Inf Sec Flashcards
A property right granted to an inventor to exclude others from making, using, offering for sale, or selling the invention for a limited time is called a
Patent
What factors should be considered when using the internet to link organization offices?
Confidentiality, Integrity, and Availability
Which of the following fields involves defences against the interception of data communication from microphones transmitters or wiretaps?
Transmission security
In protecting information assists, an effective protection strategy begins with:
A clear, practical policy that is shared with all relevant parties and enforced with fairness.
What is the key organizational asset?
Information
What are the key steps that can be taken after an information loss?
1 - Investigation
2 - Damage, assessment
3 - Recovery and follow-up
What is application security?
Modern business applications typically consist of custom code, third-party software, and one or more servers. Improper integration of these components can result in a vulnerability that can later be exploited to gain unauthorized access to data.
What an intrusion detection system can monitor
1 - Malicious programs,
2 - Unauthorized changes to files and settings
What is the most effective IT protection?
Most effective IT protection is a layered approach that integrates
1 - Physical measures
2 - Procedural measure
3 - Logical protection measures
What are the elements of technical surveillance countermeasures?
Services
Equipment and
Techniques.
Who should execute an NDA as a condition of employment in the organization?
All employees should execute an NDA as a condition of employment
When information can be said trade secret?
For information to be trade secret, the owner must be able to prove that,
1 - Information added value or benefit to the owner
2 - The trade secret was significantly identified
3 - The owner provided a reasonable level of protection for the trade secret
What is the fundamental difference between patent and trade secret?
Patent require that the inventor publicly disclose the inventions elements and a patent lasts only 20 years.
Conversely a trade secret is not disclosed and may last indefinitely.
Why it is essential to register the trade marks before the product enters the stream of commerce in any country
Because it is the primary means of ensuring that mark is eligible for before the product enters the stream of commerce protection under that country’s law and ensuring that trademark infringement can be remedied through administrative or judicial proceedings.
What is the best way to start addressing infringement of patents, copyrights and trademarks?
The best way to start addressing infringement of patents, copyrights and trademarks is to register those rights
Which type of facts are respond by operations security?
Operations security responds to the fact that small bits of information taken from several different sources can be combined to reveal sensitive information.
Operations security is used to protect which type of information?
To protect unclassified information.
How an organization can ensure that critical information retains its availability, confidentiality, and integrity during all phases of crisis situations including response and recovery?
By incorporating information asset protection program into the organization’s business continuity plan.
Personnel security plays a key role in information asset protection program. What matters includes in personnel security to protect information assets?
Due diligence investigations of potential partners, standard pre employment screening, and vetting of subcontractors, vendors, and consultants.
Based on what, an employee’s access to information assets should be determined?
An employee’s access should be based on his or her current job function and need to know, not solely on position or management level.
Who typically determines the classification level of information asset?
The originator of the information.
What must be ensured by the protection measures to protect security?
The protection measures (the physical and cyber environment) must be sufficient to ensure confidentiality, integrity, availability, accountability, recoverability, auditability, non- repudiation of information in both the physical and cyber environment
How all the information in the organization need to be evaluated
All information needs to be appropriately evaluated for sensitivity
What should clarify that information is one of the organization’s most important resources?
The policy of the organization
While developing information asset protection policies and awareness what is important?
It is important to identify what information should be and protected and when, and then identify the many forms this information may take over its life cycle.
In the organization who can influence security most and why?
The first-and second-tier management and because the managers who see employees every day are the ones who will actually be there to notice when people are following security practices and when they are not.
Who is ultimately responsible for protecting information assets in the organization?
Ultimately the responsibility for protecting information assets rests with the leadership of an organization.
What are the purposes of information risk assessment
Risk assessment should identify risks, quantify them, and prioritize them according to the organization’s criteria for risk acceptance.
How, in 80 percent of the cases, the perpetrator of information assets comes to the attention of management?
The perpetrator come to the attention of management due to inappropriate behaviors before the incident (e.g; tardiness, truancy, arguments with coworkers, or poor job performance)
What are the elements basically have converged to create unusually fertile ground for insider espionage?
Elements that create fertile ground for insider espionage due to information revolution, global economic competition, the involvement of new and non-traditional intelligence adversaries, other changes in the domestic and international environment.
What are the causes for inadvertent threats?
Inadvertent threats can be attributed to inadequate employee training, misunderstandings, lack of attention to details, lax security enforcement, pressure to produce a deliverable, insufficient staffing etc
From whom basically the largest losses of information come?
