Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Business Information Systems > 7 Securing Information Systems > Flashcards

7 Securing Information Systems Flashcards

1
Q

What are the different parts of the security triangle?

A
  1. Availability
  2. Integrity
  3. Confidentiality
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are some reasons why systems are vulnerable?

A
  • Accessibility of networks
  • Hardware problems (breakdowns, configuration errors, damage from improper use or crime)
  • Software problems (programming errors, installation errors, unauthorised changes)
  • Disasters
  • Use of networks/computers outside of firm’s control
  • Loss and theft of portable devices
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why is the internet vulnerable?

A
  • Network open to anyone
  • Size of Internet means abuses can have wide impact
  • Use of fixed Internet addresses with cable / DSL modems creates fixed targets for hackers
  • Unencrypted VOIP
    • Email, IM
    • Interception
    • Attachments with malicious software
    • Transmitting trade secrets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are some security threats?

A
  • Malware (malicious software).
  • Viruses.
  • Worms.
  • Mobile Device Malware
  • Social Network Malware.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who can be an internal threat?

A

Employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Why can employees be an internal threat?

A
  • Security threats often originate inside an organisation
  • Inside knowledge
  • Sloppy security procedures
  • User lack of knowledge
  • Social engineering
  • Both end users and information systems specialists are sources of risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Why can software be vulnerable?

A
  • Commercial software contains flaws that create security vulnerabilities
  • Patches
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are some other security threats?

A
  • Trojan Horse
  • Ransomware
  • Spyware
  • Identity Theft
  • Click Fraud
  • Cyberterrorism
  • Cyberwarfare
  • Spoofing
  • Denial-of-service attack
  • Rogue Security Software
  • Phishing Scams
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are some flaws in commercial software?

A
  • Bugs (programme code defects)
    • Zero defects cannot be achieved
    • Flaws can open networks to intruders
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are patches?

A
  • Small pieces of software to repair flaws

* Patch management

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the Business Value of Security and Control?

A
  • Failed computer systems can lead to significant or total loss of business function.
  • Firms now are more vulnerable than ever.
  • A security breach may cut into a firm’s market value almost immediately.
  • Inadequate security and controls also bring forth issues of liability.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why are firms now more vulnerable than ever?

A

Because of..
• Confidential personal and financial data.
• Trade secrets, new products, strategies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some Legal and Regulatory Requirements for Electronic Records Management?

A
  • HIPAA
  • Gramm-Leach-Bliley Act
  • Sarbanes-Oxley Act
  • GDPR (General Data Protection Regulation)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is HIPAA?

A

Medical security, privacy rules and procedures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the Gramm-Leach-Bliley Act?

A

Requires financial institutions to ensure the security and confidentiality of customer data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the Sarbanes-Oxley Act?

A

Imposes responsibility on companies and their management to safeguard the accuracy and integrity of financial information that is used internally and released externally.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Electronic Evidence?

A
  • Evidence for white collar crimes often in digital form.

* Proper control of data can save time and money when responding to legal discovery request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Computer Forensics?

A
  • Scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law.
  • Recovery of ambient data.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are some Information Systems Controls

A
  1. Physical Controls.
  2. Administrative Controls.
  3. Technical Controls.
20
Q

What are Physical Controls?

A
  • Who can access the building, data centre

* Fences around buildings, lock

21
Q

What are Administrative Controls?

A

Concerned with humans.
• Backup checks
• Policies
• Security awareness training

22
Q

What are Technical Controls?

A

Implementing the security policies.
• An access control list at a gateway or firewall
• Access controls inside a database

23
Q

What is Risk Assessment?

A
  • Determines level of risk to firm if specific activity or process is not properly controlled
    • Types of threat
    • Probability of occurrence during year
    • Potential losses, value of threat
    • Expected annual loss
24
Q

What is disaster recovery planning?

A

Devises plans for restoration of disrupted services.

25
Q

What is Business continuity planning?

A

Focuses on restoring business operations after disaster.

26
Q

Why is Disaster Recovery Planning and Business Continuity Planning needed?

A
  • Needed to identify firm’s most critical systems
    • Business impact analysis to determine impact of an outage
    • Management must determine which systems restored first
27
Q

What is information systems audit?

A

Examines firm’s overall security environment as well as controls governing individual information systems.

28
Q

What are security audits?

A
  • Review technologies, procedures, documentation, training, and personnel
  • May even simulate disaster to test responses
29
Q

What is the role of auditing?

A
  • List and rank control weaknesses and the probability of occurrence.
  • Assess financial and organisational impact of each threat.
  • To conduct information systems audit and security audits.
30
Q

What is authentication?

A

The ability to know that a person is who he or she claims to be.

31
Q

What does identity management software do?

A
  • Automates keeping track of all users and privileges.

* Authenticates users, protecting identities, controlling access.

32
Q

What are some forms of authentication?

A
  • Password systems
  • Tokens
  • Smart cards
  • Biometric authentication
  • Two-factor authentication
33
Q

What is a firewall?

A

A combination of hardware and software that controls the flow of incoming and outgoing network traffic and are used to prevent unauthorised users from accessing private networks.

34
Q

What are the two methods for encryption on networks?

A
  • Secure Sockets Layer (SSL) and successor Transport Layer Security (TLS)
  • Secure Hypertext Transfer Protocol (S-HTTP)
35
Q

What are the two methods of encryption of messages?

A
  • Symmetric key encryption.

- Public key encryption.

36
Q

What is symmetric key encryption?

A

Sender and receiver use single, shared key.

37
Q

What is public key encryption?

A
  • Uses two, mathematically related keys: public key and private key.
  • Sender encrypts message with recipient’s public key.
  • Recipient decrypts with private key.
38
Q

What are software metrics and some examples?

A 
Objective assessments of system in form of quantified measurements.
• Number of transactions
• Online response time
• Payroll checks printed per hour
• Known bugs per hundred lines of code
39
Q

How do we ensure software quality?

A
  • Software metrics
  • Early and regular testing
  • Walkthrough
  • Debugging
40
Q

How can you protect yourself?

A
  • Change your password every now and then.
  • Use words not found in the dictionary.
  • Use a combination of words, numbers and special symbols.
  • Use two-step authentication.
  • Nobody will ever ask you for your password.
41
Q

What is confidentiality (as a concept in network security)?

A

Only authorised individuals/systems can view sensitive or classified info.

42
Q

What is integrity (as a concept in network security)?

A

Only authorised individuals/systems are allowed to modify the data.

43
Q

What is availability (as a concept in network security).

A

Able to serve info when it is needed to authorised individuals/systems.

44
Q

What are Controls?

A

All of the methods, policies, and organisational procedures that ensure the safety of the organisation’s assets, the accuracy and reliability of its accounting records, and operational adherence to management standards

45
Q

What is a DDoS attack?

A

Using numerous computers to inundate and overwhelm the network from numerous launch points.

Business Information Systems (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions