Chapter 2

Question 1

Organization Security

Answer 1

Without data, loses its record of transactions and /or ability to deliver value to customers.

Question 2

What is a threat?

Answer 2

An object, person, or other entity that represents a constant danger to an asset.
64% of organizations had malware infections
14% indicated system penetration by an outsider.

Question 3

What is information extortion? Describe how such an attack can cause loses?

Answer 3

Cyberextortion its an attack with a demand for money to stop the attack.

Question 4

Cracker? Phreaker?

Answer 4

Cracker - cracks or removes software protection designed to prevent unauthorized duplication.

Phreaker - hacks the public telephone network.

Question 5

Forces of Nature?

Answer 5

Disrupts storage, transmission, and use of information. Organizations must implement controls to limit damage and prepare contingency plans for continued operation.

Question 6

Human Error or Failure?

Answer 6

Inexperience
Improper training
Incorrect assumptions

Question 7

What happens because of employee mistakes?

Answer 7

Revelation of classified data, entry of erroneous data, accidental deletion or modification of data, storage of data in unprotected areas.

Question 8

Information Extortion?

Answer 8

Steals information and asks for money, for its return or nondisclosure.
Credit cards.

Question 9

Missing, Inadequate, or Incomplete

Answer 9

It can make organization vulnerable to loss, damage, or disclosure of information assets.

Question 10

Sabotage or Vandalism

Answer 10

Cyberterrorism

Question 11

Theft?

Answer 11

Illegal taking of another’s physical, electronic, or intellectual property.
Physical theft is controlled relatively easily.

Question 12

Technical Hardware failures or error?

Answer 12

Distribution of flawed equipment.

Question 13

Software failures?

Answer 13

Hidden faults

Question 14

What is an attack?

Answer 14

Acts that exploits vulnerability.

Done by threat agent that damages or steals organization’s information.

Question 15

Types of attacks?

Answer 15

Malicious code
Hoaxes
Back door
Password crack
Brute force
Dictionary
Denial of Service (DoS)
Distributed Denial of Service
(DDoS)
Spoofing
Man-in-the-middle.
Spam
Mail Bombing

Question 16

What is malicious code?

Answer 16

Malicious code: viruses, worms, horses, web scripts, with intent to destroy or steal information.

Question 17

What is hoaxes?

Answer 17

Hoaxes: transmission of a virus hoax with a real virus attached.

Question 18

What is back door?

Answer 18

Backdoor: gaining access to system.

Question 19

What password crack?

Answer 19

Password crack: attempting to reverse calculate a password.

Question 20

What is brute force?

Answer 20

Trying every possible combination of options of a password.

Question 21

What is dictionary?

Answer 21

Selects specific accounts to attack and uses commonly used passwords.

Question 22

What is DoS?

Answer 22

Denial of Service:

large number of information requests to a target.

Question 23

What is DDoS?

Answer 23

Distributed Denial of Service:

coordinated stream of requests is launched against target from many locations.

Question 24

What is spoofing?

Answer 24

Intruder assumes a trusted IP address.

Question 25

What is man-in-the-middle?

Answer 25

Attacker monitors packets, modifies them, and inserts them back into network.

Question 26

What is spam?

Answer 26

commercial e-mail.

Question 27

What is mail bombing?

Answer 27

DoS, large quantities of e-mail to target.

Question 28

Types of Attacks? (2)

Answer 28

Sniffers
Phishing
Pharming
Social Engineering
Timing attack.

Question 29

What are sniffers?

Answer 29

software that monitors data travelling over network.

Question 30

What is phishing?

Answer 30

A try to get personal information from an individual, posing as legitimate entity.

Question 31

What is pharming?

Answer 31

Redirection of legitimate web traffic to illegimate site.

Question 32

What is social engineering?

Answer 32

Using social skills to convince people to reveal access credentials or other valuable information to attacker.

Question 33

What is timing attack?

Answer 33

Exploring the contents of a web browser cache to create a malicious cookie.

Question 34

Why does polymorphism cause greater concern than traditional malware? How does it affect detection?

Answer 34

Polymorphic malware polymorphs, changes overtime, therefore it is harder to detect.