The largest losses basically are from the people in the mirror, people make mistake, and those mistakes are the most likely thing to hurt.
What is the most frequently overlooked threats?
The most frequently overlooked threats are inadvertent threats
What need to be done to assess intentional threats?
To assess intentional threats need to identify
1 - Potential adversaries
2 - Evaluates their capability
3 - Intention to target key information assets.
What are the types of threats for information assets?
Types of threats for information assets may include:
1 - Intentional threats
2 - Natural threats
3 - Inadvertent threats
What is the goal of information security program?
The goal of information security program is to optimize risk, never minimize.
Which of the following is one step in the risk assessment process for use in protecting information?
Identifying information assets
According to the existing trends of security problems, what is one of the most serious economic and national security challenges for US?
Cyber threat is one of the most serious economic and national security.
When a person who can control the computer linked with access control system, what kind of change is possible to make?
A person who can control the computer can create two dangers:
1 - A valid administrator could add a backdoor or additional card
2 - The system may be accessible to the internet
What is the weakness of HID cards
When card reader requests an identification number to the card, the card simply supplies without verification of authenticity.
What is phishing?
When an outsiders who gain insider privileges in extracting information
To combat cyber-attacks what is required
Effectively combating cyber-attacks requires:
1 - Increased awareness
2 - New technology
3 - And improved response and recovery capabilities
When an information security system is dependent on internet, hackers can exploit the system by using different forms of attacks. What are those forms of attack?
Hackers make attacks by using worms, viruses, network flooding, no-notice attacks through compromised routers, spyware, insider attacks, data ex-filtration by outsiders who gain insider privileges(phishing), and distributed denial of service attacks are all commonplace
What are the additional risks created by convergence?
Convergence creates significant additional risk to the organization because the physical security devices are now accessible from anywhere on the network
What is security convergence?
Security convergence is the integration. in a formal, collaborative, and strategic manner, of the cumulative security resources of the organization in order to deliver enterprise-wide benefits through enhanced risk mitigation, increased operational effectiveness and efficiency, and cost savings
What are the seven critical success factors that an information security standard of care must meet?
1- Executive management responsibility
2- Information security policy
3- User awareness training and education
4- Computer and network security
5- Third- party information security assurance
6- Physical and personnel security
7- Periodic risk assessment.
The objective of ISS program is to prudently and cost-effectively manage the risk that critical information in three forms of protection and what are those forms?
Not compromised-confidentiality; remain unchanged without authorization- integrity; remains available-Availability
What is “Rogueware
Rogueware, or software that pretends to be security software but really compromise a computer, is also on the rise. Cybercriminals are doing this job by getting users to download this malicious software
What kind of attack can circumvent signature-based controls?
Malware attack
How successful breaches of information occur in the organization
When someone is able to take advantage of an error committed by the victim and installed malware to take advantage of it
Which kind of criminal group poses the greater threat to corporate information systems?
Organized criminal groups pose the greater threat to corporate information systems because this group can organize their funds to conduct their attack
What factors are promoting cyber¬-attacks
The factors that are promoting cyber-attack are: Cybercriminals do not need to change their malware as quickly but can implement it on more sites; they can use the automated techniques that continually compromise legitimate web sites; moreover, they can change malware code so it is not detected by traditional antivirus system.
What is the purpose of bots
Bots (software applications that run automated tasks) under the control of the hackers to bring the site down
Why sanitized code is used
Sanitized code used in a penetration test to obtain Social Security Numbers and other sensitive information from a supposedly database
How security professional should augment their physical security to address the challenges of information systems security?
To address the challenges of ISS, security professional must augment their physical security paradigm with a new logical security paradigm
In relation to the information systems security (ISS), the security professional strives to protect what?
The security professional strives to protect CIA triangle:
1‐ Confidentiality
2‐Integrity
3‐ Availability
What is the difference between residual threat risk and residual risk
Residual Threat Risk for each threat, the remaining potential risk after all ISS counter measures are applied and Residual Risk , the total remaining potential risk after all ISS countermeasures are applied across all threats
What types of threat agents exist with information systems security
Information system threats agents are :
1- Natural
2- People
3- Virtual
In relation to the virtual threat, a computer program or script can be illegitimately installed on a workstation, server, router or other information systems device and capable of doing what types of activities?
A computer program or script illegitimately installed on a workstation, server, router or other information systems device and capable of any or all of the following:
1 -Sending information from the device on which it is installed to the owner of the program (its control),
2- Receiving command and control instructions from its control and adjusting its behavior accordingly,
3- Executing commands on the device on which it is installed
Before using a virtual threat agent, a cybercriminal or other perpetrator must get in onto a target computer. What types of methods they may use?
Methods include
1- Direct physical access to the computer (via USB drive or cybercriminal or other perpetrator must other peripheral)
2- Hacking into the computer remotely
3- Placing malware on the computer
4- Phishing
5- Engineering.
What are the broad categories you can break Information systems security
1- Vulnerabilities in the information systems infrastructure
2- Vulnerabilities in people using the information systems infrastructure(Users)
3- Vulnerabilities in people maintaining the information systems infrastructure (custodians)
4- Executive and senior management vulnerabilities
5- Vulnerabilities in information systems management processes
Before outlining the range of countermeasures available for managing residual information system risk, what is important to specify?
It is important to specify the ISS control objectives that those counter measures must meet
What are the broad categories to divide Information systems countermeasures
Information system countermeasures divided into three broad classifications:
1‐ Administrative control
2‐ Technical controls
3‐ Physical controls
What is perhaps most important in information security
Perhaps most important in information security, as in physical security is to have the buy‐in of executive management in supporting security initiatives
What are the layers OSI model consisting?
The seven layers of the OSI model are:
1‐ Physical(layer‐1)
2‐ Data link (layer‐2)
3‐ Network(layer‐3)
4‐ Transport(layer‐4)
5‐ Session(layer‐5)
6‐ Presentation(layer‐6)
7‐ Application(layer‐7)
Which of the OSI layers was developed so that computers that could not immediately see each other could nevertheless still communicate?
In OSI (open system Interconnect) layer 3, computers that could not immediately see each other could nevertheless still communicate.
In OSI layer 3, with the help of which equipment, computers can communicate to each other’s though they cannot see each others?
The computer device called “router” allows for this communication to happen.
What do you understand by buffer overflow?
It is a form of attack. In this instance, a malicious user or program can give more information to the computer program that it is expecting. The extra words or characters can produce a buffer overflow state, giving the computer instructions to do something unintended
What is the third element of the AAA triad?
This process of authentication and authorization is part of what is called the AAA triad. The third part of this triad is auditing/accountability.
Apart from AAA, how else is data confidentiality can be maintained?
Apart from AAA, data confidentiality can be maintained through encryption and system protection
Explain the difference between authentication and authorization
(From any source) Authentication means examining identification of user who seeks to gain access to computer by asking for a user name and password. Authorization means, after identifying a user, the Computer checks a data base to see what type of authorization that particular user has. This process particularly allows the user to avail his/her rights as per the level of access of information predetermined by organization’s policy.
What are the different approaches can be applied beyond the user name and password to make authentication process more difficult for increasing the security of data?
Biometric authentication; second‐factor authentication (one time password); encryption
While designing an information system, why it is important to include redundancy system in it?
Because redundancy aids the efforts to ensure data availability and also ensure continuity.
If a company is truly concerned about the security of its data, over the open internet or within a more private network, what technology can be used?
The technology called virtual private network (VPN), can be used which encrypts data from one point to another.
What do you understand by “an escalation of privileges” attack?
“Escalation of privilege” is basically a specially crafted e-mail based attack which enables the mail system to do something undesirable to the recipient. This type of attack succeed because the email program is tricked into executing the e-mail as if it were a program rather than a simply processing it as text.
Despite of a number of advantages of VOIP system, what is the security downside?
In the VOIP system, every phone and every phone and server hosting phone-related information, including voicemail and the actual phone calls in progress, have potential to be compromised as these systems are completely accessible on the framework.
What is a critical aspect of any information security program?
Third-party review is a critical aspect of any information security program. Each organization is responsible for managing its vendors and ensuring that they come up to a specific level
What is the fundamental difference between IDS and IPS?
Intrusion detection (IDS) is designed to monitor one’s network and attempt and to interpret either via behavior or pattern/signatures whether someone is trying to attack the system. An intrusion prevention system (IPS), which is designed to automatically stop an attack in progress.
What is ISO 27001 and into what 11 domains is it broken down?
The ISO 27001 is an international standard for managing information security.
This standard is broken down into 11 domains which are:
1‐Security policy
2‐Organization of information security
3‐Asset management
4‐Human resource security
5‐Physical and environmental security
6‐ Communications and operations management
7‐Access control
8‐Information system acquisition, development and management
9‐Information security incident management
10‐Business continuity management
11‐Compliance.
What is the center piece of ISO27001
The center piece of ISO 27001 is its concept of ISMS
What is the three basic pillar of information security?
