chapter-19 Flashcards
What three types of security are essential to the AirForce mission? (457)
I) Information Assurance (IA); 2) installation security; and3) Antiterrorism (AT).
Who must protect information and information systemsand adhere to all information assurance and relatedsecurity policies and procedures? (457)
Personnel at all levels.
Information __ refers to the measures that protect,defend and ensure the availability, integrity, confidentiality,authentication and nonrepudiation of informationand information systems. (457)
Assurance.
What do Information Assurance’s (IA) protection,detection and reaction capabilities provide? (457)
Restoration of information and information systems.
Why is Information Assurance (IA) policy based onfact-based operational risk assessments? (457)
Because total risk avoidance is often not practical - risk assessmentand management are required instead.
Name the three core Information Assurance (IA)security disciplines. (457)
Communications Security (COMSEC), Computer Security(COMPUSEC) and Emissions Security (EMSEC).
The information assurance discipline __ ensuresthe confidentiality, integrity and availability of informationsystems assets, including hardware, software,firmware and information being processed, stored andcommunicated. (457)
Computer Security (COMPUSEC).
A(n) __ system is any telecommunications and/orcomputer-related equipment or interconnected system orsubsystems of equipment used in the acquisition, storage,manipulation, management, movement, control, display,switching interchange, transmission or reception of voices and/or data. (457)
Information. (This includes software, firmware and hardware.)
A Computer Security (COMPUSEC) __ is anyaction, device, procedure, technique or other measurethat reduces an information system’s vulnerability to anacceptable or manageable level. (457)
Countermeasure.
What enemy activities pose the greatest threats tocommunications and information systems? (457-458)
Information Operations (IO) and Information Warfare (IW)activities.
Information Operations (10) and Information Warfare(IW) attacks include introduction of malicious codes,trapdoors or viruses. What could result from these activities?(458)
1) Loss of information and information system confidentiality,integrity and availability; 2) disclosure of classified orsensitive information; 3) altered or deleted mission-essentialdata; and 4) destruction of communications and informationsystems.
Viruses, worms, Trojan horses and Botnets are examplesof __ logic. (458)
Malicious logic.
How does the Air Force protect information systemsfrom malicious logic attacks? (458)
Through preventive measures, including I) user awarenesstraining; 2) local policies; 3) configuration management; and4) antivirus software.
Prevent malicious logic by using antivirus softwareon all information systems. Name four other minimumsecurity measures. (458)
Any four of the following: I) Scan all incoming or downloadedelectronic traffic and files for viruses; 2) scan removableand fixed media prior to use; 3) report all virus attacks;4) preserve evidence of malicious incidents for ongoing investigations;5) use government-owned computer systems forofficial use only; and 6) do not surf unapproved websites ongovernment-owned computer systems.
Describe the minimum security requirements fordesktops and workstations used by one person at a time.(458)
1) Ensure each user’s access is based on security clearanceand need to know; 2) prevent unauthorized casual viewing ofinformation; and 3) protect against tampering, theft and loss.
Strong, two-factor, authentication for accessing systemsand networks combines a Common Access Card(CAC) with a(n) __ . (458)
PIN.
A Common Access Card (CAC) is a DoD identificationcard with an integrated circuit chip that holds what?(458)
Public Key Infrastructure (PKI) certificates and keys.
When may passwords be used in lieu of a CommonAccess Card (CAC)? (458)
When support for CAC or other strong, two-factor authenticationis unavailable.
Where should you place devices that display or outputclassified and sensitive information? (458)
In locations that deter unauthorized casual viewing.
Use a secure ____ and screen-lock to secureany unattended workstation. (458)
Screen saver. (Otherwise, log off completely.)
When using a Common Access Card (CAC), removeit if the workstation is unattended. T/F (458)
True
How can you protect information systems from tampering,theft and loss? (458)
1) Control physical access to facilities, information systemsand data; 2) use the Common Access Card (CAC) removallock feature, keyboard locks, secure screen savers, and addonsecurity software; and 3) control removal and secure storageof information on unattended systems.
Compact discs are an example of removable media.Provide two additional examples. (458)
1) USB drives; and 2) external storage drives.
How should you safeguard, mark and label removablemedia? (458)
Using the requirements for the highest level of information itever stored.