IA Knowledge VI Flashcards
A computer network made up of local-area networks over a large area (e.g., nation or world) using multiple transmission media.
Wide-area network (WAN)
Self-replicating malicious software that can disrupt networks or computers.
Worm
Malicious code that attaches itself to storage media, documents, or executable files and is spread when the files are shared with others.
Virus
Use open Internet protocols and standards to create stand-alone, modular software called services that are capable of describing themselves and integrating with other similar services.
Web services
The combination of transfer protocol, domain name, directory path, and document name.
Uniform Resource Locator
A secure method of connecting two points on the Internet, often run by an Internet service providers.
Virtual private network (VPN)
A type of firewall that enhances packet filtering by monitoring packet flows in general.
Stateful inspection
Process or transaction-level controls that must be in place for management and governance controls to be effective. They are usually specific to a given application but may also control larger technical processes such as system access rights.
Technical controls
Unsolicited bulk e-mail.
Spam
A network topology in which each device is wired to a central device that routes data to or from other devices, eliminating the need to wire between devices.
Star network
A contract between an organization and a software vendor specifying terms of use.
Software license agreement
Making illegal duplicate copies of software or installation of software beyond what is allowed in a license agreement.
Software piracy
A powerful computer with high bandwidth dedicated to a specific task such as providing access to files or managing the common application needs of an organization.
Server
A software system design that allows for sharing of Web services as needed; a service consumer gets Web services from various service providers.
Service-oriented architecture (SOA)
The overall rules for a database.
Schema
The processes an organization puts into place so that security controls and expenditures are fully commensurate with the risks to which the organization is exposed.
Security risk management
The acceptable levels of variation relative to the achievement of objectives.
Risk tolerance
In terms of networking hardware, an intelligent processor that networks devices using protocols.
Router
A database management system that is arranged into two-dimensional files called tables, with links between tables that share a common attribute.
Relational database
A network topology in which the network is arranged in a circle, so two paths for data are available.
Ring network
In a database, a logical grouping of fields.
Record
A hardware control in which each transmitted data element receives an additional bit (character) of data mathematically related to the data; abnormal changes will void the mathematical relationship.
Redundant character check
Automated error checks built into computer processing as well as segregation of duties such as controlling programmers’ access to files and records. They check that data processing tasks are accurate, complete, and valid.
Processing controls
An encryption method in which two keys are created, private and public. The sender places the public key in a directory or an application automatically applies it to lock sent data; to decrypt the data, the private key must be used
Public key encryption
In a database, a unique key field number (i.e., a proper noun) used to identify a specific entity.
Primary key
An encryption method in which a sender creates an encryption key and sends it to a trusted receiver, who can use it to decrypt all messages in that session.
Private key encryption
In terms of networking hardware, a physical connection point to a device
Port
A type of proactive control that deters undesirable events from occurring.
Preventive control
A type of computer network that is a direct connection between two computers.
Peer-to-peer network
The means of preventing access to an asset such as locks and/or key cards preventing access to a building, to data centers, and to key operational areas.
Physical access controls
A type of firewall that compares source and destination addresses to an allowed list, examining headers and other fields in packets of data.
Packet filtering
The installation of released bug fixes to applications that are already in production.
Patch management
Process or transaction-level controls that find errors and verify the accuracy, completeness and validity of output data after processing is complete.
Output controls
A general term describing a logical grouping of data passing through network layers.
Packet
A method of defining how messages should be sent through a network so that unrelated products can work together.
Open Systems Interconnection (OSI) reference model
The software interface between the hardware and the applications and end user.
Operating system (O/S)
Hardware and software systems on a network that analyze incoming packet content, dropping malicious packets.
Network IPS (NIPS)
Software that allows multiple perspectives for a set of data to be analyzed.
Online analytical processing (OLAP)
Networking hardware that combines multiple channels into a single channel, such as multiple phone lines sharing a single physical phone line.
Multiplexer
Used by firewalls with packet filtering and stateful inspection to hide the internal host computer IP addresses from sniffer utilities.
Network address translation (NAT)
IT controls that determine and mitigate risks to critical assets, sensitive data, or operations, including standards, organizational structure, and physical and environmental controls.
Management controls
Type of processing that is halfway between batch and real-time processing. Creates real-time entries that are posted to a temporary memo file (which allows the updated information to be viewed); at a designated time the memo file is batch-processed to update the master file.
Memo posting
A type of computer network for a limited geographical area such as a building.
Local-area network (LAN)
A large computer capable of supporting massive inputs and outputs and many concurrent users.
Mainframe computer
In a database, the field used to identify an entity, such as employee number.
Key field
A type of control that requires data to be entered twice, by different persons if possible, and highlights any differences.
Keystroke verification
An organization that provides connection to the Internet via a TCP/IP (Transmission Control Protocol/Internet Protocol) connection or provides network services (IP network).
Internet service provider (ISP)
An internal network for employees built using thin-client tools, standards, and protocols of the World Wide Web and the Internet.
Intranent
A series of high-capacity trunk lines owned and operated by network service providers (e.g., long-distance telephone companies or governments).
Internet backbone
Numeric address for a specific computer located on the Internet, e.g., 128.6.13.42.
Internet protocol (IP) address
A process designed to provide reasonable assurance regarding the achievement of objectives in the categories of effectiveness and efficiency of operations, reliability of financial reporting, and compliance with applicable laws and regulations.
Internal control
A network of networks that have devoted a portion of their processing power and data to public use.
Internet
A type of control intended to prevent computer errors by controlling data as it manually or electronically enters the system.
Input controls
A type of control that tracks all read-only access to records.
Inquiry log
The illegal use of sensitive information to impersonate an individual over computer networks in order to defraud the person or commit a crime without the perpetrator’s true identity being known.
Identity theft
The risk that inaccurate information is used to make a business decision.
Information risk
Regular and encrypted versions of the communications standard for Internet message formatting and transmission.
HTTP/HTTPS (Hypertext Transfer Protocol/Secure HTTP)
In terms of networking hardware, a port switching communications device.
Hub
Entity-level IT controls that applies generally to the IT environment or overall mix of systems, networks, data, people, and processes.
General control
Software that functions at the operating system kernel level to detect and block abnormal application behavior before it executes.
Host IPS (HIPS)
Networking hardware that connects networks with dissimilar architectures.
Gateway
A type of firewall that stops traffic flowing to a specific application such as File Transfer Protocol.
Gateway firewall
A hardware/software combination that routes all communications to or from the outside world through it, blocking unauthorized traffic.
Firewall
A type of control that checks to see that data is entered in an acceptable format.
Format check
In a database, a collection of related records.
File
Allows transfer of large files between computers on a network or the Internet.
File Transfer Protocol (FTP)
In a database, a business object such as a name or an asset.
Field
A type of control that involves a check to see if information in an entry field is complete.
Field check
A network that is similar to an intranet but is designed for customers, external partners, or suppliers.
Extranet
Components that have redundancies in hardware or software to allow continued operations if a system fails.
Fault-tolerant components
In a database, a record that relates to a person, place, or thing.
Entity
Software systems that capture the knowledge of a professional using a series of decision points; used to automate complex situations requiring judgment, such as the probability of loan default.
Expert systems
A portfolio of technologies that help disparate applications communicate.
Enterprise application integration (EAI)
Modular suites of business applications that share data between modules seamlessly and store all data in a single repository.
Enterprise resource planning (ERP) systems
A type of control that involves automated tests on data fields.
Edit check
Use of a mathematical algorithm to scramble data so that it cannot be unscrambled without a numeric key code.
Encryption
A hardware control in which a process is done twice and compared.
Duplicate process check
A hardware control in which received data is returned to the sender for comparison.
Echo check
A hierarchical server network that maintains the domain names for conversion to IP addresses.
Domain name system (DNS)
An input/output node for a mainframe system, consisting of either just a display and entry devices or a PC running terminal emulation software.
Dumb terminal
Uses public key encryption and a hashing algorithm (information about the transmitted data) to prevent an original message from being reconstructed.
Digital signature
A plain language label referring to a numeric IP address.
Domain name
An application that links users and programs to a database and allows the database to be manipulated by multiple applications.
Database management system (DBMS)
A broad category of software systems designed not to make decisions but to enhance information available to management in making decisions.
Decision support systems (DSS)
Database designed to collect the information from one or more transactional databases for purposes of multiyear storage of records and reporting.
Data warehouse
Any repository of data in a computer system.
Database
A user-friendly method of querying a database for information.
Data query language
An input/output node for a mainframe system, consisting of either just a display and entry devices or a PC running terminal emulation software.
Data terminal
A language that has commands for viewing or changing a database.
Data manipulation language
The capability of sifting through and analyzing large volumes of data to find certain patterns or associations.
Data mining
A master record concerning the data in a database.
Data dictionary
In a database, the specific data in fields.
Data items
The removal of redundancies and errors in a database.
Data cleansing
Describes the data and the relationships between data in a database, including logical access paths and records.
Data definition language
Files intended to be accessible only by the creator that are used to store data about a user’s preferences.
Cookies
IT controls that are used once errors, fraud, or other control issues have been detected. These are designed to allow manual or automated correction of errors or irregularities discovered by detective controls.
Corrective controls
A computer network formed by a group of organizations to assist in intercommunications.
Consortium network
A system of internal controls for managing the availability of computer and other resources and data after a processing disruption.
Contingency planning
A network architecture that uses servers for specialized functions; clients (the recipients of these functions) are PCs that send requests to the servers.
Client/server architecture
The sum of all infrastructure and applications required to connect two or more network nodes (computers and devices).
Computer network
Any alphanumeric key; the item that is second-lowest in the database hierarchy.
Character
A type of control in which an extra digit is added that has an algorithmic relationship to the remaining digits to show if the number was incorrectly entered such as by transposition.
Check digits
A network topology that has a main line (bus); all devices are connected to the line.
Bus network
A set of processes developed for the entire enterprise, outlining the actions to be taken by the information technology (IT) organization, executive staff, and various business units in order to quickly resume operations in the event of a business disruption or service outage.
Business continuity plan
A binary digit; the item that is lowest in the database hierarchy.
Bit
Networking hardware that connects two or more LANs with similar architectures.
Bridge
In a database, fields relating to entities.
Attributes
A type of processing that accumulates data changes until a set time and then releases them to the database.
Batch processing
An IT control related to the specific functioning of an application system that supports a specific business process.
Application control
A type of firewall that serves as an intermediary for communications between the external world and private internal servers; intercepts external packets and, after inspection, relays a version of the information, called a proxy, to the private server, and vice versa.
Application gateway/proxy server