Integrity, non‐repudiation and confidentiality
What is the purpose of program developed based on “red flag rules”?
Early detection and prevention of identity theft
What is the biggest challenge for management in relation to the ISS policy implementation?
Management’s biggest challenges lies not in the writing of specific ISS policies but in the orderly development and implementation of policies
The effectiveness of an information security program ultimately depends upon depends on what?
Depends upon people’s behavior
An employee’s access to information should be based on what criteria
Their current job function and “need-to-know.”
In the context of information asset protection, “sanitizing” is the process of:
Removing data on the media before the media is reused
Which of the following can be used to authenticate and authorize computer access?
What a person has/what a person knows/who a person is
Original works in the form of books, magazines, musical scores, movies, and computer software programs are protected by a:
Copyright
How does a host intrusion prevention system (HIPS) differ from an intrusion detection system (IDS)?
HIPS operates on a host system, such as a computer or server
A password cracking attempt that systematically tries every possible combination of letters and number is referred to as a:
Brute force attack
A software program that performs a useful purpose but also has a hidden destructive purpose is known as a:
Trojan horse
Which of the following fields involves defences against the interception of data communication from microphones transmitters or wiretaps?
Transmission security
When preparing for a technical surveillance countermeasures (TSCM) inspection, it is not necessary to determine the:
Height of the building
The first step in keeping sensitive information secure to.
Classify it according to its value
In a theft of proprietary information case, which of the following steps is most important to the security manager?
The information was patented, trademarked, or copyrighted
Which of the following is one step in the risk assessment process for use in protecting information?
Identifying information assets
The first step in securing sensitive information is to
Identify it and classify it by value.
One step for harmonizing information asset protection (IAP) and general business practices is to:
Communicate IAP issues to all elements of management
The ISO 27001 and ISO 27002 standards are important for the information system security (ISS) practitioner
Represent the first acknowledged worldwide standards to identify a code of practice for the management of information security.
Why it is important to encrypt the video stream regarding video cameras in the network?
To ensure that whatever credentials are passed between a workstation and the device, they cannot be easily stolen off the network. Otherwise, the organization may face one of these familiar issues: denial of services, insertion of inaccurate data, data theft, data modification, and data destruction.
Based on the present context of cyber security, it is not recommended to allow a legitimate user to access video or access control data at a distance with only user name and password. To ensure greater protection of data what corporate ISS policies should prohibit?
Corporate ISS policies should prohibit accessing into network without using second‐factor authentication
When a converged IP‐based access control system is vulnerable to viruses and Trojans?
In a converged IP‐based across control system is vulnerably to viruses and Trojans because if control system, not placing antivirus or other host protection software on the machine that runs the system could leave it susceptible to compromise or failure.
What kind of causes could arise while upgrading a video camera within a network?
Upgrading a video camera could cause a broadcast storm on the network due to a bug in the camera, causing not only that video camera but also other systems to stop working.
What kind of inconveniences we might face with IP‐CCTV systems in locations where power supply is not consistently reliable or fluctuate?
If power supply is not consistently, which might cause to leave an organization’s video system down during the restart because computer‐based systems make take unexpectedly long to start up and shut down.
As part of ISS organization, before providing access to a third party to an organization’s data, what process must complete to protect own security?
When using 3rd party delivery services, ISS professional need to ensure that organization is protected by making sure that provider must adhere to the organization’s policies. Besides, a vetting process can be carried out before allowing access to an organization’s data.
Why physical security professional to work in collaborate with the ISS department?
It is critical for the physical security professional to collaborate with the ISS department to ensure that physical security is a good ISS partner and complies with policies and procedures.
What is the first job of the individual charged with an organization’s ISS?
The first job of the individual charged with an organization’s ISS is to create ISMS appropriate for the size of the organization
What is the difference between how physical security managers and ISS professionals mitigate risk?
Physical security professionals mitigate risk via policies, references and frameworks. On the other hand, ISS professionals mitigate risk through an information security management system(ISMS).
How a malware attack takes place while simply visiting a website?
In case of web attack, when users are accessing the web they can pick up malware simply by going to a compromised web and malware introduction on to the network cannot be blocked by VPN because web attack can defeat every control.
Why a web attack is particularly dangerous?
Because it can defeat almost every control
Why is a malware attack particularly insidious?
This is because malware has been designed to be primarily silent. The longer the hackers can stay in stealth mode, owning an organization system stealing its information, the more they have time to gain. Etc
How even a completely “patched” and up‐to‐date system still is possible to be compromised?
An engineer could configure the system incorrectly or make an architectural mistake, such as plugging an internal server into as witch that is accessible via the internet.
How a hacker can launch an attack against a converged IP‐based video protection system?
Hackers may start by checking a readily accessible website. If, via social engineering they can steal a username and password to gain access, they will. If this is not possible, they might use a brute force password cracker that enables them to try many passwords very quickly.
How malware attack can be launched in the network?
Someone attacks a system by installing software on it, either with the user’s knowledge (usually hidden in other software or e‐mail)or automatically, without the user’s knowledge
What is social engineering?
Social engineering is the manipulation of people to get them to do something that weakens the security of the networks
Why does communication at the layer 3 level increase risk in converged access control system?
Layer3 or indirect communication is the mechanism that allows for computers to interact across the internet globally. In a converged paradigm, an organizations computers and physical security assets are potentially accessible from across the world‐therefore vulnerable to attacks.
How physical security practitioners should categories ISS risk to address the security risks brought on by convergence?
According to the CIA triad
Security convergence can indeed enhance risk mitigation, but it can also increase total organizational risk. If it is so, give examples of risks?
When physical security practitioners put physical security technology onto the network, they open the door to significant network‐based security risk. Some elements of information systems security (ISS) can weaken the physical security. These are: 1‐ denial of service (DOS), 2‐ insertion of inaccurate data, 3‐data theft, 4‐ data modification, 5‐ data destruction
How to define convergence?
Convergence is the integration, in a formal, collaborative, and strategic manner of the cumulative security resources of the organization in order to deliver enterprise-wide benefits through enhanced risk mitigation, increased operational effectiveness and efficiency, and cost savings.
Asset
Anything that has tangible or Intangible value to an enterprise
Intangible Asset
Assets that do not have a physical presence (Information, Intellectual property, reputation etc..).
Tangible Asset
Assets that have a physical presence. (Human & Environmental assets).
Copyrights
A property right in an original work of authorship fixed in any tangible medium of expression, giving the holder the exclusive right to reproduce, adapt, distribute, perform, and display the work.
Example of Copyrights
Original works may include things such as Literary, musical, dramatic, choreographic, pictorial, graphic, sculptural, and architectural work; motion pictures and other audio-visual works; and sound & records
Intellectual property rights (IPR)
Intangible rights protecting the realization of ideas and concepts resulting in commercially valuable products. NOTE: Examples include but are not limited to trademark, copyright, and patent rights, as well as trade secret rights, publicity rights, moral rights, and rights against unfair competition
Internet of things (loT)
A system of interrelated computing devices, mechanical, and digital machines provided with unique identifiers (UIDs) with the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction.
Non-disclosure agreement (NDA)
A Legal contract that establishes a relationship between two or more parties outlining confidentiality and the responsibility for protecting information
Patent
to exclude others from making, using, marketing, selling, offering for sale, or importing an invention for a specified period granted to the inventor if the device or process is novel, useful, and no obvious
Proprietary information
Information of value, owned by an entity or entrusted to it, which has not been disclosed publicly
Risk
Effect of uncertainty on the achievement of strategic, tactical, and operational objectives
Risk assessment
Overall and systematic process for evaluating the effects of uncertainty on achieving an enterprise’s objectives_ Risk assessment includes risk identification, risk analysis, and risk evaluation
RCA- Root cause analysis
A technique used to identify the conditions that initiate the occurrence of an undesired activity or state.
Technical surveillance Countermeasures (TSCM)
Employment of services, equipment, and techniques designed to Locate, identify, and neutralize the effectiveness of technical surveillance activities.
Threat
Potential cause of an unwanted incident, which may result in harm to individuals, assets, a system or organization, the environment, or the community
Trade secret
All forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, program devices, formulas, designs, prototypes, methods, techniques, processed, procedures, programs, or codes, whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if (a the owner thereof has taken reasonable measures to keep such information secret; and if) the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, the public
Information assets are necessary in achieving organizations strategic ____________ and ____________.
Goals & Objectives
In order to safeguard its information assets, what should be established by an organization.
IAP - Information Asset Protection program appropriate to its size & type
Mixed assets
Some assets have both tangible and intangible characteristics and may be referred to as “mixed assets
As per ESRM who shares the Security Responsibility
Security Professionals & Asset Owners.
As per ESRM all the final security decisions are responsibility of whom ?
Asset Owners
Who is responsible for protecting the information’s assets in an organization
The Top Management & Other Asset owners
Who is responsible for overseeing the implementation, maintenance, and evaluation of the IAP program ?
The IAP Lead nominated/Assigned by Top Management
