The transmitted packets are encrypted with a secret key and an
Integrity Check (IC) field comprised of a CRC-32 check sum that is
attached to the message. WEP uses the RC4 variable key-size
stream cipher encryption algorithm. RC4 was developed in 1987 by
Ron Rivest and operates in output feedback mode. Researchers at
the University of California at Berkely ([email protected])
have found that the security of the WEP algorithm can be
compromised, particularly with the following attacks:
Passive attacks to decrypt traffic based on statistical analysis
Active attack to inject new traffic from unauthorized mobile
stations, based on known plaintext
Active attacks to decrypt traffic, based on tricking the access
point
Dictionary-building attack that, after analysis of about a day's
worth of traffic, allows real-time automated decryption of all
traffic
The Berkeley researchers have found that these attacks are
effective against both the 40-bit and the so-called 128-bit versions of
WEP using inexpensive off-the-shelf equipment. These attacks can
also be used against networks that use the 802.11b Standard, which
is the extension to 802.11 to support higher data rates, but does not
change the WEP algorithm.
The weaknesses in WEP and 802.11 are being addressed by the
IEEE 802.11i Working Group. WEP will be upgraded to WEP2 with
the following proposed changes:
Modifying the method of creating the initialization vector (IV)
Modifying the method of creating the encryption key
Protection against replays
Protection against IV collision attacks
Protection against forged packets
In the longer term, it is expected that the Advanced Encryption
Standard (AES) will replace the RC4 encryption algorithm currently
used in WEP.

The top barrier for companies to adopt cloud technology is security. Cloud technology is a technology that enables the delivery or consumption of computing resources or services over the internet, such as servers, storage, databases, networks, applications, or analytics. Cloud technology can offer many benefits to companies, such as cost reduction, scalability, flexibility, or efficiency. However, cloud technology also poses many challenges or risks to companies, such as security, compliance, performance, or reliability. Security is the top barrier for companies to adopt cloud technology, as it is the most critical and complex issue that companies face when moving to or using the cloud. Security is the barrier that prevents or hinders the companies from adopting cloud technology, as it involves the protection of the data, the systems, and the users from unauthorized or malicious access, modification, or disruption, and the compliance with the legal, regulatory, or contractual obligations. Security is the barrier that requires or demands the most attention, effort, or resources from the companies when adopting cloud technology, as it involves the assessment, evaluation, or verification of the security posture, capabilities, or controls of the cloud provider, the cloud service, and the cloud customer, and the implementation, management, or monitoring of the security policies, procedures, or measures for the cloud environment. Migration period, data integrity, or cost are not the top barriers for companies to adopt cloud technology, as they are not the most critical or complex issues that companies face when moving to or using the cloud. Migration period is the time or the duration that it takes for the companies to transfer or migrate their data, systems, or applications from their on-premises or legacy environment to the cloud environment. Data integrity is the quality or the condition of the data that ensures that the data is accurate, complete, or consistent, and that the data is not corrupted, altered, or lost. Cost is the amount or the value of the money or the resources that the companies spend or invest in adopting or using the cloud technology. Migration period, data integrity, or cost are important or relevant issues that companies face when adopting cloud technology, but they are not the top barriers, as they are not the most critical or complex issues, and they can be addressed or resolved by using proper planning, testing, or optimization techniques or methods. References: Official (ISC)2 Guide to the CISSP CBK, Fifth Edition, Chapter 4: Communication and Network Security, page 287.

Controls are the countermeasures for vulnerabilities. There are many kinds, but generally they are categorized into four types: Deterrent controls reduce the likelihood of a deliberate attack. Preventative controls protect vulnerabilities and make an attack unsuccessful or reduce its impact. Preventative controls inhibit attempts to violate security policy. Corrective controls reduce the effect of an attack. Detective controls discover attacks and trigger preventative or corrective controls. Detective controls warn of violations or attempted violations of security policy and include such controls as audit trails, intrusion detection methods, and checksums. Source: Introduction to Risk Analysis, "Corrective controls reduce the effect of an attack" & "Detective controls discover attacks and trigger preventative or corrective controls" Security Risk Analysis Group and NIST Special Publication 800-30, Risk Management Guide for Information Technology Systems.

The primary benefits of employing an incident-handling capability
are containing and repairing damage from incidents and preventing
future damagE. Additional benefits related to establishing an incidenthandling capability are:
Enhancement of the risk assessment process. An incidenthandling
capability will allow organizations to collect threat
data that may be useful in their risk assessment and safeguard
selection processes (e.g., in designing new systems). Statistics
on the numbers and types of incidents in the organization can
be used in the risk-assessment process as an indication of
vulnerabilities and threats.
Enhancement of internal communications and the readiness of
the organization to respond to any type of incident, not just
computer security incidents. Internal communications will be
improved, management will be better organized to receive
communications, and contacts within public affairs, legal staff,
law enforcement, and other groups will have been preestablished.
Security training personnel will have a better understanding of
users knowledge of security issues. Trainers can use actual
incidents to vividly illustrate the importance of computer
security. Training that is based on current threats and controls
recommended by incident-handling staff provides users with
information more specifically directed to their current needs,
thereby reducing the risks to the organization from incidents.
*Answer "An individual acting alone would not be able to subvert a security process or control" is a benefit of employing separation of duties controls.
Source: National Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook Special Publication 800-12.