AP Cybersecurity Unit 2 Cheatsheet: Securing Spaces

Psychological manipulation to trick targets into desired actions:

• Pretexting: Create believable reason to contact target
• Authority: Impersonate someone with power or relay their instructions
• Intimidation: State negative consequences if demands aren't met
• Consensus: Create social pressure ("everyone else is doing it")
• Scarcity: Create sense of limited availability
• Familiarity: Pretend to know someone close to target
• Urgency: Create deadline requiring quick action to avoid harm

Three factors determine likelihood:

• Target value (adversaries target high-value assets)
• Exploit difficulty (well-documented exploits = more adversaries can execute)
• Adversary motivation & capabilities

Severity measured by: Financial cost, reputational impact, operational disruption

Assessment types:

• Quantitative: Numeric scale (1–10) or financial ($10K risk)
• Qualitative: Low/medium/high/severe

Documentation must include: Assets & value, threats, vulnerabilities, exploitation details, damage severity, likelihood, final rating

Residual risk = risk remaining after avoidance, transference, mitigation. Organizations favor cost-effective solutions where implementation cost < expected loss.