Chapter 1 Key Concepts and Terms Flashcards
3 tenets of information systems security
Confidentiality, integrity, and availability.
AUP (Acceptable Use Policy)
what users are allowed and not allowed to do with organization
availability
a mathematical calculation where A=(Total Uptime)/(Total Uptime+Total Downtime)
availability
Security actions that ensure that data is accessible to authorized users.
BCP
Business Continuity Plan- gives priorities to the functions an organization needs to keep going.
CIPA (Children’s Internet Protection Act)
protects minors from inappropriate content when accessing the internet in schools and libraries
Confidentiality
the act of holding information in confidence, not to be released to unauthorized individuals
Cryptography
Practice of hiding data and keeping it away from unauthorized users
Cybersecurity
The act of securing and protecting individuals, businesses, organizations, and governments that are connected to the Internet and the Web.
Data classification standard
The goal and objective of a __________ is to provide a consistent definition for how an organization should handle and secure different types of data.
Downtime
the total amount of time the IT system, application and data are not accessible.
DRP
Disaster Recovery Plan- how a business gets back on its feet after a major disaster such as a fire or hurricane.
Encryption
the process of transforming data from clear text into ciphertext.
End User License Agreement (EULA)
A legal contract between the author of software and the end user that defines how the software can be used
Ethernet LAN
LAN solution based on the IEEE 802.3 CSMA/CD standard for 10/100/1000mbps.
FERPA (Family Educational Rights and Privacy Act)
Passed in 1974, protects the private data of students and their school records.
FISMA (Federal Information Security Management Act)
requires federal civilian agencies to provide security controls over resources that support federal operations.
GLBA (Gramm-Leach-Bliley Act)
Federal law enacted in 1999 to control the ways that financial institutions deal with the private information of individuals
HIPAA (Health Insurance Portability and Accountability Act)
Federal law passed in 1996, requires health care organizations to have security and privacy controls implemented to ensure patient privacy.
Hypertext Transfer Protocol Secure (HTTPS)
an encrypted form of information transfer on the Internet that combines HTTP and TLS
information system security
is the collection of activities that protect the information system and the data stored in it.
integrity
deals with the validity and accuracy of data.
IoT
Internet of Things
IT security policy framework
A set of rules for security. The framework is hierarchical and includes policies, standards, procedures, and guidelines.
LAN Domain (Local area network)
is a collection of computers connected to one another or to a common connection medium.
LAN switch
the device that connects workstations into a physical Ethernet LAN
malicious code (malware)
is a computer program written to cause a specific action to occur, such as erasing a hard drive.
Mean Time Between Failures (MTBF)
is the predicted amount of time between failures of an IT system during operations.
Mean time to failure (MTTF)
The average amount of time expected until the first failure of a piece of equipment.
Mean Time to Repair (MTTR)
The average amount of time a computer repair technician needs to resolve the cause of a failure through replacement or repair of a faulty unit.
Network Interface Card (NIC)
the interface between the computer and the LAN physical media.
PDA (Personal Digital Assistant)
A portable device that is small enough to hold in the palm of your hand. Usually contains an address book, note making features, telephone and Internet facilities. Allows data to be exchanged with computers
Recovery Time Objective (RTO)
is the amount of time it takes to recover and make a system, application, and data available for use after an outage.
risk
the likelihood that something bad will happen to ana asset.
Service Level Agreement (SLA)
formal contract between customers and their service providers that defines the specific responsibilities of the service provider and the level of service expected by the customer
Seven Domains of a Typical IT Infrastructure
User, workstation,
SOX (Sarbanes-Oxley Act)
Requires companies to review internal control and take responsibility for the accuracy and completeness of their financial reports.
system administrator
setup of user LAN accounts with logon ID and password access controls (that is, user logon information.
TCP/IP
Transmission Control Protocol/Internet Protocol
thin client
is a software or a actual computer with no hard drive that runs on a network and relies on a server to provide applications.
threat
Any action that could damage an asset
unauthorized access
the use of a computer or network without permission
unified communications
The centralized management of multiple types of network-based communications, such as voice, video, fax, and messaging services.
unsheilded twisted pair (UTP)
workstation cabling that uses RJ-45 connectors and jacks to physically connect to a 100 mbps/1gbps/10gbps ethernet LAN switch.
Uptime
The total amount of time the IT system, application and data was accessible.
User Domain
Defines the people who access an organization’s information system
Virus
is a computer program written to cause damage to a system, an application, or data.
vulnerability
is a weakness that allows a threat to be realized or to have an effect on an asset.
WAP (Wireless Access Point)
A device that provides a connection between wireless devices and can connect to wired networks.
Workstation Domain
can be a desktop computer, a laptop computer, a specific-purpose terminal, or any other device that connects to your network.
WWW
World Wide Web
