Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BusBis > Chapter 8: Securing Information Systems > Flashcards

Chapter 8: Securing Information Systems Flashcards

1
Q

Cybersecurity

A

art of protecting networks, devices, and data from unauthorized access , ensuring CIA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIA Triad

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Confidentiality

A
  • controlled access, data kept secret and private
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Integrity

A
  • data is trustworthy and free from tampering
  • accurate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability

A

systems must be functioning, data must be accessible

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Security

A

Policies, procedures, and technical measures used to prevent unauthorized access or damage to IS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Controls

A

methods, policies, and organizational procedures that ensure the safety or org’s assets, the accuracy and reliability of records, and operational adherence to management standards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Vulnerability

A

weakness or flow in system that can be exploited
- weakest link (poor sys mgmt)
- hardware
- software
- loss or theft
- networks outside control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Internet Vulnerabilities

A
  • large networks open to anyone = recipe for widespread impact
  • emails could have malicious software
  • IM could be backdoor
  • sharing info over P2P network can compromise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Wireless Security Challenges

A
  • bluetooth, wifi, local area networks (LAN)
  • radio frequency bands easy to scan
  • SSID
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

SSID

A

Service Set Identifiers
- identify access points
- broadcast multiple times
- found by sniffer programs
- War Driving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

War Driving

A

eavesdroppers drive by and try to detect SSIDs to get on network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Software Vulnerability

A
  • bugs (program code defects)
  • zero defects can’t be achieved
  • 0 day vulnerabilities
  • patchwork
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Malicious Software

A
  • malware
  • virus
  • worms
  • SQL Injection
  • Trojan Horse
  • RansomWare
  • Spyware
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Malware

A

malicious software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

virus

A

rogue software program that attaches itself to other stuff to be executed
- must deliver payload
- spread from computer to computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Worms

A

independent programs that copy themselves from one computer to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Trojan Horse

A
  • appear benign, but does something different than expected
  • way viruses/malware is introduced
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

SQL Injection

A

install themselves under the radar to monitor web activity and sense advertising
- Keyloggers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Keyloggers

A

record keystrokes on computers to steal serial numbers for software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Red Team

A
  • vulnerability and penetration testing
  • treat hunting
  • malware analysis
  • social engineering
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Purple Team

A

red and blue teams working together to improve cybersecurity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Blue

A
  • incident responders
  • security operations
  • IT networks and systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Denial-of-Service

A
  • flooding server with thousands of requests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Distributed DOS

A

multiple computers to launch
- Botnet: network of “zombie” PCs infilitrated by bot malware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Computer Crime

A

violation criminal law that involve knowledge of computer tech for their perpetration, investment, and prosecution
- computer can be either the target or instrument

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Phishing

A

setting up fake websites or sending emails that look legit and asking for personal data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Spear-Phishing

A

sends fraud email to organizations’ employees

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Smishing

A

sending text telling people to call or login

30
Q

Vishing

A

leaving voicemail telling people to call or login

31
Q

Evil Twins

A

wireless networks that pretend to offer trustworthy wifi-connections and look identical to public networks

32
Q

Pharming

A

redirections users to bogus websites, even when typed correctly

33
Q

Click Fraud

A

fraudulently click on ad

34
Q

Cyberterrorism

A

state-sponsored activity designed to cripple and defect another nation

35
Q

Internal Threat

A

Employees
- insider knowledge
- sloppy security

36
Q

Social Engineering

A

tricking employees into revealing their passwords by pretending to be legit members of the company

37
Q

Patches

A

small patches of software released to repair flaws

38
Q

Spoofing

A

“masquerade”
- steal info from fake website that mirror real one

39
Q

Sniffing

A

“eavesdropping”
- “grab info” as it passes through transmission
- encryption is only safeguard

40
Q

Business Value of Security + Control

A
  • failed computer systems can lead to significant loss
  • firms are more vulnerable than ever
    Breach cuts into firms net value
  • liability issues with inadequate security
41
Q

HIPPA

A

medical security

42
Q

Gramm-Lean Biley Act

A

Financial inst. to declare security and confidentiality of data

43
Q

Sarbanes-Osley Act

A

responsibility on company/management to safeguard accuracy and integrity of financial date

44
Q

computer Forenscics

A

recovering data from computers while preserving evidential integrity
- in court

45
Q

Risk Assessment

A

determines level of risk to company if not properly dealt with
think: impact and probability

46
Q

Security managment

A

ranks info risk and identifies acceptable security and goals and means to achieve those goals
- Acceptable use policy
- identity management

47
Q

Acceptable use policy (AUP)

A

acceptible use’s of firms’ info

48
Q

Identity Management

A

indenify valid uses, control access

49
Q

Disaster Recovery Planning

A

devises plans for restoration of disrupted services

50
Q

Business Continuity Planning

A

focuses on restoring business operations after a disaster

51
Q

Business Impact Analysis

A

determines impact of outage

52
Q

IS Auditing

A
  • examination of IS security and control governing IT
  • internal auditors
  • external auditions: review
    ISACA (independent systemp audit and control association)
53
Q

Identity Management (IAM)

A

autimates process of keeping track of users and their privledges, assigning user each unique identity for assessing each system

54
Q

Authentication

A

Knowing a person is who they say they are

55
Q

2 factor authentication

A

something you are and something you own

56
Q

Firewalls

A

combination of hardware and software that prevents unauthorized users from accessing private network
- security personnel must maintain detailed internal rules for identifying people, apps, or addresses that are allowed

57
Q

Tools for Protecting Info Systems and Resources

A
  • Intrusion Detection Systems
  • intrusion prevention systems
  • anti-malware
  • unified threat management system
58
Q

Intrusion Detection System

A

full time monitoring placed at most vulnerable points to detect intruders

59
Q

Intrusion Prevention System

A

monitor network activities to attempt to block threat

60
Q

Anti-malware

A

checks computer for malware presence and can often eliminate it

61
Q

Unified Threat Management System

A

combo of various security tools into 1 system and often helping company decrease costs and increase manageability

62
Q

Encryption

A

transforming text or data into cipher text that cannot be read by unintended recipients
2 methods
- symmetric key
- public key

63
Q

Symmetric Key Encryption

A

sender and user have 1 shared key

64
Q
A
65
Q

Public Key

A
  • uses 2 mathematically related keys
  • sender encrypts with recipient public key
  • recipient decrypts with private key
66
Q

Ensuring System Availability

A

online transaction processing requires 100% availability
- Fault-tolerant computer systems
- deep packet inspection
- security outsourcing (MSSP)

67
Q

Fault-tolerant computer systems

A

contain redundant hard/software and power supply components that create an environment that provides continuous, interrupted service

68
Q

Security for Cloud Computing

A

Responsibility resides in company owing data
- firms must ensure adequate protection
- service level agreement

69
Q

Security for Mobile Platforms

A

Costs should include any other costs for mobile

70
Q

Control Updates

A

-Lockdown/erase lost devices
- encryption
- software for separate corporate data on device

71
Q

Rise of Software Supply Chain

A
  • cost
  • quality
  • speed
    Can only have 2!!

BusBis (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions