Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

MGCR 331 > chapter 4 > Flashcards

chapter 4 Flashcards

1
Q

def. information security

A

Protecting an organization’s information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

def. threat

A

Any danger to which an information resource may be exposed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

def. vulnerability

A

The possibility that an information resource will be harmed by a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the five key factors contributing to the increasing vulnerability of organizational information sources?

A
  1. Today’s interconnected, interdependent, wirelessly networked business environment.
  2. Smaller, faster, cheaper computers and storage devices.
  3. Decreasing skills necessary to be a computer hacker.
  4. International organized crime taking over cybercrime.
  5. Lack of management support.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

def. trusted network

A

any network within your organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

def. untrusted network

A

any network external to your organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

wireless is an inherently ____________ broadcast communications medium

A

nonsecure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

def. cybercrime

A

Illegal activities executed on the Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what are the to major categories of threats?

A

unintentional threats

deliberate threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what is a major category of unintentional threats?

A

human error

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are two important points about employees regarding threats?

A
  1. the higher the level of employee, the greater the threat he or she poses to information security
    - - higher level employees typically have greater access to corporate data, and they enjoy greater privileges on organizational information systems
  2. employees in two areas of the organization pose especially significant threats to information security: human resources and information systems (IS)
    - -HR employees have access to sensitive personal information, IS employees not only have access to sensitive organizational data but also often control the means to create, store, transmit, and modify those data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

who tends to be overlooked when considering threats

A

janitors and guards

as well as contract labour and consultants

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what are human errors they result of?

A

typically the result of laziness, carelessness, or a lack of awareness concerning information security. This lack of awareness arises from poor education and training efforts by the organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

def. social engineering

A

Getting around security systems by tricking computer users inside a company into revealing sensitive information or gaining unauthorized access privileges

-most common example is attacker impersonating someone else on the telephone, or impersonating other individuals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

two other social engineering techniques

A

Tailgating: a technique designed to allow the perpetrator to enter restricted areas that are controlled with locks or card entry. The perpetrator follows closely behind a legitimate employee and, when the employee gains entry, the attacker asks him or her to “hold the door.”

Shoulder surfing: occurs when a perpetrator watches an employee’s computer screen over the employee’s shoulder. This technique is particularly successful in public areas such as in airports and on commuter trains and airplanes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

def. espionage or trespass

A

occurs when an unauthorized individual attempts to gain illegal access to organizational information
-industrial espionage crosses the legal boundary such as theft of confidential data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

def. information extortion

A

occurs when an attacker either threatens to steal or actually steals information from a company. The perpetrator demands payment for not stealing the information, for returning stolen information, or for agreeing not to disclose the information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

def. sabotage or vandalism

A

deliberate acts that involve defacing an organization’s website, potentially damaging the organization’s image and causing its customers to lose faith in the organization

-ex. hacktivist or cyberactivist operation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

describe dumpster diving

A

involves rummaging through commercial or residential garbage to find discarded information. Paper files, letters, memos, photographs, IDs, passwords, credit cards, and other forms of information can be found in dumpsters
-this info can be used for fraudulent purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

def. identity theft

A

Crime in which someone uses the personal information of others to create a false identity and then uses it for some fraud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

techniques for illegally obtaining personal info

A
  • Stealing mail or dumpster diving.
  • Stealing personal information in computer databases.
  • Infiltrating organizations that store large amounts of personal information (e.g., data aggregators such as Acxiom)
  • Impersonating a trusted organization in an electronic communication (phishing).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

def. intellectual property

A

The intangible property created by individuals or corporations, which is protected under trade secret, patent, and copyright laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

def. trade secret

A

Intellectual work, such as a business plan, that is a company secret and is not based on public information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

def. patent

A

A document that grants the holder exclusive rights on an invention or process for a specified period of time, currently 20 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

def. copyright

A

A grant that provides the creator of intellectual property with ownership of it for a specified period of time, currently the life of the creator plus 50 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

def. piracy

A

Copying a software program (other than freeware, demo software, etc.) without making payment to the owner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the 3 general categories of cyberattacks?

A

(1) Remote Attacks Requiring User Action
(2) Remote Attacks Needing No User Action
(3) Attacks by a Programmer Developing a System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

def. virus

A

Segment of computer code that performs malicious actions by attaching to another computer program

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

def. worm

A

Segment of computer code that performs malicious actions and will replicate, or spread, by itself (without requiring another computer program)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

def. phising attack

A

Attack that uses deception to acquire sensitive personal information by masquerading as official-looking emails or instant messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

def. spear phishing

A

Attack that targets large groups of people. The perpetrators find out as much information as they can about an individual, tailoring their phishing attacks to improve their chances that they will obtain sensitive, personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

def. denial-of-service attack

A

An attack where an attacker sends so many information requests to a target computer system that the target cannot handle them successfully and typically crashes (ceases to function)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

def. distributed denial-of-service attack

A

An attack where an attacker first takes over many computers, typically by using malicious software. These computers are called zombies or bots. The attacker uses these bots—which form a botnet—to deliver a coordinated stream of information requests to a target computer, causing it to crash

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

def. bot or zombie

A

A computer that has been compromised by, and is under the control of, a hacker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

def. botnet

A

A network of computers that has been compromised by, and is under the control of, a hacker, who is called the botmaster

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

def. trojan horse

A

Software programs that hide in other computer programs and reveal their designed behaviour only when they are activated

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

def. back door

A

Typically a password, known only to the attacker, that allows him or her to access a computer system at will, without having to go through any security procedures (also called a trap door

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

def. logic bomb

A

A segment of computer code that is embedded within an organization’s existing computer programs and is designed to activate and perform a destructive action under specific conditions, such as at a certain time or date

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What are the four types of software attacks that are remote attacks requiring user action?

A

virus, worm, phishing attack, spear phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

what are the two types of remote attacks needing no user action

A

denial-of-service attack

distributed denial-of-service attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are the three kinds of attacks by a programmer developing a system?

A

trojan horse, back door, logic bomb

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

def. alien software

A

Clandestine software that is installed on your computer through duplicitous methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

def. adware

A

Alien software designed to help pop-up advertisements appear on your screen

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

def. spyware

A

software that collects personal information about users without their consent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

what are the two common types of spyare

A

keystroke loggers (record both your individual keystrokes and your web browsing history) and screen scrapers (his software records a continuous “movie” of a screen’s contents rather than simply recording keystrokes)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

def. spamware

A

Alien software that uses your computer as a launch platform for spammers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

def. spam

A

unsolicited email, usually advertising for products and services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

what is an issue with spam

A

it wastes time and money. Spam costs companies around the world billions of dollars every year. These costs arise from productivity losses, clogged email systems, additional storage, user support, and anti-spam software. Spam can also carry viruses and worms, making it even more dangerous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

def. cookies

A

Small amounts of information that websites store on your computer, temporarily or more or less permanently

-tracking cookies can be used to track your path through a website, the time you spend there, what links you click on, and other details that the company wants to record, usually for marketing purposes. Tracking cookies can also combine this information with your name, purchases, credit card information, and other personal data to develop an intrusive profile of your spending habits

50
Q

def. Supervisory Control and Data Acquisition (SCADA)

A

large-scale, distributed measurement and control system. SCADA systems are used to monitor or to control chemical, physical, and transport processes such as those used in oil refineries, water and sewage treatment plants, electrical generators, and nuclear power plants. Essentially, SCADA systems provide a link between the physical world and the electronic world

51
Q

def. cyberterrorism

A

A premeditated, politically motivated attack against information, computer systems, computer programs, and data that results in violence against noncombatant targets by subnational groups or clandestine agents

52
Q

def. cyberwarfare

A

War in which a country’s information systems could be paralyzed from a massive attack by destructive software

53
Q

Major difficulties in protecting information resources (10)

A
  1. Hundreds of potential threats exist.
  2. Computing resources may be situated in many locations.
  3. Many individuals control or have access to information assets.
  4. Computer networks can be located outside the organization, making them difficult to protect.
  5. Rapid technological changes make some controls obsolete as soon as they are installed.
  6. Many computer crimes are undetected for a long period of time, so it is difficult to learn from experience.
  7. People tend to violate security procedures because the procedures are inconvenient.
  8. The amount of computer knowledge necessary to commit computer crimes is usually minimal. As a matter of fact, a potential criminal can learn hacking, for free, on the Internet.
  9. The costs of preventing hazards can be very high. Therefore, most organizations simply cannot afford to protect themselves against all possible hazards.
  10. It is difficult to conduct a cost-benefit justification for controls before an attack occurs because it is difficult to assess the impact of a hypothetical attack.
54
Q

def. risk

A

probability that a threat will affect an information resource

55
Q

def. risk management

A

A process that identifies, controls, and minimizes the impact of threats, in an effort to reduce risk to manageable levels

56
Q

what are the three processes involved in risk management?

A

risk analysis, risk mitigation, and controls evaluation

57
Q

def. risk analysis (3 steps)

A

(1) assessing the value of each asset being protected, (2) estimating the probability that each asset will be compromised, and (3) comparing the probable costs of the asset’s being compromised with the costs of protecting that asset

58
Q

def. risk mitigation

A

A process whereby the organization takes concrete actions against risks, such as implementing controls and developing a disaster recovery plan

59
Q

two functions of risk mitigation

A

(1) implementing controls to prevent identified threats from occurring,
(2) developing a means of recovery if the threat becomes a reality

60
Q

what are the three most common risk mitigation strategies

A

risk acceptance, risk limitation, and risk transference

61
Q

def. risk acceptance

A

Accept the potential risk, continue operating with no controls, and absorb any damages that occur

62
Q

def. risk limitation

A

Limit the risk by implementing controls that minimize the impact of the threat

63
Q

def. risk transference

A

Transfer the risk by using other means to compensate for the loss, such as by purchasing insurance

64
Q

what does an org do in controls evaluation?

A

the organization identifies security deficiencies and calculates the cost of implementing. If the costs of implementing a control are greater than the value of the asset being protected, the control is not cost-effective

65
Q

def. controls (or countermeasures)

A

Defence mechanisms used to safeguard assets, optimize the use of the organization’s resources, and prevent or detect errors or fraud

66
Q

what is the single most valuable control?

A

user education and training

67
Q

def. control environment

A

Controls that encompass management attitudes toward controls, as evidenced by management actions, as well as by stated policies and procedures that address ethical issues and the quality of supervision

68
Q

def. general controls

A

Controls that apply to more than one functional area

69
Q

def. application controls

A

Security countermeasures that protect specific applications in functional areas

70
Q

3 types of general controls

A

physical controls, access controls, and communications controls

71
Q

def. physical controls

A

Controls that restrict unauthorized individuals from gaining access to a company’s computer facilities
(ie walls, doors, gates, locks, guards, alarm systems, etc.)q

72
Q

what is a shortcoming of physical controls

A

can be inconvenient to employees

73
Q

why do guards have a difficult job (two reasons)

A
  1. their jobs are boring and repetitive and generally do not pay well.
  2. if guards perform their jobs thoroughly, the other employees harass them, particularly if they slow up the process of entering the facility
74
Q

def. access controls

A

Controls that restrict unauthorized individuals from using information resources and are concerned with user identification
-can be physical controls or logical controls

75
Q

def. logical controls

A

controls that are implemented by software

76
Q

what are the two main functions of access controls

A

authentication and authorization

77
Q

def. authentication

A

confirms the identity of the person requiring access

78
Q

def. authorization

A

process that determines which actions, rights, or privileges the person has, based on his or her verified identity

79
Q

what do good control systmes do?

A

limit authorization to tasks needed to accomplish a person’s job

80
Q

def. biometrics

A

The science and technology of authentication (i.e., establishing the identity of an individual) by measuring the subject’s physiological or behavioural characteristics

ex. fingerprints, retina scan

81
Q

smart ID cards

A

have an embedded chip that stores pertinent information about the user

82
Q

tokens

A

have embedded chips and a digital display that presents a login number that the employees use to access the organization’s network. The number changes with each login.

83
Q

what are forms of authentication that the user does

A

voice recognition, signature recognition

84
Q

what are authentication methods that the users knos?

A

passwords and passphrase

85
Q

Basic guidelines for strong passwords? (6)

A
  • They should be difficult to guess.
  • They should be long rather than short.
  • They should have uppercase letters, lowercase letters, numbers, and special characters.
  • They should not be recognizable words.
  • They should not be the name of anything or anyone familiar, such as family names or names of pets.
  • They should not be a recognizable string of numbers, such as a social insurance number or a birthday
86
Q

what is the difference between a password and pass phrase

A

passphrase is a series of characters that is longer than a password but is still easy to memorize

-passphrase can serve as a password itself, or it can help you create a strong password

87
Q

what is using more than one type of authentication called

A

multifactor authentification

88
Q

def. privilege (user profile)

A

A collection of related computer system operations that can be performed by users of the system

89
Q

def. least privilege

A

A principle that users be granted the privilege for some activity only if there is a justifiable need to grant this authorization

90
Q

def. communication controls (or network controls)

A

Controls that deal with the movement of data across networks

91
Q

def. firewall

A

A system (either hardware, software, or a combination of both) that prevents a specific type of information from moving between untrusted networks, such as the Internet, and private networks, such as your company’s network

92
Q

def. demilitarized zone (DMZ)

A

A separate organizational local area network that is located between an organization’s internal network and an external network, usually the Internet

93
Q

The danger from viruses and worms is so severe that many organizations are placing firewalls at strategic points _________________

A

inside their private networks.

