Data Security & Integrity Processes

Question 1

Threats of no privacy and security

Answer 1

Unauthorised access
Disclosure of data to people not entitled to have access to it
Disruption of data in transit from one place to another
Unauthorised modification of data
Destruction or loss of data
Destruction or loss of storage media

Question 2

Protection: Standard clerical prosedures

Answer 2

Removal of data prohibited by a policy
Removal of USB ports from machines to prevent theft of data
Only hiring employees with no criminal record
Regular backing up of data

Question 3

Protection: Levels of permitted access

Answer 3

Employees can only access what they need to access
Different users will be able to read some data, read all data, write data to existing tables and create and remove tables.

Question 4

Protection: Passwords

Answer 4

Complex - combination of upper case, lower case, numeric and symbols
Imposing a minimum number of characters
Changed often, minimising risks if a password is compromised

Question 5

Protection: Write-protect mechanisms

Answer 5

A setting that can be applied to disk drives or certain folders
Write-protected data can be read but not changed of deleted

Question 6

Accidental Damage

Answer 6

Data may be lost, but no one deliberately intended for it to be lost.
A person accidentally deleting a record
A computer or server crash
A loss of power before a file was saved
Destruction of equipment due to fire or flood

Question 7

Malicious Damage

Answer 7

When a person sets out with the specific intent to cause damage to data.
A hacker gaining access to a system and changing/deleting information.
A virus, Trojan horse or worm being introduced to a system.
An employee of an organisation damaging or destroying data for their own gains.

Question 8

Black hackers

Answer 8

Black hackers break into systems for their own purposes such as financial or
political gain.

Question 9

White hackers

Answer 9

White hackers use their skills to break into systems to expose flaws and
advise how they can be fixed. They are usually hired by companies to test.

Question 10

Grey hackers

Answer 10

Grey hackers are the same as white hackers however are not hired by
companies but do it anyway to expose the flaws. They hope to be hired by
the company but they are at risk of the computer misuse act.

Question 11

Virus

Answer 11

A virus attaches itself to a host program. The host file has to be opened for the virus to spread. They become resident in memory once they are run. They infect other uninfected files by copying themselves.

Question 12

Worms

Answer 12

Worms are similar to viruses; however, they can spread without the need for human interaction. They can self-replicate. Worms can easily be spread through a lack of knowledge and awareness.

Question 13

Trojans

Answer 13

Programs which contain trojans appear useful but once installed the program has a hidden agenda and is often used to create backdoors to your system. These are then used to exploit your system by people with malicious intent.

Question 14

Contingency planning: Before the disaster

Answer 14

Before the disaster: risk analysis, preventive measures including offsite backup and staff training to ensure that when a disaster happens, loss of data is minimised and the company has ensured that the data can be recovered.

Question 15

Contingency planning: During the disaster

Answer 15

During the disaster: staff response - implement contingency plans that prevent further damage to the data and begins immediate recovery of data.

Question 16

Contingency planning: After the disaster

Answer 16

After the disaster: recovery measures, purchasing replacement hardware, reinstalling software, restoring data from backups restores normal running and recovers all data.