Chapter 8 - Securing Information Systems

Question 1

Controls

Answer 1

Methods, policies, and organizational procedures that ensure the safety of the organization’s assets, the accuracy and reliability of its records, and operational adherence to management standards.

Question 2

Threats to Internet and other networks

Answer 2

Tapping, sniffing, message alteration, theft and fraud, radiation

Question 3

Threats to corporate servers

Answer 3

Hacking, malware, theft and fraud, vandalism, DoS attacks

Question 4

Threats to corporate systems

Answer 4

Theft of data, copying data, alteration of data, hardware failure, software failure.

Question 5

War driving

Answer 5

Eavesdroppers drive by buildings or parks outside and try to intercept wireless network traffic.

Question 6

Malware

Answer 6

Malicious software programs like viruses, worms, and Trojan horses

Question 7

Computer virus

Answer 7

Rogue software program that attaches itself to other software programs or data files to be execuuted, usually without user knowledge or permission

Question 8

Worms

Answer 8

Independent computer programs that copy themselves from one computer to other computers over a network. Can operate on their own.

Question 9

Drive-by downloads

Answer 9

Malware that comes with a downloaded file that a user intentionally or unintentionally requests.

Question 10

SQL injection attack

Answer 10

Exploit vulnerabilities in poorly coded web application software to introduce malicious program code into a company’s systems and networks. These vulnerabilities occur when a web application fails to validate properly or filter data a user enters on a web page.

Question 11

Ransomware

Answer 11

Attempts to extort money by taking control of computers, blocking access to files, or displaying annoying pop-up messages.

Question 12

Spyware

Answer 12

Monirot a user’s web-surfing activity and serve up advertising

Question 13

Keyloggers

Answer 13

Record every keystroke made on a computer to steal serial numbers for software, to launch Internet attacks, to gain access to email accounts, to obtain passwords to protect computer systems, or to pick up personal information.

Question 14

Spoofing

Answer 14

Hiding true identity with fake email addresses or web links

Question 15

Sniffer

Answer 15

Eavesdropping program that monitors information traveling over a network

Question 16

Evil twins

Answer 16

Wireless networks that pretend to offer trustworthy Wi-Fi connections

Question 17

Pharming

Answer 17

Redirects users to a bogus web page

Question 18

Click fraud

Answer 18

When an individual or computer program fraudulently clicks an online ad without any intention of learning more about the advertiser or making a purchase

Question 19

Zero-day vulnerabilities

Answer 19

Holes in software that are unknown to its creators

Question 20

Gramm-Leach Bliley Act

Answer 20

Also known as the US Financial Services Modernization Act of 1999. It requires financial institutions to ensure the security and confidentiality of customer data. Data must be stored on a secure medium, and special security measures must be enforced to protect such data on storage media and during transmittal.

Question 21

Sarbanes-Oxley Act

Answer 21

It imposes responsibility on companies and their management to safeguard the accuracy and integrity of financial information that is used internally and released externally.

Question 22

Computer forensics

Answer 22

The scientific collection, examination, authentication, preservation, and analysis of data held on or retrieved from computer storage media in such a way that the information can be used as evidence in a court of law.

Question 23

General Controls

Answer 23

Govern the design, security, and use of computer programs and the security of data files in general througout the organization’s information technology infrastructure.

Question 24

Application Controls

Answer 24

Specific controls unique to each computerized application, such as payroll or order processing. They can be classified as input controls, processing controlls, or output controls.

Question 25

Input Controls

Answer 25

Check data for accuracy and completeness when they enter the system.

Question 26

Processing controls

Answer 26

Establish that data are complete and accurate during updating.

Question 27

Output controls

Answer 27

Ensure that the results of computer processing are accurate, complete, and properly distributed.

Question 28

Risk Assessment

Answer 28

Determines the level of risk to the firm if a specfici activity or process is not properly controlled.

Question 29

Security Policy

Answer 29

Statements ranking risks, identifying acceptable security goals, and identifying the mechanisms for acheiving these goals.

Question 30

Acceptable Use Policy (AUP)

Answer 30

Defines acceptable uses of the firm's information resources and computing equipment.

Question 31

Information Systems Audit

Answer 31

Examines the firm's overall security environment as well as controls governing individual information systems. It lists and ranks all control weaknesses and estimates the probability of their occurrence. It then assesses the financial and organizsational impact of each threat.

Question 32

Token

Answer 32

A physical device, similar to an identification card, that is designed to prove the identity of a single user.

Question 33

Smart card

Answer 33

A device about the size of a credit card that contains a chip formatted with access permission and other data.

Question 34

Biometric Authentication

Answer 34

Uses systems that read and interpret individual human traits, such as fingerprints, irises, and voices to grant or deny access.

Question 35

Two-factor Authentication

Answer 35

Increases security by validating users through a multi-step process

Question 36

Firewalls

Answer 36

A combination of hardware and software that prevents unauthorizsed users from accessing private networks. It examines names, IP addresses, applications, and other characteristics of incoming traffic.

Question 37

Packet Filtering

Answer 37

Examines selected fields in the headers of data packets flowing back and forth between the trusted network and the Internet, examining individual packets in isolation.

Question 38

Intrusion Detection Systems

Answer 38

Feature full-time monitoring tools placed at the most vulnerable points or hot spots of corporate networks to detect and deter intruders continually.

Question 39

Unified Threat Management (UTM) Systems

Answer 39

Comprehensive security management products with various security tools, including firewalls, cirtual private networks, intrusion detection systems, web content filtering, and anti-spam software.

Question 40

Encryption

Answer 40

The process of transforming plain text or data into cipher text that cannot be read by anyone other than the sender and the intended receiver.

Question 41

Secure Sockets Layer (SSL)

Answer 41

Enable client and server computer to manage encryption and decryption activities as they communicate with each other during a secure web session.

Question 42

Secure Hypertext Transfer Protocol (S-HTTP)

Answer 42

Used for encrypting data flowing over the Internet, but it is limited to individual messages.

Question 43

Public Key Encryption

Answer 43

A more secure form of encruption that uses two keys, one shared (public) and another totally private.

Question 44

Digital Certificates

Answer 44

Data files used to establish the identity of users and electronic assets for protection of online transactions. They use a trusted third party, known as a certificate authority (CA), to validate a user's identity.

Question 45

Fault-tolerant computer systems

Answer 45

Contain redundant hardware, software, and power supply components that create an environment that provides continuous, uninterrupted service.

Question 46

Managed Security Service Provider (MSSPs)

Answer 46

Businesses that monitor network activity and perform vulnerability tewsting and intrustion detection. Many companies outsource them.

Question 47

Digital Resiliency

Answer 47

How to maintain and increase the resilience of an organization and its business processes in an all-pervasive digital environment.