Chapter 17: Securing Information Systems Flashcards
Security
Refers to the policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems
Controls
Specific method of ensuring security. Think of as gates in order to enter system. (passwords)
Methods, policies, and organizational procedures that ensure the safety of the organization’s assets; the accuracy and reliability of its records; and operational adherence to management standards
Worms
Independent computer programs that copy themselves from one computer to other computers over a network
Trojan Horse
A software program that appears to be benign but then does something other than expected. The Trojan horse is not itself a virus because it does not replicate, but it is often away for viruses or other malicious code to be introduced into your computer system
SQL Injection Attacks
The largest malware threat. SQL injection attacks take advantage of vulnerabilities in poorly coded Web application software to introduce malicious program code into a company’s systems and networks
Spyware
These small programs install themselves surreptitiously on computers to monitor user Web surfing activity and serve up advertising
Keyloggers
Record every keystroke made on a computer to steal serial numbers for software, to launch Internet attacks, to gain access to email accounts, to obtain passwords to protected computer systems, or to pick up personal information such as credit cards
Hacker
A individual who intends to gain unauthorized access to a computer system
Cybervandalism
The intentional disruption, defacement, or even deactivation of a Web site or corporate information system
Spoofing
Involves redirecting a Web link to an address different from the intended one, with the site masquerading as the intended destination
Sniffer
A type of eavesdropping program that monitors information traveling over a network
Denial-of-service (DoS) Attack
Hackers flood a network server or Web server with many thousands of false communications or requests for service to crash the network
Distributed Denial-of-Service (DoSS)
Uses numerous computers to inundate an overwhelm the network from numerous launch points
Botnet
Perpetrators of DoS attacks often use thousands of “zombie” PCs infected with malicious software without their owner’s knowledge and organized into a botnet
Computer Crime
Any violation of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution
Identity Theft
A crime in which an impostor obtains key pieces of personal information, such as social security identification numbers, driver’s license numbers, or credit card numbers, to impersonate someone else
Phishing
Involves setting up fake Web sites or sending emails or text messages that look like those of legitimate businesses to ask users for confidential personal information
Evil Twins
Wireless networks that pretend to offer trustworthy Wifi connections to the Internet, such as those in airier lounges, hotels, or coffee shops
Pharming
Redirects users to a bogus web page, even when the individual types the correct web page address into his or her browser
Click Fraud
Occurs when an individual or computer program fraudulently clicks on an online ad without any intention of learning more about the advertiser or making a purchase
Social Engineering
Malicious intruders seeking system access sometimes trick employees into revealing their passwords by pretending to be legitimate members of the company in need of information
Bugs
Program code defects
