Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

MIS 4800 > Exam 1 > Flashcards

Exam 1 Flashcards

1
Q

OSI Layer “Please”

A
  1. Physical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

OSI Layer “Do”

A
  1. Data Link
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

OSI Layer “Not”

A
  1. Network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

OSI Layer “Throw”

A
  1. Transport
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

OSI Layer “Sausage”

A
  1. Session
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

OSI Layer “Pizza”

A
  1. Presentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

OSI Layer “Away”

A
  1. Application
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The name fo the Internet standards architecture is _________

A

TCP/IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

________ is a good option if an attack is aimed at a single server because it keeps transmission lines at least partially open for other communication.

A

Rate limiting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Threat Environment

A

The threat environment consists of the types of attackers and attacks that companies face

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Security Goals

A

Confidentiality, Integrity, Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Confidentiality

A

Confidentiality means that people cannot read sensitive information, either while it is on the a computer or while it is traveling across a network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Integrity

A

Integrity means that attackers cannot change or destroy information, either while it is on a computer or while it is traveling across a network. Or, at least, if information is changed or destroyed, then the receiver can detect the change or restore destroyed data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Availability

A

Abailability means that people who are authorized to use information are not prevented from doing so

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Compromises

A

Successful attacks (aka incidents, breaches)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Countermeasures

A

Tools used to thwart attacks (aka safeguards, protections, and controls)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Types of countermeasures

A

Preventative
Detective
Corrective

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

PCI-DSS

A

Payment Card Industry-Data Security Standard
Rules for companies that accept credit card purchases
Has 12 requirements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Employees and ex-employees are dangerous because:

A

They have knowledge of internal systems
They often have teh permission to access systems
They often know how to avoid detection
Employees generally are trusted
(IT and especially IT security professionals are the greatest employee threats)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Employee sabotage

A

Destruction of hardware, software, or data

Plant time bomb or logic bomb on computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Employee hacking

A

hacking is intentionally accessing a computer without AUTHORIZATION or in excess of authorization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Employee financial threat

A

Misappropriation of assets

theft of money

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Employee theft of intellectual property (IP)

A

Copyrights, patents, and trade secrets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Employee extortion

A

Perpetrator tries to obtain money or other goods by threatening to take actions that would be against the victim’s interest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Employee internet abuse

A

Downloading pornography, which can lead to sexual harassment lawsuits and viruses.
Downloading pirated software, music, and video, which can lead to copyright violation penalties.
Excessive personal use of the internet at work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Employee carelessness

A

Loss of computers or data media containing sensitive information.
Careless leading to the theft of such information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Malware

A

A generic name for “evil software”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Viruses

A

Programs that attach themselves to legitimate programs on the victim’s computer
Spread today primarily by email
Also by instant messaging, file transfers, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Worms

A

Full programs that do not attach themselves to other programs
Like viruses, can send by email, IM, and file transfers.
Direct-propagation worms can just from one computer to another without human intervention on the receiving computer and can therefore spread extremely rapidly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Blended threats

A

Malware propagates in several ways – like worms, viruses, compromised webpages containing mobile code, etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Payloads

A

Pieces of code that do damage
Implementation by viruses and worms after propagation.
Malicious payloads are design to do heavy damage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Non mobile malware

A

Must be placed on the user’s computer by hackers.
Placed on computer by virus or worm as part of its payload.
The victim can be enticed to download the program.
Mobile code executed on a webpage can download the nonmobile malware

33
Q

Trojan Horses definition

A

A program that replaces an existing system file, taking its name

34
Q

Types of Trojan horses

A

Remote Access Trojans (RATs) – Remotely control the vicim’s PC
Downloaders

35
Q

Downloader (THs)

A

Smal Trojan horses that download larger Trojan horses after the downloader is installed

36
Q

Trojan horses: Spyware

A

Programs that gather information about you and make it available to the adversary.
Cookies that store too much sensitive personal information.
Keystroke loggers.
Password-stealing spyware.
Data mining spyware

37
Q

Trojan horses: Rootkits

A

Take control of the supper user account (root, administrator, etc.).
Can hide themselves from file system detection.
Can hide malware from detection.
Extremely difficult to detect

38
Q

Mobile Code

A

Executable code on a webpage.
Code is executed automatically when webpage is downloaded.
Javascript, etc.

39
Q

Social engineering

A

Social engineering is attempting to trick users into doing something that goes against security policies

40
Q

Types of malware used in social engineering

A

Spam
Phishing
Spear phishing (aimed at individuals or groups)
Hoaxes

41
Q

Traditional hackers

A

Motivated by thrill, validation of skills, sense of power, to increase reputation among other hackers.
Often do damage as a byproduct.
Often engage in petty crime.

42
Q

Anatomy of a hack

A 
Reconnaissance probes
The exploit (specific attack method used)
43
Q

Chain of attack computers

A

attacker goes through a chain of victim computers

44
Q

Denial of Service (DoS) attacks

A

Make a server or network unavailable to legitimate users.

Typically send a flood of attack messages to victim

45
Q

Hacker Skill Levels

A

Expert

Script kiddies

46
Q

PCI-DSS

A

Payment Card Industry-Data Security Standard

Rules for companies that accept credit card purchases

47
Q

Employees and ex-employees are dangerous because:

A

They have knowledge of internal systems
They often have teh permission to access systems
They often know how to avoid detection
Employees generally are trusted
(IT and especially IT security professionals are the greatest employee threats)

48
Q

Employee sabotage

A

Destruction of hardware, software, or data

Plant time bomb or logic bomb on computer

49
Q

Employee hacking

A

hacking is intentionally accessing a computer without AUTHORIZATION or in excess of authorization

50
Q

Employee financial threat

A

Misappropriation of assets

theft of money

51
Q

Employee theft of intellectual property (IP)

A

Copyrights, patents, and trade secrets

52
Q

Employee extortion

A

Perpetrator tries to obtain money or other goods by threatening to take actions that would be against the victim’s interest

53
Q

Employee internet abuse

A

Downloading pornography, which can lead to sexual harassment lawsuits and viruses.
Downloading pirated software, music, and video, which can lead to copyright violation penalties.
Excessive personal use of the internet at work

54
Q

Employee carelessness

A

Loss of computers or data media containing sensitive information.
Careless leading to the theft of such information

55
Q

Malware

A

A generic name for “evil software”

56
Q

Viruses

A

Programs that attach themselves to legitimate programs on the victim’s computer
Spread today primarily by email
Also by instant messaging, file transfers, etc.

57
Q

Worms

A

Full programs that do not attach themselves to other programs
Like viruses, can send by email, IM, and file transfers.
Direct-propagation worms can just from one computer to another without human intervention on the receiving computer and can therefore spread extremely rapidly.

58
Q

Blended threats

A

Malware propagates in several ways – like worms, viruses, compromised webpages containing mobile code, etc.

59
Q

Payloads

A

Pieces of code that do damage
Implementation by viruses and worms after propagation.
Malicious payloads are design to do heavy damage.

60
Q

Non mobile malware

A

Must be placed on the user’s computer by hackers.
Placed on computer by virus or worm as part of its payload.
The victim can be enticed to download the program.
Mobile code executed on a webpage can download the nonmobile malware

61
Q

Trojan Horses definition

A

A program that replaces an existing system file, taking its name

62
Q

Types of Trojan horses

A

Remote Access Trojans (RATs) – Remotely control the vicim’s PC
Downloaders

63
Q

Downloader (THs)

A

Smal Trojan horses that download larger Trojan horses after the downloader is installed

64
Q

Trojan horses: Spyware

A

Programs that gather information about you and make it available to the adversary.
Cookies that store too much sensitive personal information.
Keystroke loggers.
Password-stealing spyware.
Data mining spyware

65
Q

Trojan horses: Rootkits

A

Take control of the supper user account (root, administrator, etc.).
Can hide themselves from file system detection.
Can hide malware from detection.
Extremely difficult to detect

66
Q

Mobile Code

A

Executable code on a webpage.
Code is executed automatically when webpage is downloaded.
Javascript, etc.

67
Q

Social engineering

A

Social engineering is attempting to trick users into doing something that goes against security policies

68
Q

Types of malware used in social engineering

A

Spam
Phishing
Spear phishing (aimed at individuals or groups)
Hoaxes

69
Q

Traditional hackers

A

Motivated by thrill, validation of skills, sense of power, to increase reputation among other hackers.
Often do damage as a byproduct.
Often engage in petty crime.

70
Q

Anatomy of a hack

A 
Reconnaissance probes
The exploit (specific attack method used)
71
Q

Chain of attack computers

A

attacker goes through a chain of victim computers

72
Q

Denial of Service (DoS) attacks

A

Make a server or network unavailable to legitimate users.

Typically send a flood of attack messages to victim

73
Q

Hacker Skill Levels

A

Expert

Script kiddies

74
Q

Federal Trade Commission (FTC)

A

Can punish companies that fail to protect private information

75
Q

MSSPs

A

Managed SEcurity Service Providers

Outsource most IT security functions to the MSSP

76
Q

Risk analysis

A

Goal: reasonable risk
Risk analysis weighs probable cost of compromises vs. cost of countermeasures.
Security has negative side effects that must be weighed: cost, convenience, efficiency

77
Q

Single Loss expectancy (SLE)

A 
Asset Value
Exposure factor (percentage loss in asset value if a compromise occurs)
AV*EF=SLE
78
Q

Annualized Loss Expectancy (ALE)

A

SLE*Annualized rate of occurrence(ARO)

= ALE (expected loss per year from this type of compromise)

MIS 4800 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions