ethics in tech general Flashcards
Black hat hacker
Someone who violates computer or Internet security maliciously or for illegal personal gain (in contrast to a white hat hacker who is someone who has been hired by an organization to test the security of its information systems)
Cracker
An individual who causes problems, steals data, and corrupts systems
Malicious insider
An employee or contractor who attempts to gain financially and/or disrupt a company’s information systems and business operations
Industrial spy
An individual who captures trade secrets and attempts to gain an unfair competitive advantage
Cybercriminal
Someone who attacks a computer system or network for financial gain
Hacktivist
An individual who hacks computers or websites in an attempt to promote a political ideology
Cyberterrorist
Someone who attempts to destroy the infrastructure components of governments, financial institutions, and other corporations, utilities, and emergency response units
Why are computer incidents so prevalent?
bring your own device (BYOD) policies
a growing reliance on software with known vulnerabilities
and the increasing sophistication of those who would do harm have caused a dramatic increase in the number, variety, and severity of security incidents
zero-day exploit
a cyberattack that takes place before the security community and/or software developers become aware of and fix a security vulnerability.
deontology
emphasizes moral obligation and describes principles that govern action,
the Ethics of Logical Consistency and Duty,
virtue ethics
focus on human character as the centre of moral activity
communitarianism
centers on the interdependence we have for all of life and people
utilitarianism
greatest benefit for the greatest number of people, happy consequences
“finding the mean” in virtue ethics
acting virtuously requires a balance between excess and deficiency.
utility in utilitarianism
utility is the greatest happiness principle, hard to determine what consequences should be considered
ransomware
malware that stops you from using your computer or accessing your data until you meet certain demands, such as paying a ransom or sending photos to the attacker.
virus
a piece of programming code, usually disguised as something else, that causes a computer to behave in an unexpected and usually undesirable manner.
worm
Unlike a computer virus, which requires users to spread infected files to other users, a worm is a harmful program that resides in the active memory of the computer and duplicates itself. Worms differ from viruses in that they can propagate without human intervention, often sending copies of themselves to other computers by email. A worm is capable of replicating itself on your computer so that it can potentially send out thousands of copies of itself to everyone in your email address book.
trojan horse
a seemingly harmless program in which malicious code is hidden. A victim on the receiving end of a Trojan horse is usually tricked into opening it because it appears to be useful software from a legitimate source,
blended threat
a sophisticated threat that combines the features of a virus, worm, Trojan horse, and other malicious code into a single payload.
How to spam legally?
spammers cannot disguise their identity by using a false return address, the email must include a label specifying that it is an ad or a solicitation, and the email must include a way for recipients to indicate that they do not want future mass mailings.
DDos Attack
a malicious hacker takes over computers via the Internet and causes them to flood a target site with demands for data and other small tasks. A DDoS attack does not involve infiltration of the targeted system. Instead, it keeps the target so busy responding to a stream of automated requests that legitimate users cannot get in—the Internet equivalent of dialing a telephone number repeatedly so that all other callers hear a busy signal.
root kit
a set of programs that enables its user to gain administrator-level access to a computer without the end user’s consent or knowledge.
APT or advanced persistent threat
a network attack in which an intruder gains access to a network and stays there—undetected—with the intention of stealing data over a long period of time (weeks or even months). Attackers in an APT must continuously rewrite code and employ sophisticated evasion techniques to avoid discovery.
spear phishing
a variation of phishing in which the phisher sends fraudulent emails to a certain organization’s employees
Department of Homeland Security
a large federal agency with a budget of $65 billion whose goal is to provide for a “safer, more secure America which is resilient against terrorism and other threats.”
Computer Fraud and Abuse Act (U.S. Code Title 18, Section 1030)
Addresses fraud and related activities in association with computers, including the following:
Accessing a computer without authorization or exceeding authorized access Transmitting a program, code, or command that causes harm to a computer Trafficking of computer passwords Threatening to cause damage to a protected computer
Fraud and Related Activity in Connection with Access Devices Statute
Covers false claims regarding unauthorized use of credit cards
Stored Wire and Electronic Communications and Transactional Records Access Statutes
Focuses on unlawful access to stored communications to obtain, alter ot prevent unauthorized access to electronic communication while it is in electronic storage.
USA Patriot Act
defines cyber-terrorism and associated penalties
CIA Triad
confidentiality- only those with proper authority can access sensitive data
integrity- data can only be changed by authorized individuals
availability- data can be accessed where and when its needed
Layered security solution
The key to prevention of a computer security incident is to implement a layered security solution to make computer break-ins so difficult that an attacker eventually gives up or is detected before much harm is inflicted. In a layered solution, if an attacker breaks through one layer of security, another layer must then be overcome.
Organization, Network, Application and End User
risk assessment
the process of assessing security-related risks to an organization’s computers and networks from both internal and external threats. Such threats can prevent an organization from meeting its key business objectives
reasonable assurance
managers must use their judgment to ensure that the cost of control does not exceed the system’s benefits or the risks involved.
disaster recovery plan
a documented process for recovering an organization’s business information system assets—including hardware, software, data, networks, and facilities—in the event of a disaster.
business continuity plan
an organization should conduct a business impact analysis to identify critical business processes and the resources that support them. The recovery time for an information system resource should match the recovery time objective for the most critical business processes that depend on that resource. Some business processes are more pivotal to continued operations and goal attainment than others. These processes are called mission-critical process
What does a good security policy do?
delineates responsibility and the behaviour expected of members of the organization
What does a security audit do?
evaluates whether an organization has a well-considered security policy in place and if it is being followed.
Bank Secrecy Act of 190
Requires financial institutions in the United States to assist U.S. government agencies in detecting and preventing money laundering
Federal Information Security Management Act (44 U.S.C. § 3541, et seq.)
Requires each federal agency to provide information security for the data and information systems that support the agency’s operations and assets, including those provided or managed by another agency, contractor, or other source
Foreign Corrupt Practices Act (15 U.S.C. § 78dd-1, et seq.)
Makes certain payments to foreign officials and other foreign persons illegal and requires companies to maintain accurate records
Gramm-Leach-Bliley Act (Public Law 106-102)
Governs the collection, disclosure, and protection of consumers’ nonpublic personal information or personally identifiable information
Health Insurance Portability and Accountability Act (Public Law 104–191)
Regulates the use and disclosure of an individual’s health information
Payment Card Industry Data Security Standard (PCI DSS)
Provides a framework of specifications, tools, measurements, and support resources to help organizations ensure the safe handling of cardholder information
Sarbanes-Oxley Act (Public Law 107–204 116 Stat. 745)
Protects shareholders and the general public from accounting errors and fraudulent practices in the enterprise
NGFW vs standard firewall
Protects shareholders and the general public from accounting errors and fraudulent practices in the enterprise
encryption key
a value that is applied (using an algorithm) to a set of unencrypted text (plaintext) to produce encrypted text that appears as a series of seemingly random characters (ciphertext) that is unreadable by those without the encryption key needed to decipher it.
transport layer security (TLS)
a communication protocol or system of rules that ensures privacy between client and server
intrusion detection system (IDS)
software and/or hardware that monitors system and network resources and activities and notifies network security personnel when it detects network traffic that attempts to circumvent the security measures of a networked computer environment (see Figure 3-7). Such activities usually signal an attempt to breach the integrity of the system or to limit the availability of network resources.
Antivirus software scans for a specific sequence of bytes, known as a __________________ , that indicates the presence of a specific virus.
virus signature
what must be done before eradication of a cyber attack?
incident containment, and collection and log of all possible criminal evidence of the attack
What is a MSSP?
a managed security service provider (MSSP) , which is a company that monitors, manages, and maintains computer and network security for other organizations. MSSPs include such companies as AT&T, Computer Sciences Corporation, Dell SecureWorks, IBM, Symantec, and Verizon. MSSPs provide a valuable service for IT departments drowning in reams of alerts and false alarms coming from VPNs; antivirus, firewall, and IDSs; and other security-monitoring systems. In addition, some MSSPs provide vulnerability scanning and web blocking and filtering capabilities.
right of privacy
“the right to be left alone—the most comprehensive of rights, and the right most valued by a free people.”*
Fair Credit Reporting Act
regulates the operations of credit reporting bureaus, including how they collect, store, and use credit information. The act, enforced by the U.S. Federal Trade Commission,
Right to Financial Privacy Act (1978)
protects the records of financial institution customers from unauthorized scrutiny by the federal government
Gramm-Leach-Bliley Act (1999)
was a bank deregulation law that repealed a Depression-era law known as Glass-Steagall, included three key rules that affect personal privacy, financial privacy, safeguards, and pretexting rules
Fair and Accurate Credit Transactions Act (2003)
allows consumers to request and obtain a free credit report once each year from each of the three primary consumer credit reporting companies
Health Insurance Portability and Accountability Act (1996)
designed to improve the portability and continuity of health insurance coverage; to reduce fraud, waste, and abuse in health insurance and healthcare delivery; and to simplify the administration of health insurance.
The American Recovery and Reinvestment Act (2009)
a wide-ranging act passed in 2009 that authorized $787 billion in spending and tax cuts over a 10-year period. Title XIII, Subtitle D, of this act (known as the Health Information Technology for Economic and Clinical Health Act, or HITECH) included strong privacy provisions for electronic health records (EHRs), including banning the sale of health information, promoting the use of audit trails and encryption, and providing rights of access for patients. It also mandated that each individual whose health information has been exposed be notified within 60 days after discovery of a data breach.
Family Educational Rights and Privacy Act (1974)
a federal law that assigns certain rights to parents regarding their children’s educational records. These rights transfer to the student once the student reaches the age of 18, or earlier, if he or she attends a school beyond the high school level. These rights include:
the right to access educational records maintained by a school; the right to demand that educational records be disclosed only with student consent; the right to amend educational records; and the right to file complaints against a school for disclosing educational records in violation of FERPA.
Children’s Online Privacy Protection Act (1998)
any website that caters to children must offer comprehensive privacy policies, notify parents or guardians about its data collection practices, and receive parental consent before collecting any personal information from children under 13 years of age. COPPA was implemented in 1998 in an attempt to give parents control over the collection, use, and disclosure of their children’s personal information; it does not cover the dissemination of information to children.
Title III of the Omnibus Crime Control and Safe Streets Act (1968; Amended 1986)
also known as the Wiretap Act , regulates the interception of wire (telephone) and oral communications. It allows state and federal law enforcement officials to use wiretapping and electronic eavesdropping, but only under strict limitations. Under this act, a warrant must be obtained from a judge to conduct a wiretap.
