Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Management Information Systems > Exam 4: Chapter 4- Information Security > Flashcards

Exam 4: Chapter 4- Information Security Flashcards

1
Q

the degree of protection against criminal activity, danger, damage, or loss.

A

security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

all of the processes and policies designed to protect an organization’s information and information systems (IS) from unauthorized access, use, disclosure, disruption, modification, or destruction.

A

information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

any danger to which a system may be exposed.

A

Threat (to an information resource)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

the harm, loss, or damage that can result if a threat compromises that resource.

A

Exposure (of an information resource)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

the possibility that a threat will harm that resource.

A

Vulnerability (of an information resource)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 5 key factors contributing to the increasing vulnerability of organizational information resources?

A
  1. Today’s interconnected, interdependent, wirelessly networked business environment.
  2. Smaller, faster, cheaper computers and storage devices
  3. Decreasing skills necessary to be a computer hacker
  4. International organized crime taking over cybercrime
  5. Lack of management support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

any network within your organization

A

trusted network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

any network external to your organization.

A

untrusted network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

________ _________ enable employees to compute, communicate, and access the Internet anywhere and at any time.

A

wireless technologies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

__________ is an inherently unsecure broadcast communications medium.

A

wireless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

users with limited skills can download and use to attack any information system that is connected to the Internet.

A

scripts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

illegal activities conducted over computer networks, particularly the Internet.

A

cybercrime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

T or F: cybercrimes are typically nonviolent; however, they are quite lucrative. Losses from computer crimes can average hundreds of thousands of dollars. Computer crimes can be committed from anywhere in the world at any time, effectively providing an international safe haven for cybercriminals.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the 2 major categories of threats?

A

Unintentional and deliberate threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

acts performed without malicious intent that nevertheless represent a serious threat to information security. A major category of this is human error.

A

unintentional threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

the higher the level of employee, the (smaller/greater) the threat he or she poses to information security

A

greater

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Employees in two areas of the organization pose especially significant threats to information security:
Why are these two significant threats?

A
  • human resources and information systems
  • H.R. employees generally have access to sensitive personal information about all employees.
  • IS employees not only have access to sensitive organizational data, but they also frequently control the means to create, store, transmit, and modify those data.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are 3 other relevant employees in regard to information security?

A
  1. Contract labor (such as temporary hires)
  2. Consultants
  3. Janitors and guards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords.

A

social engineering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are 2 social engineering techniques?

A

Tailgating and shoulder surfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

a technique designed to allow the perpetrator to enter restricted areas that are controlled with locks or card entry. The perpetrator follows closely behind a legitimate employee and, when the employee gains entry, the attacker asks him or her to “hold the door.”

A

tailgating

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

occurs when a perpetrator watches an employee’s computer screen over the employee’s shoulder. This technique is particularly successful in public areas such as in airports and on commuter trains and airplanes.

A

shoulder surfing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are 10 common types of deliberate attacks?

A
  1. Espionage or trespass
  2. Information extortion
  3. Sabotage or vandalism
  4. Theft of equipment/information
  5. Identity theft
  6. Compromises to intellectual property
  7. Software attacks
  8. Alien software
  9. SCADA attacks
  10. Cyberterrorism and cyberwarfare
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

occurs when an unauthorized individual attempts to gain illegal access to organizational information

A

espionage or trespass

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

occurs when an attacker either threatens to steal, or actually steals, information from a company. The perpetrator demands payment for not stealing the information, for returning stolen information, or for agreeing not to disclose the information

A

information extortion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

An increasingly serious type of information extortion is _________.

A

ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

blocks access to a computer system or encrypts an organization’s data until the organization pays a sum of money. Victims are told to pay the ransom, usually in Bitcoin. Attackers typically use the anonymizing Tor network.

A

ransomware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Most commonly, ransomware attacks use _____ ______ and _______ attacks. These emails are carefully tailored to look as convincing as possible.

A

sphear phishing; whaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Some ransomware developers distribute ransomware to any hacker who wants to use it. This process is called

A

ransomware-as-a-service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Rather than threatening to delete encrypted data, some cybercriminals are beginning to threaten to release it to the public, a strategy known as

A

doxxing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the 5 things to do to protect against ransomware?

A
  1. all organizations must provide education and training
  2. Organizations must install the latest versions of software and apply patches immediately.
  3. Organizations must back up crucial data and information often
  4. Organizations should employ anti-ransomware software.
  5. Organizations should utilize the No More Ransom initiative
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

deliberate acts that involve defacing an organization’s website, potentially damaging the organization’s image and causing its customers to lose faith.

A

sabotage or vandalism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

T or F: not all attacks on organizations involve sophisticated software.

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

a form of theft that involves rummaging through commercial or residential trash to find discarded information

A

dumpster diving

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

the deliberate assumption of another person’s identity, usually to gain access to his or her financial information or to frame him or her for a crime.

A

identity theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

T or F: Recovering from identity theft is costly, time consuming, and burdensome.

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

the property created by individuals or corporations that is protected under trade secret, patent, and copyright laws.

A

intellectual property

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

an intellectual work, such as a business plan, that is a company secret and is not based on public information. (ex: formula for Coca Cola)

A

trade secret

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

an official document that grants the holder exclusive rights on an invention or a process for a specified period of time.

A

patent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

a statutory grant that provides the creators or owners of intellectual property with ownership of the property, also for a designated period.

A

copyright

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Current U.S. laws award patents for ____ years and copyright protection for the life of the creator plus ____ years. Owners are entitled to collect fees from anyone who wants to copy their creations.

A

20; 70

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

The most common intellectual property related to IT deals with _________.

A

software

43
Q

copying a software program without making payment to the owner—including giving a disc to a friend to install on his or her computer

A

piracy

44
Q

Software attacks have evolved from the early years of the computer era, when attackers used malicious software—called ________—to infect as many computers worldwide as possible, to the profit-driven, Web-based attacks of today.

A

malware

45
Q

T or F: Not all cybercriminals are sophisticated.

A

true

46
Q

segment of computer code that performs malicious actions by attaching to another computer program

A

virus

47
Q

segment of computer code that modifies itself (ex: changes its computer code) to avoid detection by anti-malware systems, while keeping its same functionality

A

polymorphic virus

48
Q

segment of computer code that performs malicious actions and will replicate, or spread, by itself (without requiring another computer program)

A

worm

49
Q

attacks that use deception to acquire sensitive personal information by masquerading as official looking emails or instant messages

A

phishing attack

50
Q

phishing attacks target large groups of people. In these phishing attacks, the attackers find out as much information about an individual as possible to improve their chances that phishing techniques will be successful and obtain sensitive, personal information.

A

spear phishing

51
Q

attack that targets high-value individuals such as senior executives in an attempt to steal sensitive information from a company such as financial data or personal details about employees

A

whaling attack

52
Q

an attacker sends so many information requests to a target computer system that the target cannot manage them successfully and typically ceases to function (crashes)

A

denial-of-service attack

53
Q

an attacker first takes over many computers, typically by using malicious software. These computers are called zombies or bots. The attacker uses these bots—which form a botnet—to deliver a coordinated stream of information requests to a target computer, causing it to crash.

A

Distributed denial-of-service attack

54
Q

Software programs that hide in other computer programs and reveal their designed behavior only when they are activated.

A

trojan horse

55
Q

Typically a password, known only to the attacker, that allows him or her to access a computer system at will, without having to go through any security procedures (also called a trap door)

A

back door

56
Q

A segment of computer code that is embedded within an organization’s existing computer programs and is designed to activate and perform a destructive action at a certain time or date

A

logic bomb

57
Q

clandestine software that is installed on your computer through duplicitous methods. It typically isn’t as malicious as viruses, worms, or Trojan horses, but it does use up valuable system resources. It can also enable other parties to track your Web surfing habits and other personal behaviors

A

alien software (or pestware)

58
Q

The vast majority of pestware is _______

A

adware

59
Q

software that causes pop-up advertisements to appear on your screen; common because it works

A

adware

60
Q

software that collects personal information about users without their consent.

A

spyware

61
Q

3 common types of spyware:

A
  1. stalkerware
  2. keystroke loggers
  3. screen scrapers
62
Q

spyware used to monitor people close to the perpetrator. Victims typically don’t know it is on their device unless they run an antivirus scan. Developers of this market their apps as child safety or anti-theft tools. However, these apps can easily be used for the purpose of spying on a partner.

A

stalkerware

63
Q

record both your individual keystrokes and your Web browsing history. The purposes range from criminal—for example, theft of passwords and sensitive personal information such as credit card numbers—to annoying—for example, recording your Internet search history for targeted advertising.

A

keystroke loggers (or keyloggers)

64
Q

How have companies attempted to counter keyloggers?

A

By using CAPTCHA

65
Q

software that records a continuous “movie” of a screen’s contents rather than simply recording keystrokes.

A

screen scrapers (screen grabbers)

66
Q

pestware that uses your computer as a launch pad for spammers.

A

spamware

67
Q

unsolicited email, usually advertising for products and services.

A

spam

68
Q

T or F: Spam wastes time and money; costs U.S. companies billions of dollars every year.

A

True

69
Q

small amounts of information that websites store on your computer, temporarily or more or less permanently. In many cases, they are useful and innocuous.

A

cookies

70
Q

can be used to track your path through a website, the time you spend there, what links you click on, and other details that the company wants to record, usually for marketing purposes. They can also combine this information with your name, purchases, credit card information, and other personal data to develop an intrusive profile of your spending habits.

A

tracking cookies

71
Q

a large-scale distributed measurement and control system.

A

SCADA

72
Q

used to monitor or to control chemical, physical, and transport processes such as those used in oil refineries, water and sewage treatment plants, electrical generators, and nuclear power plants; provide a link between the physical world and the electronic world.

A

SCADA systems

73
Q

malicious acts in which attackers use a target’s computer systems, particularly through the Internet, to cause physical, real-world harm or severe disruption, often to carry out a political agenda. These actions range from gathering data to attacking critical infrastructure; for example, through SCADA systems.

A

cyberterrorism/cyberwarfare

74
Q

Which describes cyberterrorism and which describes cyberwarfare?
1. typically carried out by individuals or groups
2. carried out by nation-states or non-state actors such as terrorists.

A
  1. cyberterrorism
  2. cyberwarfare
75
Q

T or F: IT security is the business of everyone in an organization.

A

true

76
Q

the probability that a threat will impact an information resource.

A

risk

77
Q

The goal of _______ _______ is to identify, control, and minimize the impact of threats. In other words, it seeks to reduce risk to acceptable levels.

A

risk management

78
Q

What are the 3 types of Information Security controls?

A
  1. Physical controls
  2. Access controls
  3. Communications (network controls)
79
Q

What are the two parts of access controls?

A
  1. Authentification (identification)
  2. Authorization
80
Q

Security is almost all (good/bad) news; the bad guys only have to be right ____ time and the good guys (defenders) have to be right _____ time.

A

bad; one; every

81
Q

T or F: Cybersecurity people make a lot of money, but it is a very difficult proposition.

A

True

82
Q

As computer code software has gotten more complex, the number of errors that bad guys can exploit (increase/decrease).

A

increase

83
Q

Unfortunately, we are almost totally _______, not proactive.

A

reactive

84
Q

People are backing up their data now in ____ _____. To backup your data, you’ve got to back it up in almost real time, which connects your backup with your main site. The issue is: the bad guys know this, so they encrypt both.

A

hot sites

85
Q

an off-premises location where an organization can resume normal operations during a commercial disaster. All the equipment needed for the work to resume is available there, including phones, backup data, and computers.

A

hot site

86
Q

A backup facility that has the necessary electrical and physical components of a computer facility, but does not have the computer equipment in place.

A

cold site

87
Q

consists of elements providing power, networking capability, and cooling. It doesn’t include other hardware elements such as servers and storage.

A

cold site

88
Q

T or F: Using a cold site is very limiting to a business since before it can be used, backup data and some additional hardware must be sent to the site and installed

A

true

89
Q

contain all the elements of a cold site while adding additional elements, including storage hardware such as tape or disk drives, servers, and switches. Warm sites are “ready to go” in one sense, but they still need to have data transported for use in recovery should a disaster occur

A

warm sites

90
Q

Who drives the process of risk optimization?

A

You

91
Q

As security increase, productivity (decreases/increases)

A

decreases

92
Q

SCADA attacks are ________ attacks

A

infrastructure

93
Q

T or F: SCADA systems are critical

A

true

94
Q

Cyber crime is being taken over by the _______

A

cartel

95
Q

Most ransomeware attacks come from _________

A

Russia

96
Q

What is the biggest white collar theft right now?

A

Identity theft

97
Q

What is the cheapest software attack? Most expensive?

A
  • Cheapeast= cyberwarfare
  • Most expensive = nuclear
98
Q

T or F: Risk analysis is the MIS’s job.

A

False; it is YOUR job

99
Q

What are the 4 steps of risk management?

A
  1. Risk
  2. Risk management
  3. Risk analysis
  4. Risk Mitigation
100
Q

What are 3 ways to avoid risk (aka risk mitigation)?

A
  1. Risk acceptance (not rlly used anymore)
  2. Risk limitation (control measures)
  3. Risk transference (insurance)
101
Q

T or F: risk optimization has nothing to do with MIS

A

True

102
Q

Less potential loss = spending (less/more) on countermeasures

A

more

103
Q

Who handles communication controls?

A

MIS

Management Information Systems (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions