Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Study group > CPP 2012 Domain 6: Information Security > Flashcards

CPP 2012 Domain 6: Information Security Flashcards

1
Q

What are the three threat categories in information asset protection?

A

Intentional,
Natural,

Inadvertent.

Source: POA: Information Security, 1.3.2, pages 5-6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What kinds of companies are particularly vulnerable to counterfeiting and piracy?

A

Startups,
Early stage firms,

Small and medium-size companies that are rich in intangible assets.

Source: POA: Information Security, 1.3.2, page 9

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

According to the FBI, what are the six steps of protecting a business from espionage?

A

Recognize the (insider or outsider) threat,
Identify and valuate trade secrets,
Implement a proactive plan for protecting trade secrets,
Secure physical and electronic versions of trade secrets,
Confine intellectual knowledge to “need to know,”
Train employees on intellectual property protection.
Source: POA: Information Security, 1.4.1, page 11

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does layered protection apply to information protection?

A

Apply multiple levels of protection to information assets,
Ensure that layers of protection complement each other,
Build a coordinated strategy that integrates families of protective measures (e.g. technical, physical, access control).
Source: POA: Information Security, 1.4.2, page 13

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Access to internal information should be restricted to which groups?

A

Company personnel and those who have signed a nondisclosure agreement.

Source: POA: Information Security, 1.4.1, page 12

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How should obsolete prototypes, models, and test items be disposed of?

A

They should be destroyed so they can’t be reverse engineered.

Source: POA: Information Security, 1.4.2, page 14

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a patent?

A

A patent is a property right granted to an inventor to exclude others from making, using, offering for sale, or selling the invention for a limited time.

Source: POA: Information Security, 1.5, page 21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a trademark?

A

Legal protection for words, names, symbols, devices, or images applied to products or used in connection with goods or services to identify their source.

Source: POA: Information Security, 1.5, page 21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a copyright?

A

Legal protection of the expression of ideas in literary, artistic, and musical works.

Source: POA: Information Security, 1.5, page 21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the best way to start addressing infringements of patents, copyrights, and trademarks?

A

By registering those rights.

Source: POA: Information Security, 1.5, page 21

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How long is U.S. patent protection?

A

20 years from filing.

Source: POA: Information Security, 1.5.3, page 23

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What qualifies something as a trade secret?

A

The information added value or benefit to the owner,
The trade secret was specifically identified, and
The owner provided a reasonable level of protection for the information.
Source: POA: Information Security, 1.5.4, page 24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is an intrusion detection system?

A

An intrusion detection system monitors for malicious programs and unauthorized changes to files and settings. It also monitors network traffic and provides alarms for network-based attacks.

Source: POA: Information Security, 1.6.2, page 27

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are three methods of sanitizing electronic media?

A

Overwriting,
Degaussing,
Physical destruction.
Source: POA: Information Security, 1.6.2, page 27

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the two primary aspects of recovery after an information loss?

A

Return to normal business operations as soon as possible,
Implement measures to prevent a recurrence.
Source: POA: Information Security, 1.7, page 30

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

During which stage of a project is critical information most vulnerable?

A

The intermediate phases.

Source: POA: Information Security, 1, Appendix D, page 49

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When is it appropriate to recycle papers that contain proprietary information?

A

When the papers have been properly destroyed.

Source: POA: Information Security, 1, Appendix E, page 55

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What access control protocol passes credentials between the reader and the control panel in plain text?

A

Wiegand.

Source: POA: Information Security, 2.5, page 75

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the difference between embedded and host-based systems?

A

Embedded systems are typically programmed at the manufacturer and run proprietary or nonstandard operating systems, e.g. cameras, card readers, and video converters.
Host-based systems run on more standard operating systems such as Windows and Linux and are easier to change.
Source: POA: Information Security, 2.5, page 73

20
Q

What are the two components of a legacy HID card?

A

A secret facility number,
An ID number that is printed on the card.
Source: POA: Information Security, 2.5, page 74

21
Q

What is a gecko?

A

A gecko is an inexpensive tool that can be used to give an intruder complete control over a door.

Source: POA: Information Security, 2.5, page 75

22
Q

What three aspects of information must be protected?

A

Confidentiality,
Integrity,
Availability.
Source: POA: Information Security, 2.3, page 69; Information Asset Protection Guideline, 3, page 85

23
Q

What is the fundamental equation of information systems security?

A

Threats x Vulnerabilities
Residual Risk = __________________
Countermeasures
Source: POA: Information Security, 3.1.2, page 87

24
Q

What are the three general categories of information system threat agents?

A

Nature,
People,
Virtual threats.
Source: POA: Information Security, 3.1.3, pages 87-88

25
Q

What is the first job of a person tasked with an organization’s information systems security?

A

Create an information security management system appropriate for the size of the organization.

Source: POA: Information Security, 4.3, page 174

26
Q

What are the five general types of vulnerabilities of information systems?

A 
Information systems infrastructure,
People using the infrastructure,
People maintaining the infrastructure,
Executive and senior management,
Information management processes.
Source: POA: Information Security, 3.1.4, page 89
27
Q

What are the five information systems infrastructure management countermeasures?

A

Vulnerability and patch management,
System monitoring and log review,
Information system security metrics,
Physical security of the information system infrastructure,
IT staff training in information security.
Source: POA: Information Security, 3.1.6, page 91

28
Q

What are the seven layers of the Open Systems Interconnect (OSI) network model?

A 
Physical,
Data link,
Network, 
Transport,
Session, 
Presentation,
Application.
Source: POA: Information Security, 3.2.1, page 97
29
Q

What is a buffer overflow attack?

A

A buffer overflow attack occurs when a user or programmer gives a computer more information than the program is expecting. The extra characters may give the computer instructions to do something not originally intended.

Source: POA: Information Security, 3.2.1, page 101

30
Q

What is the “AAA triad” of information security with regard to access control?

A

Authentication,
Authorization,
Auditing/accountability.
Source: POA: Information Security, 3.2.1, page 103

31
Q

What is the IT Infrastructure Library (ITIL)?

A

An international standard for managing IT—particularly service-level agreements, the way an organization negotiates for IT security services.

Source: POA: Information Security, 3.2.2, page 106

32
Q

What is an escalation of privilege attack?

A

An escalation of privilege attack occurs when an email program is tricked into executing an email as if it were a program rather than text.

Source: POA: Information Security, 3.2.3, page 109

33
Q

What are three major vulnerabilities of a printer?

A

They often connect to a network, so communications can be intercepted.
They may contain onboard memory, which must be wiped when printing confidential information.
The hard copies they create can be taken from one place to another.
Source: POA: Information Security, 3.2.3, page 110

34
Q

What is a security information and event manager (SIEM)?

A

A security information and event manager is a device that looks at all the log activity on a network and attempts to point out what is most important to facilitate response to incursions and other problems on the network.

Source: POA: Information Security, 3.2.5, page 116

35
Q

What are ISO 27001 and 27002?

A

ISO 27001 and 27002 are the first acknowledged worldwide standards to identify a code of practice for the management of information security.

Source: POA: Information Security, 3.3.1, page 118

36
Q

What are the six elements of the Payment Card Industry Data Security Standard (PCI DSS)?

A

Build and maintain a secure network,
Protect cardholder data,
Maintain a vulnerability management program,
Implement strong access control measures,
Regularly monitor and test networks,
Maintain an information systems policy.
Source: POA: Information Security, 3.4.1, pages 123-124

37
Q

According to ISO 27002, which three elements of guidance should information security policies include, at a minimum?

A

Definition of information security and its objectives/scope,
Statement of management intent,
Brief explanation of security policies/principles/standards important to the organization.
Source: POA: Information Security, 3.5.2, page 141

38
Q

What is the fundamental idea behind an information security management system?

A

Continual improvement.

Source: POA: Information Security, 3.6.2, page 146

39
Q

On what does the effectiveness of an information security program ultimately depend?

A

People’s behavior.

Source: POA: Information Security, 3.6.2, page 147

40
Q

Which five information systems security (ISS) issues can also weaken physical security in a converged system?

A 
Denial of services,
Insertion of incorrect data,
Data theft,
Data modification,
Data destruction.
Source: POA: Information Security, 4.1, page 159
41
Q

What are four main vectors via which networked security systems can be attacked?

A 
Social engineering,
Direct hacking,
Malware, 
Web attack.
Source: POA: Information Security, 4.2, page 168
42
Q

What are three main reasons that malware is effective?

A

Out-of-date antivirus software,
Users open booby-trapped emails or websites,
System administrators allow users to install software on the desktop.
Source: POA: Information Security, 4.2.3, page 170

43
Q

What is an injection attack?

A

An injection attack allows an adversary to execute a command directly on a database contrary to allowed access rights.

Source: POA: Information Security, 4.2.4, page 171

44
Q

What is cross-site scripting?

A

A cross-site scripting error on a website enables an attacker to run a malicious code from a second website on the browser of the person viewing the first website.

Source: POA: Information Security, 4.2.4, page 171

45
Q

What is a cross-site request forgery?

A

A cross-site request forgery is an attack where the victim’s browser is tricked into issuing a command to a vulnerable Web application.

Source: POA: Information Security, 4.2.4, page 172

Study group (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions