6 - The Principals Of Infomation Security

Question 1

6.1

What are Legal requirement and prevention?

Answer 1

This is information that is private of an individual and whoever they intend to know this information

Legal requirement under the DPA

Physical and logical security

Question 2

6.1

requirement and prevention linking to information integrity

Answer 2

Information is maintained, so that it is up to date, accurate, complete and fit for purpose

Legal requirement under the DPA

Can be avoided by periodically checking data

Question 3

6.1

what is Legal requirement and prevention linking to availability

Answer 3

Information is always available to and to use by the individuals, groups or processes that need to use it

Not under the DPA

Making sure information, hardware and software systems are working correctly to stop workers from being compelled to create copies

Question 4

6.2
Risk
what is the definition, reason and impact of Unauthorised or unintended access to data?

Answer 4

Any time data is see or used by someone who should not see or use it.

Espionage : gaining an advantage over original holder

Possible infringement of DPA, competitor advantage, reputation

Question 5

6.2
Risk
what is the definition, reason and impact of Accidental loss of data?

Answer 5

The loss of data itself, rather than a copy or version

Human or equipment error

Breaching the DPA, liable to prosecution, reputation

Question 6

6.2
Risk
what is the definition, reason and impact of Intentional destruction of data?

Answer 6

Being motivated by a desire to harm the organisation that holds the data

Viruses can delete or encrypt the data

Breached the DPA, cost and reputation

Question 7

6.2
Risk
what is the definition, reason and impact of Intentional tampering with data?

Answer 7

Data is changed in some way but is still available

Change personal information or competitors information

Decisions based on the data will be flawed and reputation

Question 8

6.3
Impact
what is the definition and impact of a loss of intellectual property?

Answer 8

Anything that has been created by an individual

Depends on the nature of the item taken, copied or accessed

Question 9

6.3
Impact
what is the definition and impact of loss of service and access?

Answer 9

Not being able to access a service

Hackers could you use the services purchased

Question 10

6.3
Impact
what is the definition and impact of failure and security of confidential information?

Answer 10

Not secured data could potentially be accessible to all

Data can be modified and stolen

Question 11

6.3
Impact
what is the definition and impact of loss of information belonging to a third party?

Answer 11

And attack on a business server is not only impact the business, but also on any businesses or individuals that holds data for

Question 12

6.3
Impact
what is the definition and impact of loss of reputation

Answer 12

If an organisation fails to keep data safe, they have failed to meet their legal and moral obligations

Question 13

6.3
Impact
what is the definition and impact of threat to national security

Answer 13

A direct physical threat to the country, as well as a threat to the financial security of the state

Question 14

6.5

what are locks and biometrics

Answer 14

Locks are a physical mechanism used to fasten shut or close a door, window, container etc

Biometric security devices measure unique characteristics of a person, such as voice pattern, fingerprint patterns etc.

Question 15

6.5

Impacts of not Placing computers above known flood levels

Answer 15

Data can be lost through a natural disaster like a flood. Pitting machines in areas that are known to be away from damage areas

Question 16

6.5

disadvantages of Backup systems in other locations

Answer 16

Do not protect from theft or loss, but it limits the effect if the data is stolen or lost. Any data not backup before the next backup will be lost.

Question 17

6.5

what does Security Staff do

Answer 17

They are physical barriers between anyone and the protected information. They can stop and report any unauthorised attempts to gain access to the data

Question 18

6.5

what is Shredding Old Paper

Answer 18

This is physically destroying the information so know one ever can gain access to it gain. It is a way to ensure that the information does not get into the wrong hands.

Question 19

6.6

what is Tiered Levels of Access to Data

Answer 19

This is the application is the staff access rights policy and is the process of making certain information only accessible to certain staff

Question 20

6.6

what are Firewalls

Answer 20

This is a form of network security that monitors data traffic into and out of a network.

Question 21

6.6

Anti-Malware Applications

Answer 21

This is any software that protects a computer from malware

Question 22

6.6

Obfuscation

Answer 22

This is purposely making something unintelligible so that it cannot be understood

Question 23

6.6

Encryption of Data at Rest

Answer 23

Making information only understandable to the intended recipient to data that is stored on digital media while it is not being transferred between devices.

Question 24

6.6

Encryption of Data in Transit

Answer 24

Making information only understandable to the intended recipient to data that is being sent between two users.

Question 25

6.6

Password Protection

Answer 25

This is a word/phrase they is personal to the user that only the user can use. They use this to get access to private information on a computer or server

Question 26

6.2

What are the 4 risk factors?

Answer 26

1. Unauthorised or unintended access to data
2. Accidental loss of data
3. Intentional destruction of data
4. Intentional tampering with data

Question 27

6.3

What are the 6 impact factors?

Answer 27

1. Loss of intellectual property
2. Loss of service and access
3. Failure in security of confidential information
4. Loss of information belonging to a third party
5. Loss of reputation
6. Threat to national security

Question 28

6.5

What are the 5 physical protection methods?

Answer 28

1. Locks and biometrics
2. Placing computers above known flood levels
3. Backup systems in other locations
4. Security staff
5. Shredding old papers based records

Question 29

6.5

What are the 7 logical protection methods?

Answer 29

1. Tiered levels of access to data
2. Firewalls
3. Anti-malware applications
4. Obfuscation
5. Encryption of data at rest
6. Encryption of data in transit
7. Password protection