Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CPP by Matty > Information Security > Flashcards

Information Security Flashcards

1
Q

Intangible assets are….?

A

Assets with no physical presence: information, credibility, brand, and reputation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Information Security threat categories include…?

A
  • Intentional
  • Natural
  • Inadvertent
  • Data mining
  • Insiders
  • Counterfeiting and Piracy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

OPSEC has 5 cyclical steps:

A

1) Identify assets (critical information);
2) Define the threat ( collectors, capabilities, motivations);
3) Assess vulnerabilities;
4) Analyze the risk - it’s impact, priority, and any existing countermeasures; and
5) develop and implement countermeasures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is Cryptoware?

A

Also known as crypto-ransomware, it is a type of harmful program that encrypts files stored on a computer or mobile divide in order to extort money.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are four levels of information classification?

A

Highly restricted….restricted….internal use and unrestricted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are three key steps to take after an information loss?

A

Investigation, damage assessment and recovery and follow-up.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are technical surveillance countermeasures (TSCM)?

A

Services, equipment, and techniques designed to locate, identify and neutralize technical surveillance activities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

The strategies used to safeguard information assets typically include what three components?

A

Security measures, legal protections and management practices.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Informational assets can take what physical forms?

A

Prototypes and models; manufacturing processes and equipment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are five business impacts of an information asset loss event?

A

Loss of company reputation/image/goodwill;
- Loss of competitive advantage in one …..or in multiple …..products/services;
- reduced projected returns or profitability
- loss of core business technology or process

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is data mining?

A

Software driven collection of open-source data and public information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is proprietary information?

A

Information of value, owned by an entity or entrusted to it, which has not been disclosed publicly.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Inappropriate links to unprotected networks, improper system configuration, or unpatched workstations are examples of..?

A

Vulnerability in the information systems infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which five information security systems (ISS) issues can also weaken physical security in a converged system?

A

Denial of services,
Insertion of incorrect data
Data theft
Data modification and
Data destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the best way to evaluate the current status of information security programs in your organization?

A

Conduct surveys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are examples of inadvertent threats?

A

Inadequate employee training, misunderstandings and lack of attention to detail

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Gramm-Leach-Bliley Act?

A

Requires financial institutions and companies that offer consumer financial products or services to explain their information sharing practices to their customers and to safeguard sensitive data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Data breach laws put the onus of data protection on?

A

The organizations and agencies that house and use that information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the security model that requires strict ID verification for every person and device trying to access resources on a network?

A

Zero trust.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How do information systems security professionals mitigate risk?

A

Through the development of an information Security Management System (ISMS).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Who is in charge of deciding to pay a hacker’s ransom?

A

Stakeholders in the business.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the business impacts of a loss event?

A
  • loss of use
  • loss of ownership
  • loss of intellectual property rights
  • loss of proprietary information or prototypes that could facilitate product counterfeiting.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

There are no criminal laws regarding?

A

Patent infringement

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An information assets protection (IAP) program focuses on?

A

IAP programs focus holistically on the security of information assets - including all aspects of protection….not just technology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does an information systems security (ISS) program focus on?

A

An ISS focuses on the security of information technology….for example….systems, networks, applications and the interaction between those technology components and end users. The objective of an ISS is to prudently and cost-effectively manage the risk where critical organizational information could be: compromised, changed without authorization or become unavailable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Six ISS terms include? pg 262 in study guide

A
  • information systems threat
  • information systems vulnerability
  • information systems risk
  • information systems countermeasures
  • residual threat risk
  • Residual risk
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Cyclical redundancy check (CRC)?

A

A tool for maintaining information integrity; it shows whether data has been altered.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Three classifications of information systems countermeasures?

A
  • Administrative controls
  • technical controls; and
  • Physical controls
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

The ISO/IEC 2700 family of standards does what?

A

Provides best practices for an ISMS and takes a risk-based approach to cybersecurity by addressing people, technology and processes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

ISO 27001?

A

Discusses the concept of an information security management system and outlines information security management practices….policies, compliance, asset management….etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

NIST 800 series?

A

Nat’l Institute of Standards and Technology developed a series of documents used by the federal gov’t for computer security policy, procedures and guidelines.

32
Q

CISSP?

A

Certified Information Systems Security Professional is a common body of knowledge developed to characterize the body of knowledge required for certification as an information system security professional. It organizes ISS into 8 domains (p. 269 study guide)

33
Q

HIPAA?

A

Health insurance portability and accountability act was one of the first significant attempts to adopt a standard of care for electronic transactions in the healthcare field.

34
Q

Red Flag Rules

A

The purpose of the program is the early detection and prevention of identity theft

35
Q

General Data Protection Regulation (GDPR)?

A

GDPR is a regulation in European Union (EU) law on data protection and privacy in the EU and the European Economic Area (EEA).

36
Q

EU - US Privacy Shield Framework

A

The GDPR requires data transfers can only happen to countries deemed as having adequate data protection laws - and the U.S. ain’t one of them. The privacy shield gets around that by deeming that certain companies have adequate protection .

37
Q

Factors in determining whether an employee should be disciplined include?

A

Whether misconduct happened:
- on or off work property
- during or after hours;
- whether the work represented himself as part of the organization

38
Q

Photogrammetry

A

Dimensions arrived at through photographic images

39
Q

Impressions include?

A

firearms,
tool marks,
bite impressions
……. and footprints

40
Q

NLRB vs. Weingarten, Inc.

A

1975….A union representative can be present at any investigative interview that may result in disciplinary action……if the worker requests one!!!!!

41
Q

The Nine steps of interrogation included in the Reid technique

A
  • Positive confrontation;
  • Theme development;
  • Handling denials;
  • Overcoming objections;
  • Keeping a suspect’s attention;
  • Handling a suspect’s passive mood
  • Presenting an alternative question;
  • Having the suspect relate details;
  • converting an oral confession
42
Q

Types of investigative reports include?

A
  • Initial’
  • progress
  • special, and
  • final
43
Q

Typical elements of investigative reports include?

A
  • Administrative’
  • Summary
  • Narrative
  • Conclusions and
  • enclosures
44
Q

The five basic steps of report writing include?

A

Gather, record and organize the facts
Write the report
Evaluate and edit the report

45
Q

Investigative report narratives should be?

A

Clear
Simple and
Brief

46
Q

There are two types of witnesses?

A

Fact and opinion

47
Q

What three factors influence jurors?

A

Personality
Culture and
Life experiences

48
Q

UC theft investigations require special care during the …?

A

Planning phase

49
Q

Cognitive consistency?

A

A phenomenon whereby employees breaking the law in one way will be attracted to the UC operative in trying to break the law in another way.

50
Q

Sting vs. Buy Bust operations?

A

Sting is generally longer, more complicated investigative effort

51
Q

Fraud

A

An intentional deception perpetrated for the purpose of unlawfully taking another’s property

52
Q

The size and scope of the investigative program is equal to the R…..and TC?

A

Resources and time commitment

53
Q

The intersection of investigations and security risk management is….?

A

Due diligence.
- Due diligence is backward looking and can be compared to negligence. It is the effort and steps taken to demonstrate due care.

54
Q

Due care?

A

Providing reasonable protection.

55
Q

Americans with Disabilities Act

A

Applies to employers with 15 or more workers

56
Q

Fair Credit Reporting Act (FCRA) requires?

A

1) Disclosure and
2) Written authorization

Insurance and criminal history. Credit history is not part of the FCRA because credit history is not public information

57
Q

EPPA

A

Employee polygraph protection act of 1988 prohibits the use of the polygraph for preemployment screening in private sector

58
Q

Floating point Strategy

A

An investigator continuously evaluates new information to update their hypothesis of the crime.

59
Q

What are the four force multiplier in investigations?

A
  • Online information sources;
  • liaisons’
  • intelligence information; and
  • technology
60
Q

What is the theft triangle?

A

Desire - need or want
Motive - rationalization
Opportunity

61
Q

The four formats for a confession?

A
  • Statement written by the suspect;
  • statement written by the investigator but read and signed by the suspect;
  • Statement typed up but read and signed by the suspect;
  • audio or video statement by the suspect
62
Q

What are the three forms of evidence?

A

Oral
Physical and
documentary

63
Q

What are the four ways hazards from a contaminated scene can enter the body?

A
  • Inhale;
  • ingest;
  • inject; and
  • skin contact
64
Q

Evidence can be defined as?

A

Any type of proof that is capable of proving or disproving a contention or fact

65
Q

Evidence is admissible when it is?

A
  • Competent
  • Relevant and
  • Material
66
Q

Six factors affecting the type of evidence?

A
  • Direct
  • Indirect or circumstantial
  • forensic
  • hearsay
  • admissibility of evidence
  • materiality of evidence
67
Q

The private sector investigator is working towards a lower level of proof?

A

Civil court - uses the preponderance of evidence;

Criminal court - beyond a reasonable doubt

68
Q

The largest budget items for an investigative unit include?

A

Personnel and outside services

69
Q

The easiest budget item for an investigative unit to control is?

A

Overhead costs

70
Q

While some investigations call for a more creative problem solving approach…..background and incident investigations call for a…?

A

Methodical and systematic approach

71
Q

Embezzlement (defalcation)

A

Appropriation of property by a person to whom it has been entrusted. Cash disbursements are the most common form of workplace embezzlements…..so the accounts payable ledger should be looked at as it reflects dates and amounts paid to company suppliers

72
Q

Computer forensics vs. traditional forensics

A

Traditional - relies on objective results of a scientific examination;
Computer - is driven by information uncovered during the investigation

73
Q

Undercover vs. traditional investigations

A

The UC investigation is a form of interactive investigation that, by 1985, became and remains the preferred way to investigate drugs and theft in the workplace. The UC operative does not hide his presence nor attempt to operate unnoticed.

74
Q

Investigative reports should be written in?

A

The third person as a structured narrative. This eliminates rewrites and saves time and effort.

75
Q

Entrapment

A

Not a crime, but a criminal defense

76
Q

UN convention against corruption 2003?

A

Made whistleblower protection international law

77
Q

Federal Sentencing guidelines and Sarbanes-Oxley Act of 2002?

A

Require a non-retaliatory internal reporting system as part of compliance and ethics programs for all publicly traded companies

CPP by Matty (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions