuan keamanan:

Kerahasiaan - hanya orang berwenang yang dapat membaca data.
Integritas - data akurat dan tidak berubah.
Ketersediaan - data dan layanan tersedia saat dibutuhkan.

CIA triad: tiga tujuan yang didukung setiap kontrol keamanan

Serangan berasal dari penjahat yang berbeda, diklasifikasikan berdasarkan tujuan mereka. Script kiddie menggunakan ulang alat yang dibuat orang lain karena serakah atau pengakuan; hacktivist bertindak demi causes politik, sosial, atau pribadi; insider sudah memiliki akses sah dan mungkin bertindak karena balas dendam atau keserakahan; terroris siber mengganggu infrastruktur kritis seperti jaringan listrik atau pabrik air; dan organisasi kriminal transnasional mengejar uang melalui ransomware dan data yang dicuri.

Sebagian besar serangan berlangsung dalam fase-fase: rekonstruksi (pengumpulan informasi, sering kali dari sumber OSINT publik), akses awal, ketahanan, pergerakan lateral (menyebar ke lebih banyak sistem dengan meningkatkan hak istimewa), mengambil tindakan atas tujuan, dan menghindari deteksi. Memberi nama fase yang telah dicapai penyerang membantu pembela memilih respons yang tepat.

Rekayasa sosial: tujuh taktik

Sebagian besar serangan dimulai bukan dengan kode tetapi dengan rekayasa sosial - trik psikologis yang memanipulasi seseorang agar melakukan apa yang diinginkan penjahat. Ujian menyebutkan tujuh taktik, dan mengharapkan Anda mengidentifikasi mana yang ditunjukkan oleh sebuah skenario:

Taktik	Triknya
Pretexting	menciptakan alasan yang masuk akal untuk menghubungi ("Saya dari IT, memverifikasi akun Anda")
Otoritas	berpura-pura menjadi seseorang berkuasa, atau meneruskan instruksi "bos"
Intimidasi	mengancam konsekuensi negatif jika tuntutan tidak dipenuhi
Konsensus	mengklaim semua orang lain sudah melakukannya, untuk menciptakan tekanan sosial
Kelangkaan	menciptakan ketersediaan terbatas ("tersisa hanya 2")
Keakraban	berpura-pura menjadi, atau mengetahui, seseorang yang dekat dengan target
Urgensi	menetapkan tenggat waktu ketat sehingga target bertindak sebelum berpikir

benang merahnya adalah ketujuh hal itu melewati penilaian target dengan memicu respons emosional otomatis - ketakutan, kepercayaan, terburu-buru, atau keinginan untuk融入. Pertahanannya selalu sama: verifikasi melalui saluran terpisah dan terpercaya sebelum bertindak.

Risiko muncul ketika ancaman dapat mengeksploitasi kerentanan untuk merusak aset (sesuatu yang berharga - data, uang, perangkat keras, reputasi). Kita menilai risiko dengan menimbang dua hal: kemungkinan serangan dan keparahan kerusakan.

Kemungkinan itu sendiri bergantung pada nilai target (penjahat mengejar apa yang terlihat layak dicuri), keahlian yang diperlukan untuk mengeksploitasi kerentanan (eksploit yang didokumentasikan dengan baik membutuhkan sedikit keahlian, sehingga lebih banyak penjahat dapat menggunakannya), dan motivasi serta kemampuan penjahat yang mungkin. Keparahan biasanya diukur dalam biaya finansial, tetapi juga mencakup kerusakan reputasi dan operasional.

Peringkat akhir dapat ditulis dengan dua cara, dan ujian ingin Anda membedakan keduanya:

kuantitatif - sebuah angka: skor pada skala (mis. 1-10), atau nilai uang (mis. "risiko tahunan $10,000").
kualitatif - label: rendah / sedang / tinggi / parah, atau grid seperti mungkin-berdampak-tinggi vs tidak-mungkin-berdampak-rendah.

Penilaian risiko tertulis harus mencatat, untuk setiap risiko: aset yang rentan dan nilainya, ancaman yang mungkin, bagaimana kerentanan spesifik akan dieksploitasi, keparahan jika dirusak, dan peringkat kuantitatif atau kualitatif akhir.

Setelah risiko diukur, sebuah organisasi memiliki empat cara untuk mengelola-nya:

Hindari - hentikan aktivitas berisiko (hanya mungkin jika itu tidak penting).
Transfer - alihkan beban kepada orang lain, seperti perusahaan asuransi.
Mitigasi - tambahkan kontrol untuk menurunkan kemungkinan atau dampak.
Terima - hidup dengan risiko residual yang tersisa, karena keamanan sempurna mustahil.

Kontrol keamanan dikelompokkan dengan dua cara. Berdasarkan jenis: fisik (gembok, pagar, penjaga), teknis (firewall, anti-malware, enkripsi), dan manajerial (kebijakan dan prosedur). Berdasarkan fungsi: preventif (mencegah serangan, seperti gembok), detektif (menemukan serangan, seperti kamera), dan korektif (memperbaiki dan memulihkan, seperti pembaruan).

Contoh kerja. Sebuah rumah sakit menyimpan rekam pasien di server tanpa enkripsi di ruangan terbuka. Berikan peringkat risiko: asetnya sangat sensitif (data pasien, dilindungi undang-undang) dan kerentanannya mudah dieksploitasi (tanpa enkripsi, tanpa kontrol akses), jadi ini adalah risiko tinggi. Sekarang klasifikasikan satu perbaikan - kunci pintu: berdasarkan jenis ia adalah kontrol fisik, dan berdasarkan fungsi ia preventif (mencegah masuk sebelum serangan bahkan dimulai).

Strategi terbaik melapis banyak kontrol - pendekatan pertahanan berlapis. Jika penjahat melewati satu lapisan, lapisan lain masih berdiri. Lapisan meliputi manusia, fisik, jaringan, perangkat, aplikasi, dan data.

Pertahanan berlapis: banyak lapisan sehingga satu pelanggaran tidak mengekspos aset

Explore · ⁨Jelajahi⁩

Classify each security control by function · ⁨Klasifikasikan setiap kontrol keamanan berdasarkan fungsi⁩

A preventative control stops an attack, a detective control spots one in progress, and a corrective control fixes the damage and restores the system. · ⁨Sebuah kontrol preventif menghentikan serangan, kontrol detektif mendeteksi serangan yang sedang berlangsung, dan kontrol korektif memperbaiki kerusakan dan mengembalikan sistem.⁩

Explore · ⁨Jelajahi⁩

Classify each security control by type · ⁨Klasifikasikan setiap kontrol keamanan berdasarkan jenis⁩

A physical control guards the physical space, a technical control works in the digital space, and a managerial control is a rule, policy, or procedure. · ⁨Sebuah kontrol fisik menjaga ruang fisik, kontrol teknis bekerja di ruang digital, dan kontrol manajerial adalah aturan, kebijakan, atau prosedur.⁩

Vocabulary · ⁨Kosa kata⁩ Train · ⁨Latih⁩

English	Bahasa Indonesia
CIA triad/ˌsiː aɪ ˈeɪ ˈtraɪæd/	Triad CIA
Confidentiality/ˌkɒnfɪˌdenʃiˈæləti/	Kerahasiaan
Integrity/ɪnˈteɡrɪti/	Integritas
Availability/əˌveɪləˈbɪlɪti/	Ketersediaan
script kiddie/skrɪpt ˈkɪdi/	script kiddie
hacktivist/ˈhæktɪvɪst/	hacktivist
insider/ɪnˈsaɪdə/	insider
cyberterrorist/ˈsaɪbəterərɪst/	terroris siber
transnational criminal organisations/trænˈsnæʃənl ˈkrɪmɪnl ˌɔːɡənaɪˈzeɪʃnz/	organisasi kriminal transnasional
phases/ˈfeɪzɪz/	fasa
reconnaissance/rɪˈkɒnɪsəns/	reconnaissance
OSINT/ˈəʊsɪnt/	OSINT
lateral movement/ˈlætərəl ˈmuːvmənt/	lateral movement
social engineering/ˈsəʊʃl ˌendʒɪˈnɪərɪŋ/	insinyur sosial
Pretexting/ˈpriːtekstɪŋ/	Pretexting
Authority/əˈθɒrɪti/	Otoritas
Intimidation/ɪnˌtɪmɪˈdeɪʃn/	Intimidasi
Consensus/kənˈsensəs/	Konsensus
Scarcity/ˈskeəsɪti/	Kelangkaan
Familiarity/fəˌmɪliˈærɪti/	Keakraban
Urgency/ˈɜːdʒənsi/	Urgensi
risk/rɪsk/	risiko
threat/θret/	ancaman
vulnerability/ˌvʌlnərəˈbɪlɪti/	kerentanan
asset/ˈæset/	aset
likelihood/ˈlaɪklihʊd/	kemungkinan
severity/səˈverɪti/	kerusakan
quantitative/ˈkwɒntɪteɪtɪv/	quantitative
qualitative/ˈkwɒlɪteɪtɪv/	kualitatif
risk assessment/rɪsk əˈsesmənt/	penilaian risiko
Avoid/əˈvɔɪd/	Hindari
Transfer/ˈtrænsfɜː/	Transfer
Mitigate/ˈmɪtɪɡeɪt/	Mengurangi
Accept/əkˈsept/	Terima
residual risk/rɪˈsɪdʒuːəl rɪsk/	risiko residu
defense-in-depth/dɪˈfens ɪn depθ/	pertahanan berlapis
physical attacks/ˈfɪzɪkl əˈtæks/	serangan fisik

Watch lesson · ⁨Tonton pelajaran⁩

2.2

Physical Vulnerabilities and Attacks · ⁨Kerentanan dan Serangan Fisik⁩

Syllabus · ⁨Silabus⁩

English

Learning Objective 2.2.A: Identify common physical attacks.

2.2.A.1 Adversaries often use social engineering when conducting a physical attack.
2.2.A.2 Piggybacking is the name for an attack where an adversary uses social engineering to manipulate an authorized individual to grant the adversary access to a restricted area. Common piggybacking tactics include carrying something large to entice an authorized person to hold the door open, pretending to be an authorized person who has forgotten their access token, or pretending to be a maintenance person who needs to get into a certain area to perform an inspection or repair.
2.2.A.3 Tailgating is the name for an attack where an adversary gains unauthorized access to a restricted area by following close behind an authorized individual without that individual’s awareness or knowledge.
2.2.A.4 Shoulder surfing is the name for an attack where an adversary watches as a user accesses sensitive information so the adversary can use it later. Sometimes adversaries use a camera to record the target accessing the sensitive information for later analysis.
2.2.A.5 Dumpster diving is the name for an attack where an adversary goes through a target’s physical trash to look for information that could be used to help the adversary reach their goal.
2.2.A.6 Card cloning is the name for an attack where an adversary makes a copy of an authorized user’s access card so they can gain access to all the resources the user is authorized to access.

Learning Objective 2.2.B: Explain how threats can exploit common physical vulnerabilities to cause loss, damage, disruption, or destruction to assets.

2.2.B.1 Threats include human adversaries seeking to cause harm or disruption as well as natural disasters. Natural disasters can cause physical damage or destruction to computers and data as well as disruption of digital services provided by computers.
2.2.B.2 Vulnerabilities are weaknesses or flaws that could allow an asset to be compromised. Common compromises include:
- Unauthorized access to sensitive data or restricted physical spaces
- Disruption of services
- Theft or destruction of digital or physical resources
- Unauthorized modification of data
2.2.B.3 When adversaries disrupt power to a device, the device and any services it provides become unavailable. To disrupt power, adversaries may damage fuses or breakers in an electrical box, unplug or cut electrical wiring, or damage power distribution systems like substations and transformers.
2.2.B.4 When adversaries gain access to an area with sensitive information, they can steal or copy sensitive information.
2.2.B.5 When adversaries gain physical access to a device and its ports, they can plug in a keylogger or external drive containing malware, which could allow them to collect data from a user or possibly even to gain control of the device. With direct physical access adversaries can also physically destroy a device, making the device itself, any data stored on it, and any services it provides unavailable.

Learning Objective 2.2.C: Assess and document risks from physical vulnerabilities.

2.2.C.1 Physical access to devices can allow adversaries to bypass many technical controls and layers of security.
2.2.C.2 High risks from physical vulnerabilities arise when sensitive information or systems are exposed in physical spaces without sufficiently restricted and controlled access.
- Illustrative examples for 2.2.C.2:
  - A server that stores customer data is in a room with no lock which is accessed via an unmonitored hallway.
2.2.C.3 Moderate risks from physical vulnerabilities arise when a noncritical or nonsensitive part of an organization is left unprotected in a way that it could act as a foothold for an adversary to gain initial access to other resources.
- Illustrative examples for 2.2.C.3:
  - An office has a reception area beyond which access is controlled; the receptionist has a computer that connects to the office’s internal wireless network and the computer has exposed USB ports.
2.2.C.4 Low risks from physical vulnerabilities arise when a vulnerable asset is of low value and the vulnerability is unlikely to be exploited.
- Illustrative examples for 2.2.C.4:
  - Employees in an office that requires badge access have laptop computers that they leave on their desks unattended when they all go to lunch together. The computers do not contain any sensitive information, but there are no cables securing the devices to the desks.

Bahasa Indonesia

Tujuan Pembelajaran 2.2.A: Identifikasi serangan fisik yang umum.

2.2.A.1 Musuh sering menggunakan rekayasa sosial saat melakukan serangan fisik.
2.2.A.2 Piggybacking adalah nama untuk serangan di mana musuh menggunakan rekayasa sosial untuk memanipulasi individu berwenang agar memberikan akses kepada musuh ke area terbatas. Taktik piggybacking yang umum meliputi membawa barang besar untuk mendorong orang berwenang membuka pintu, berpura-pura menjadi individu berwenang yang lupa token aksesnya, atau berpura-pura menjadi teknisi pemeliharaan yang perlu masuk ke area tertentu untuk melakukan inspeksi atau perbaikan.
2.2.A.3 Tailgating adalah nama untuk serangan di mana musuh mendapatkan akses tak berwenang ke area terbatas dengan mengikuti ketat di belakang individu berwenang tanpa disadari atau diketahui oleh individu tersebut.
2.2.A.4 Shoulder surfing adalah nama untuk serangan di mana musuh mengamati pengguna yang mengakses informasi sensitif sehingga musuh dapat menggunakannya nanti. Terkadang musuh menggunakan kamera untuk merekam target yang mengakses informasi sensitif untuk analisis di kemudian hari.
2.2.A.5 Dumpster diving adalah nama untuk serangan di mana musuh menggali sampah fisik target untuk mencari informasi yang dapat digunakan untuk membantu musuh mencapai tujuannya.
2.2.A.6 Card cloning adalah nama untuk serangan di mana musuh membuat salinan kartu akses pengguna berwenang agar mereka dapat mengakses semua sumber daya yang diizinkan bagi pengguna tersebut.

Tujuan Pembelajaran 2.2.B: Jelaskan bagaimana ancaman dapat mengeksploitasi kerentanan fisik umum untuk menyebabkan kerugian, kerusakan, gangguan, atau kehancuran aset.

2.2.B.1 Ancaman mencakup musuh manusia yang bertujuan menyebabkan harm atau gangguan serta bencana alam. Bencana alam dapat menyebabkan kerusakan fisik atau kehancuran pada komputer dan data serta gangguan layanan digital yang disediakan oleh komputer.
2.2.B.2 Kerentanan adalah kelemahan atau cacat yang dapat memungkinkan aset diretas. Kompromi yang umum meliputi:
- Akses tak berwenang ke data sensitif atau ruang fisik terbatas
- Gangguan layanan
- Pencurian atau penghancuran sumber daya digital atau fisik
- Modifikasi data tak berwenang
2.2.B.3 Ketika musuh memutus daya ke sebuah perangkat, perangkat dan layanan apa pun yang disediakannya menjadi tidak tersedia. Untuk memutus daya, musuh dapat merusak sekring atau pemutus sirkuit dalam kotak listrik, mencabut atau memotong kabel listrik, atau merusak sistem distribusi daya seperti gardu induk dan trafo.
2.2.B.4 Ketika musuh mendapatkan akses ke area yang berisi informasi sensitif, mereka dapat mencuri atau menyalin informasi sensitif tersebut.
2.2.B.5 Ketika musuh mendapatkan akses fisik ke perangkat dan port-nya, mereka dapat menyambungkan keylogger atau drive eksternal yang berisi malware, yang dapat memungkinkan mereka mengumpulkan data dari pengguna atau bahkan mengambil alih kendali perangkat. Dengan akses fisik langsung, musuh juga dapat menghancurkan perangkat secara fisik, menjadikan perangkat itu sendiri, data apa pun yang tersimpan di dalamnya, dan layanan apa pun yang disediakannya tidak tersedia.

Tujuan Pembelajaran 2.2.C: Perkirakan dan dokumentasikan risiko dari kerentanan fisik.

2.2.C.1 Akses fisik ke perangkat dapat memungkinkan musuh melewati banyak kontrol teknis dan lapisan keamanan.
2.2.C.2 Risiko tinggi dari kerentanan fisik muncul ketika informasi atau sistem sensitif terekspos di ruang fisik tanpa akses yang cukup dibatasi dan terkendali.
- Contoh ilustratif untuk 2.2.C.2:
  - Sebuah server yang menyimpan data pelanggan berada di ruangan tanpa kunci yang diakses melalui lorong yang tidak dipantau.
2.2.C.3 Risiko sedang dari kerentanan fisik muncul ketika bagian organisasi yang tidak kritis atau tidak sensitif dibiarkan tidak terlindungi sedemikian rupa sehingga dapat berfungsi sebagai pijakan bagi penjahat siber untuk mendapatkan akses awal ke sumber daya lain.
- Contoh ilustratif untuk 2.2.C.3:
  - Kantor memiliki area resepsionis yang melampaui batasnya akses dikendalikan; resepsionis memiliki komputer yang terhubung ke jaringan nirkabel internal kantor dan komputer tersebut memiliki port USB yang terekspos.
2.2.C.4 Risiko rendah dari kerentanan fisik muncul ketika aset yang rentan memiliki nilai rendah dan kerentanannya tidak mungkin dieksploitasi.
- Contoh ilustratif untuk 2.2.C.4:
  - Karyawan di kantor yang memerlukan kartu akses memiliki laptop yang mereka tinggalkan di meja tanpa pengawas saat mereka semua pergi makan siang bersama. Laptop-laptop tersebut tidak berisi informasi sensitif, tetapi tidak ada kabel yang mengikat perangkat ke meja.

Source: College Board AP Course and Exam Description · ⁨Sumber: Deskripsi Kursus dan Ujian College Board AP⁩

English

Digital security means nothing if an adversary can simply walk in. Common physical attacks 物理攻击 often begin with social engineering:

Piggybacking 尾随（获许可） - tricking an authorised person into holding a door open (for example, by carrying a heavy box).
Tailgating 尾随（未察觉） - slipping through a secured door behind someone without their knowledge.
Shoulder surfing 肩窥 - watching someone type a password or read sensitive information.
Dumpster diving 翻垃圾搜集情报 - searching a target's trash for useful information.
Card cloning 门禁卡复制 - copying an access card to enter restricted areas.

With physical access, an adversary can cut power, steal or copy data, or plug in a keylogger 键盘记录器. We rate physical risk as high when sensitive systems sit in a space without controlled access, moderate when an unimportant area could act as a foothold 立足点 to reach other resources, and low when the asset is worthless and unlikely to be attacked.

Bahasa Indonesia

Keamanan digital tidak berarti apa-apa jika penjahat dapat dengan mudah masuk. Serangan fisik yang umum sering kali dimulai dari rekayasa sosial:

Piggybacking（） - menipu orang berizin untuk membuka pintu (misalnya, dengan membawa kotak berat).
Tailgating（） - menyusup melalui pintu terkunci di belakang seseorang tanpa diketahuinya.
Shoulder surfing - mengintip seseorang saat mengetik kata sandi atau membaca informasi sensitif.
Dumpster diving - mencari sampah target untuk mendapatkan informasi yang berguna.
Card cloning - menyalin kartu akses untuk memasuki area terbatas.

Dengan akses fisik, penjahat dapat memutus listrik, mencuri atau menyalin data, atau memasang keylogger. Kami menilai risiko fisik sebagai tinggi ketika sistem sensitif berada di ruang tanpa akses terkontrol, sedang ketika area tidak penting dapat bertindak sebagai titik awal untuk mencapai sumber daya lain, dan rendah ketika aset tersebut tak berharga dan tidak mungkin diserang.

Gembok pada rantai: keamanan fisik adalah lapisan pertama — kunci, pintu, dan penghalang itu penting

Vocabulary · ⁨Kosa kata⁩ Train · ⁨Latih⁩

English	Bahasa Indonesia
physical/ˈfɪzɪkl/	fisika
technical/ˈteknɪkl/	teknis
managerial/ˌmænəˈdʒɪərɪəl/	manajerial
preventative/prɪˈventətɪv/	preventif
detective/dɪˈtektɪv/	detektif
corrective/kəˈrektɪv/	pembetulan
Piggybacking/ˈpɪɡɪbækɪŋ/	Piggybacking
Tailgating/ˈteɪlɡeɪtɪŋ/	Tailgating
Shoulder surfing/ˈʃəʊldə ˈsɜːfɪŋ/	Shoulder surfing
Dumpster diving/ˈdʌmpstə ˈdaɪvɪŋ/	Dumpster diving
Card cloning/kɑːd ˈkləʊnɪŋ/	Kloning kartu
keylogger/ˈkiːlɒɡə/	keylogger
foothold/ˈfʊthəʊld/	landasan
clean desk policy/kliːn desk ˈpɒlɪsi/	kebijakan meja bersih
bollards/ˈbɒlɑːdz/	tiang pelindung
card readers/kɑːd ˈriːdəz/	pembaca kartu
access control vestibule/ˈækses kənˈtrəʊl ˈvestɪbjuːl/	vestibul kendali akses
uninterruptible power supply (UPS)/ˌʌˌnɪntəˈrʌptɪbl ˈpaʊə səˈplaɪ/	catu daya tak terputus (UPS)
motion sensors/ˈməʊʃn ˈsensəz/	sensor gerakan
points of ingress and egress/pɔɪnts ɒv ˈɪŋɡres ænd iːˈɡres/	titik masuk dan keluar

Watch lesson · ⁨Tonton pelajaran⁩

2.3

Protecting Physical Spaces · ⁨Melindungi Ruang Fisik⁩

Syllabus · ⁨Silabus⁩

English

Learning Objective 2.3.A: Identify managerial controls related to physical security.

2.3.A.1 Organizations should conduct employee security awareness training to educate employees about how they can contribute to the organization’s security by:
- Detecting social engineering attempts like phishing
- Not badging other people into restricted areas
- Preventing device theft
2.3.A.2 Organizations should have a workstation security policy that outlines the measures necessary to protect a physical workplace. The policy may have tiers of workstation security based on the type of data handled at a workstation. Workstation policies often require:
- Locking devices before leaving workstations unattended to prevent unauthorized access
- Clearing sensitive documents off workstations before leaving them unattended (sometimes called a clean desk policy)
- Using a privacy screen filter or other physical barrier to prevent others from viewing information on the screen
- Connecting devices to surge protectors or uninterruptible power supplies (UPS)

Learning Objective 2.3.B: Determine mitigation strategies for risks from physical vulnerabilities.

2.3.B.1 To determine a relevant control, a cyber defender considers how an adversary could take advantage of a vulnerability to attack a system and how to prevent, detect, or correct the attack.
2.3.B.2 Installing physical controls like fencing, gates, and bollards around a building can deter adversaries from trying to physically access an organization’s buildings.
2.3.B.3 Locks on doors, server cabinets, and computers can prevent devices from being accessed or stolen.
2.3.B.4 Card readers can record which employee badges are being used to access different entries at specific times and deny access to unauthorized badges.
2.3.B.5 Access control vestibules and turnstiles can prevent an authorized person from intentionally or accidentally admitting an unauthorized person into a restricted area.
2.3.B.6 Organizations can disable USB ports to prevent external drives from loading malware onto a computer.
2.3.B.7 An uninterruptible power supply (UPS) provides a backup power source for a device in the event of a power outage. Organizations can also use power generators to provide power at a larger scale to a building or set of critical devices.
2.3.B.8 Organizations prioritize risk mitigations based on the severity of the risks and the cost of the recommended mitigations.

Bahasa Indonesia

Tujuan Pembelajaran 2.3.A: Identifikasi kontrol manajerial terkait keamanan fisik.

2.3.A.1 Organisasi harus menyelenggarakan pelatihan kesadaran keamanan karyawan untuk mengedukasi karyawan tentang bagaimana mereka dapat berkontribusi pada keamanan organisasi dengan cara:
- Mendeteksi upaya rekayasa sosial seperti phishing
- Tidak memasukkan orang lain ke area terbatas menggunakan kartu akses
- Mencegah pencurian perangkat
2.3.A.2 Organisasi harus memiliki kebijakan keamanan workstation yang menjelaskan langkah-langkah yang diperlukan untuk melindungi tempat kerja fisik. Kebijakan ini mungkin memiliki tingkat keamanan workstation berdasarkan jenis data yang ditangani di workstation. Kebijakan workstation sering kali mewajibkan:
- Mengunci perangkat sebelum meninggalkan workstation tanpa pengawasan untuk mencegah akses tidak sah
- Membersihkan dokumen sensitif dari workstation sebelum meninggalkannya tanpa pengawasan (kadang-kadang disebut kebijakan meja bersih)
- Menggunakan filter layar privasi atau penghalang fisik lainnya untuk mencegah orang lain melihat informasi di layar
- Menyambungkan perangkat ke pelindung lonjakan listrik atau catu daya tak terputus (UPS)

Tujuan Pembelajaran 2.3.B: Tentukan strategi mitigasi risiko dari kerentanan fisik.

2.3.B.1 Untuk menentukan kontrol yang relevan, seorang pertahanan siber mempertimbangkan bagaimana penjahat siber dapat memanfaatkan kerentanan untuk menyerang sistem dan bagaimana mencegah, mendeteksi, atau memperbaiki serangan tersebut.
2.3.B.2 Memasang kontrol fisik seperti pagar, gerbang, dan tiang bollard di sekitar gedung dapat deterrent penjahat siber dari mencoba mengakses gedung organisasi secara fisik.
2.3.B.3 Kunci pada pintu, kabinet server, dan komputer dapat mencegah perangkat diakses atau dicuri.
2.3.B.4 Pembaca kartu dapat mencatat kartu akses karyawan mana yang digunakan untuk mengakses berbagai pintu masuk pada waktu tertentu dan menolak akses untuk kartu yang tidak berwenang.
2.3.B.5 Vestibul kendali akses dan tuas putar dapat mencegah seseorang yang berwenang secara sengaja atau tidak sengaja memasukkan orang yang tidak berwenang ke area terbatas.
2.3.B.6 Organisasi dapat menonaktifkan port USB untuk mencegah drive eksternal memuat malware ke dalam komputer.
2.3.B.7 Catu daya tak terputus (UPS) menyediakan sumber cadangan daya untuk perangkat jika terjadi pemadaman listrik. Organisasi juga dapat menggunakan generator listrik untuk menyediakan daya dalam skala lebih besar ke gedung atau serangkaian perangkat kritis.
2.3.B.8 Organisasi memprioritaskan mitigasi risiko berdasarkan tingkat keparahan risiko dan biaya mitigasi yang direkomendasikan.

Source: College Board AP Course and Exam Description · ⁨Sumber: Deskripsi Kursus dan Ujian College Board AP⁩

English

Managerial controls come first: security-awareness training teaches staff not to badge strangers in, and a workstation security policy requires locking devices, clearing desks (a clean desk policy 清桌政策), and using privacy screens.

Physical controls then harden the building: fences, gates, and bollards 防撞柱 deter access; locks protect doors and cabinets; card readers 读卡器 log and restrict entry; an access control vestibule 门禁前室 (a two-door airlock) stops piggybacking; disabling USB ports blocks malware drives; and an uninterruptible power supply (UPS) 不间断电源 keeps devices running through an outage. Organisations prioritise these by matching the cost of a control to the severity of the risk.

Bahasa Indonesia

Kontrol manajerial datang terlebih dahulu: pelatihan kesadaran keamanan mengajarkan staf untuk tidak memberikan badge kepada orang asing, dan kebijakan keamanan stasiun kerja mewajibkan penguncian perangkat, pembersihan meja (kebijakan meja bersih), serta penggunaan layar privasi.

Kontrol fisik kemudian memperkuat bangunan: pagar, gerbang, dan bollard mencegah akses; kunci melindungi pintu dan lemari; pembaca kartu mencatat dan membatasi masuk; vestibul kontrol akses (airlock dua pintu) mencegah piggybacking; menonaktifkan port USB memblokir drive malware; dan catu daya tak terputus (UPS) menjaga perangkat tetap menyala selama pemadaman. Organisasi memprioritaskan hal ini dengan menyesuaikan biaya kontrol dengan tingkat keparahan risiko.

Kamera keamanan dome: kontrol fisik dan pemantauan melindungi ruang serta jaringan

Watch lesson · ⁨Tonton pelajaran⁩

2.4

Detecting Physical Attacks · ⁨Mendeteksi Serangan Fisik⁩

Syllabus · ⁨Silabus⁩

English

Learning Objective 2.4.A: Identify ways security controls can detect physical attacks.

2.4.A.1 Cameras can capture a visual record of an adversary’s malicious activity. The feed from a camera should be recorded and monitored for maximum effect. Recordings can be especially helpful in after-incident investigations.
2.4.A.2 Security guards can monitor activity in an area and respond to suspicious activity once detected.
2.4.A.3 Motion sensors can alert security to movement in an area.
2.4.A.4 Employees that work in a physical space are often the first to notice the presence of an unauthorized person and can alert security.

Learning Objective 2.4.B: Determine effective placement of security controls for detecting physical attacks.

2.4.B.1 When placing cameras, consideration should be given to visual coverage, angle, and the ability to be tampered with by an adversary. Consideration should also be given to what a camera in a specific area could capture an adversary doing and how that information would be helpful. Points of ingress and egress are often monitored by camera.
2.4.B.2 Motion sensors should be placed in areas where traffic is unexpected, like server rooms, or areas where sensitive materials are stored and few people have access. Motion sensors in high-traffic areas create many false alarms, making the alarms less likely to be taken seriously when there is a real security event.
2.4.B.3 Locks should be placed on all entries to areas containing sensitive information or systems. For areas with particularly sensitive information or systems, an organization could use an access control vestibule at the entry point to prevent piggybacking or tailgating.
2.4.B.4 Security guards can be stationary or patrolling. Stationary guards can provide constant protection for a specific area, entrance, or high-value item. Patrolling guards are more difficult for an adversary to plan around and can create time pressure for an adversary. Placing stationary guards at places that funnel traffic (e.g., entry gates, main entrances or lobbies, and entrances to more secure access areas) can be highly effective, while patrolling guards are better suited for perimeters and exterior areas.

Learning Objective 2.4.C: Apply detection techniques to identify physical attacks.

2.4.C.1 Cameras provide visual monitoring and a visual record of activity within a designated space. Cameras can be paired with facial recognition software that can provide alerts when unauthorized individuals enter controlled areas. Once a physical breach has been detected, defenders can use live and recorded camera footage to track an adversary’s path and actions.
2.4.C.2 Motion detectors work best when paired with cameras. When a security alert is raised because a motion detector has been activated, defenders can use cameras to check the space visually and verify a physical security breach.
2.4.C.3 When employees are required to use an electronic badge to unlock a door to a restricted area, a sensor can record how long the door was open. In reviewing entry logs for the door, potential piggybacking or tailgating can be detected by doors being open for longer than normal lengths of time.

Bahasa Indonesia

Tujuan Pembelajaran 2.4.A: Identifikasi cara-cara kontrol keamanan dapat mendeteksi serangan fisik.

2.4.A.1 Kamera dapat merekam aktivitas jahat penjahat siber secara visual. Sinyal kamera harus direkam dan dipantau untuk efek maksimal. Rekaman dapat sangat membantu dalam investigasi pasca-insiden.
2.4.A.2 Petugas keamanan dapat memantau aktivitas di suatu area dan merespons aktivitas mencurigai setelah terdeteksi.
2.4.A.3 Sensor gerakan dapat memberi peringatan kepada keamanan mengenai pergerakan di suatu area.
2.4.A.4 Karyawan yang bekerja di ruang fisik sering kali menjadi yang pertama menyadari kehadiran orang yang tidak berwenang dan dapat memberi peringatan kepada keamanan.

Tujuan Pembelajaran 2.4.B: Tentukan penempatan kontrol keamanan yang efektif untuk mendeteksi serangan fisik.

2.4.B.1 Saat memasang kamera, perlu dipertimbangkan cakupan visual, sudut pandang, dan kemampuan untuk dimanipulasi oleh penjahat siber. Pertimbangan juga harus diberikan pada apa yang dapat ditangkap kamera di area tertentu dilakukan oleh penjahat siber dan bagaimana informasi tersebut akan bermanfaat. Titik masuk dan keluar sering dipantau oleh kamera.
2.4.B.2 Sensor gerakan harus ditempatkan di area dengan lalu lintas yang tidak terduga, seperti ruang server, atau area di mana bahan sensitif disimpan dan sedikit orang yang memiliki akses. Sensor gerakan di area dengan lalu lintas tinggi menciptakan banyak alarm palsu, membuat alarm tersebut kurang mungkin diambil serius ketika terjadi insiden keamanan nyata.
2.4.B.3 Kunci harus dipasang pada semua pintu masuk ke area yang berisi informasi atau sistem sensitif. Untuk area dengan informasi atau sistem yang sangat sensitif, organisasi dapat menggunakan vestibul kendali akses di titik masuk untuk mencegah penggunaan kartu berganda (piggybacking) atau mengikuti seseorang (tailgating).
2.4.B.4 Petugas keamanan dapat bersifat diam atau patroli. Petugas yang diam dapat memberikan perlindungan konstan untuk area, pintu masuk, atau benda bernilai tinggi tertentu. Petugas patroli lebih sulit direncanakan oleh penjahat dan dapat menciptakan tekanan waktu bagi penjahat. Menempatkan petugas yang diam di tempat-tempat yang menyempitkan arus lalu lintas (misalnya gerbang masuk, pintu utama atau lobi, dan pintu masuk ke area akses yang lebih aman) dapat sangat efektif, sementara petugas patroli lebih cocok untuk perimeter dan area eksterior.

Tujuan Pembelajaran 2.4.C: Terapkan teknik deteksi untuk mengidentifikasi serangan fisik.

2.4.C.1 Kamera menyediakan pemantauan visual dan rekaman visual dari aktivitas dalam ruang yang ditentukan. Kamera dapat dipasangkan dengan perangkat lunak pengenalan wajah yang dapat memberikan peringatan ketika individu tidak berwenang memasuki area terkendali. Setelah pelanggaran fisik terdeteksi, pihak pertahanan dapat menggunakan rekaman kamera langsung dan terekam untuk melacak jalur dan tindakan penjahat.
2.4.C.2 Detektor gerakan bekerja paling baik jika dipasangkan dengan kamera. Ketika peringatan keamanan muncul karena aktivasi detektor gerakan, pihak pertahanan dapat menggunakan kamera untuk memeriksa ruang secara visual dan memverifikasi pelanggaran keamanan fisik.
2.4.C.3 Ketika karyawan diharuskan menggunakan kartu elektronik untuk membuka pintu ke area terbatas, sensor dapat mencatat berapa lama pintu terbuka. Saat meninjau log masuk untuk pintu tersebut, potensi piggybacking atau tailgating dapat dideteksi dengan pintu yang terbuka lebih lama dari biasanya.

Source: College Board AP Course and Exam Description · ⁨Sumber: Deskripsi Kursus dan Ujian College Board AP⁩

English

Some controls detect attacks rather than prevent them. Cameras record activity and help after-incident investigations; security guards respond to what they see; motion sensors 运动传感器 alert staff to movement; and employees themselves often notice an intruder first.

Placement matters. Cameras belong at points of ingress and egress 出入口 (entrances and exits). Motion sensors work best in low-traffic areas like server rooms - put them in a busy hallway and constant false alarms make everyone ignore them. Stationary guards protect a fixed high-value point, while patrolling guards are harder for an adversary to plan around. Reviewing door-open times in entry logs can even reveal piggybacking, because a door held open too long is suspicious.

Bahasa Indonesia

Beberapa kontrol mendeteksi serangan alih-alih mencegahnya. Kamera merekam aktivitas dan membantu investigasi pasca-insiden; petugas keamanan merespons apa yang mereka lihat; sensor gerakan memberi tahu staf tentang pergerakan; dan karyawan sendiri seringkali merupakan yang pertama menyadari penyusup.

Penempatan sangat penting. Kamera harus ditempatkan di titik masuk dan keluar (pintu masuk dan keluar). Sensor gerakan bekerja paling baik di area lalu lintas rendah seperti ruang server—menempatkannya di lorong ramai akan menyebabkan alarm palsu terus-menerus sehingga semua orang mengabaikannya. Petugas statis melindungi titik bernilai tinggi yang tetap, sementara petugas patroli lebih sulit direncanakan oleh penjahat. Meninjau durasi pintu terbuka dalam log masuk juga dapat mengungkap piggybacking, karena pintu yang dibiarkan terbuka terlalu lama mencurigakan.

Watch lesson · ⁨Tonton pelajaran⁩

2.4

Exam tips · ⁨Tips ujian⁩

English

Memorise the CIA triad and be ready to say which goal a control protects - encryption serves confidentiality, a hash checks integrity, a backup restores availability.
Know the four risk responses (avoid, transfer, mitigate, accept) and the two ways to classify controls (by type: physical/technical/managerial; by function: preventative/detective/corrective).
Distinguish piggybacking (with consent, tricked) from tailgating (without the person's knowledge) - exam questions test this exact pair.
For risk-rating questions, high risk needs both high value AND easy exploitation; a "foothold to other systems" is the classic moderate risk.
Defense in depth is the model answer whenever a question asks why one control is not enough.

Bahasa Indonesia

Hafalkan triad CIA dan siap menjelaskan tujuan mana yang dilindungi oleh suatu kontrol—enkripsi melayani kerahasiaan, hash memeriksa integritas, dan backup mengembalikan ketersediaan.
Pahami empat respons risiko (hindari, alihkan, kurangi, terima) dan dua cara untuk klasifikasikan kontrol (berdasarkan jenis: fisik/teknis/manajerial; berdasarkan fungsi: preventif/deteksi/korektif).
Bedakan piggybacking (dengan persetujuan, ditipu) dari tailgating (tanpa pengetahuan orang tersebut)—soal ujian menguji pasangan ini secara spesifik.
Untuk soal penilaian risiko, risiko tinggi membutuhkan nilai tinggi DAN eksploitasi mudah; "titik awal menuju sistem lain" adalah contoh klasik risiko sedang.
Pertahanan berlapis adalah jawaban standar setiap kali pertanyaan menanyakan mengapa satu kontrol tidak cukup.