In this way, if a virus or worm does get through both the external and internal firewalls, then the internal damage may be contained

94
Q

def. anti-malware systems (or antivirus software)

A

Software packages that attempt to identify and eliminate viruses, worms, and other malicious software

95
Q

def. malware

A

Malicious software such as viruses and worms

96
Q

Whereas firewalls filter network traffic according to categories of activities that are likely to cause problems, anti-malware systems filter traffic ____________

A

according to a database of specific problems

97
Q

def. whitelisting

A

A process in which a company identifies acceptable software and permits it to run, and either prevents anything else from running or lets new software run in a quarantined environment until the company can verify its validity

98
Q

def. blacklisting

A

A process in which a company identifies certain types of software that are not allowed to run in the company environment

99
Q

Whereas whitelisting allows _______ to run unless it is on the whitelist, blacklisting allows _________ to run unless it is on the blacklist.

A

nothing

everything

100
Q

def. encryption

A

The process of converting an original message into a form that cannot be read by anyone except the intended receiver

101
Q

def. public-key encryption (or asymmetric encryption)

A

A type of encryption that uses two different keys: a public key (locking key) and a private key (unlocking key)

public key (locking key) and the private key (the unlocking key) are created simultaneously using the same mathematical formula or algorithm. Because the two keys are mathematically related, the data encrypted with one key can be decrypted by using the other key

102
Q

def. certificate authority

A

third party that acts as a trusted intermediary between computers (and companies) by issuing digital certificates and verifying the worth and integrity of the certificates

103
Q

def. digital certificate

A

An electronic document attached to a file certifying that this file is from the organization it claims to be from and has not been modified from its original format or content

104
Q

def. Virtual private network (VPN)

A

A private network that uses a public network (usually the Internet) to securely connect users by using encryption

105
Q

why are VPNs called virtual

A

they have no separate physical existence

106
Q

advantages of VPNs

A
  1. they allow remote users to access the company network
  2. they provide flexibility. That is, mobile users can access the organization’s network from properly configured remote devices.
  3. organizations can impose their security policies through VPNs
107
Q

def. tunnelling

A

A process that encrypts each data packet to be sent and places each encrypted packet inside another packet

VPN uses this

108
Q

def. transport layer security (TLS) (or secure socket layer)

A

An encryption standard used for secure transactions such as credit card purchases and online banking

109
Q

def. employee monitoring systems

A

Systems that monitor employees’ computers, email activities, and Internet surfing activities

110
Q

application controls

A

security countermeasures that protect specific applications in functional areas

111
Q

3 major categories of application controls

A

input controls, processing controls, and output controls.

112
Q

input controls

A

programmed routines that edit input data for errors before they are processed

113
Q

processing controls

A

programmed routines that perform actions that are part of the record-keeping of the organization, reconcile and check transactions, or monitor the operation of applications.

114
Q

output controls

A

programmed routines that edit output data for errors, or help to ensure that output is provided only to authorized individuals.

115
Q

def. business continuity planning

A

The chain of events linking planning to protection and to recovery

purpose:
provide guidance to people who keep the business operating after a disaster occurs

116
Q

hot sites

A

fully configured computer facility with all of the company’s services, communications links, and physical plant operations. A hot site duplicates computing resources, peripherals, telephone systems, applications, and workstations

117
Q

warm site

A

provides many of the same services and options as the hot site. However, it typically does not include the actual applications the company needs. A warm site includes computing equipment such as servers, but it often does not include user workstations

118
Q

cold site

A

provides only rudimentary services and facilities, such as a building or a room with heating, air conditioning, and humidity control. This type of site provides no computer hardware or user workstations.

119
Q

audit

A

The accumulation and evaluation of evidence that is used to prepare a report about the information or controls that are being examined, using established criteria and standards

120
Q

information systems audit

A

An examination of information systems, their inputs, outputs, and processing

MGCR 331 (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions