Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IS 3413 > Chapter 10 - Test 3 > Flashcards

Chapter 10 - Test 3 Flashcards

1
Q

What is the first step in any security plan?

A
  • risk assessment

- understanding the key assets that need protection, and assessing the risks to each.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is network security focused on?

A

-preventing, detecting, and correcting security problems due to disruptions, destruction, disaster, and unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the primary goal of network security?

A

-protect organizations’ data and application software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the fiver primary goals of network security?

A
  • confidentiality
  • integrity
  • availability
  • non-repudiation
  • authentication
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Describe confidentiality.

A

-the protection of organizational data from unauthorized disclosure of customer and proprietary data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Describe Integrity.

A

-assurance that data have not been altered or destroyed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe availability.

A

-providing continuous opertion of the organization’s hardware and software so that staff, customers, and suppliers can be assured of no interruptions in service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Describe non-repudiation.

A

-a person can’t deny having performed an action.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Describe authentication.

A

-authenticate identity, give access to resources they only have access to, audit use of those resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What categories can security threats be classified as?

A
  • ensuring business continuity

- preventing unauthorized access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe business continuity.

A

-ensuring availability with some aspects of data integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Describe business continuity.

A

-ensuring availability with some aspects of data integrity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the three main threats to business continuity?

A
  • disruptions: loss of or reduction in network service.
  • destruction of data
  • intrusion: confidentiality and integrity.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Describe controls.

A

-software, hardware, rules, or procedures that reduce or eliminate the threats to network security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What do controls do?

A

-prevent, detect, and/or correct whatever might happen to the organization because of threats facing its computer-based systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What do controls do?

A

-prevent, detect, and/or correct whatever might happen to the organization because of threats facing its computer-based systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe preventive controls.

A
  • mitigate or stop a person from acting or an event from occuring.
  • examples are passwords, guard, or security lock
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe detective controls.

A
  • reveal or discover unwanted events.

- software that looks for illegal network entry

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Describe corrective controls.

A

-remedy an unwanted event or an intrusion.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Describe a risk assessment.

A

-assign levels of risk to various threats to network security by comparing the nature of the threats to the controls designed to reduce them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Describe a control spreadsheet.

A

-ensures that data communication networks and microcomputer workstations have the necessary controls and that these controls offer adequate protection. that are currently in the network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the first step in a risk assessment

A
  • identify assets.

- something of value and can be either hardware, software, data, or applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Describe mission-critical applications.

A
  • an information system that is critical to the survival of the organization.
  • cannot be permitted to fail, and if it does fail, the network staff drops everything else to fix it.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Describe threats.

A

-potential adverse occurence that can do harm, interrupt the systems using the network, or cause a monetary loss to the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Describe threats.

A

-potential adverse occurence that can do harm, interrupt the systems using the network, or cause a monetary loss to the organization.

26
Q

Describe controls.

A

-mitigate or stop a threat, or protect an asset.

27
Q

What is the last step in using a control spreadsheet?

A

-evaluate the adequacy of the existing controls and the resulting degree of risk associated with each threat.

28
Q

What is a Delphi team?

A

-team of experts between three to nine key people that review the plan.

29
Q

What are macro viruses?

A

-viruses contained in document, emails, or spreadshee files, can spread when an infected file is simply opened.

30
Q

What is a worm?

A

-special type of virus that spreads itself without human intervention.

31
Q

Describe DoS.

A
  • Denial of Service attach
  • attacker attempts to disrupt the network by flooding it with messages so that the network cannot process messages from normal users.
32
Q

Describe DDoS

A
  • distributed denial of service attack
  • attacker breaks into and takes control of many computers on the internet and plants DDos agent.
  • attacker uses DDoS handler to control the agents.
33
Q

What are ways to prevent DoS and DDoS

A
  • traffic filtering: verify that source address of all incoming messages is in a valid address range for that connection.
  • traffic limiting: limit number of incoming packets that could be DoS/DDoS attack packets that it allows to enter the network.
  • traffic anomaly detector: installed in front of the main router or firewall to perform traffic analysis.
34
Q

How do traffic anomaly detectors work?

A
  • monitors normal traffic patterns and learns what normal traffic looks like.
  • when it recognizes a sudden burst of abnormally high traffic destined for a specific server or device, it quarantines those incoming packets but allows normal traffic to flow through the network.
35
Q

How do traffic anomaly detectors work?

A
  • monitors normal traffic patterns and learns what normal traffic looks like.
  • when it recognizes a sudden burst of abnormally high traffic destined for a specific server or device, it quarantines those incoming packets but allows normal traffic to flow through the network.
36
Q

What are six types of attacks?

A
  • ICMP attacks
  • UDP attacks
  • TCP SYN Floods
  • Unix process table attacks
  • Finger of death attacks
  • DNS Recursion attacks.
37
Q

Describe physical security.

A
  • key component of theft protection.

- visitors be authorized by an organization employee.

38
Q

What is redundancy?

A
  • best way to prevent a failure from impacting business continuity.
  • for any network component that would have a major impact on business continuity, network designer provides a second, redundant component.
39
Q

What are fault-tolerant servers?

A

-contain many redundant components so that if one of its components fails, it will continue to operate.

40
Q

Describe RAID.

A
  • Redundant array of independent disks
  • made of many disk drives, when a file is written to a RAID device it is written across several separate, redundant disks.
41
Q

Describe RAID 0.

A

-uses multiple drives and is faster than traditional storage.

42
Q

Describe RAID 1.

A
  • writes duplicate copies of all data on at least two different disks.
  • also called disk mirroring.
43
Q

Describe RAID 2.

A

-provides error checking to ensure no errors have occurred during the reading or writing process.

44
Q

Describe RAID 3.

A

provides better and faster error checking process than RAID 2.

45
Q

Describe RAID 4.

A

-provides slightly faster read access than RAID 3 because of the way it allocates the data to different disk drives.

46
Q

Describe RAID 5.

A

-provides slightly faster read and write access because of the way it allocates the error checking data to different disk drives.

47
Q

Describe RAID 6,

A

can survive the faiure of two drives with no data loss.

48
Q

Describe RAID 6,

A

can survive the faiure of two drives with no data loss.

49
Q

What is a disaster recovery plan?

A

-should address various levels of response to a number of possible disasters and should provide for partial or complete recovery of all data, application software, network components and physical facilities.

50
Q

Describe coninuous data protection.

A

-copies of all data and transactions on slected servers are written to CDP servers as the transaction occurs.

51
Q

What are the four types of intruders?

A
  • script kiddies
  • hackers/crackers:experts in security, motivation is the thrill of the hunt
  • professional hackers: break into corporate or government computers for specific purposes.
  • organization employees who have legitimate access to the network, but who gain access to information they are not authorized to use.
52
Q

What are the four types of intruders?

A
  • script kiddies
  • hackers/crackers:experts in security, motivation is the thrill of the hunt
  • professional hackers: break into corporate or government computers for specific purposes.
  • organization employees who have legitimate access to the network, but who gain access to information they are not authorized to use.
53
Q

What is a a security policy.

A

-critical to controlling risk due to intrusion.

54
Q

What is a firewall.

A
  • commonly used to secure an organization’s internet connection.
  • router or special-purpose device that examines packets flowing into and out of a network and restricts access to the organization’s network.
55
Q

What are three types of firewalls?

A
  • packet-level
  • application-level
  • NAT
56
Q

Describe packet-level firewalls.

A
  • examine source and destination address of every network packet that passes through it
  • only allows packets that have acceptable source and destination addresses.
  • only examined at transport and network layer.
  • does not monitor the contents or why they are being transmitted and does not log packets for later analysis.
57
Q

What is an ACL?

A
  • access control list
  • set of rules for the packet level firewall so it knows what packets to permit into the network and what packets to deny entry.
58
Q

What is IP spoofing?

A

-can change the source IP address on the packets they send.

59
Q

Describe an application-level firewall.

A
  • examines contents of the application layer packet and searches for known attacks.
  • rules for each application.
  • can use stateful inspection: monitor and record the status of each connection and can use this information in making decisions.
  • often prohibit external users from uploading executable files.
60
Q

Describe NAT firewalls.

A
  • converting between one set of public IP address to a second set of private IP addresses.
  • uses address table to translate private IP addresss into proxy IP addresses. Sets source port number to a unique number that it uses as an index into its address table to find the IP address of the actual sending commputer.

IS 3413 (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions