IS3230 CHAPTER 5 Flashcards
A confirmed event that compromises the confidentiality, integrity, or availability of information is called ___.
BREACH
Requires a business operating in California to notify customers when it has reason to believe that personal information has been disclosed through unauthorized access is called ___.
CALIFORNIA IDENTITY THEFT STATUTE
A federal criminal statute designed to protect electronic data from theft is called ___.
COMPUTER FRAUD AND ABUSE ACT (CFAA)
A method of scrambling data for security purposes. Published in 1974, it has since been broken and is no longer considered highly secured is called ___.
DATA ENCRYPTION STANDARD (DES) ENCRYPTION
A US copyright law that enacts criminal penalties for breaking or distributing technology designed to break digital rights management technologies is called ___.
DIGITAL MILLENNIUM COPYRIGHT ACT (DMCA)
Random data that is used as the basis for an encryption algorithm. The randomness of this data provides an additional layer of security to the encryption is called ___.
HASH SALT
The method used to store passwords up to 15 characters in Windows operating systems prior to Window Vista is called ___.
LAN MANAGER (LM) HASH
A challenge-response authentication protocol used by NT servers when using the Server Message Block (SMB) protocol is called ___.
NTLM HASH
A comprehensive process for determining the privacy, confidentiality, and security risks associated with the collection, use, and disclosure of personal information. It also describes the measures used to mitigate, and if possible, eliminate identified risks is called ___.
PRIVACY IMPACT ASSESSMENT (PIA)
An ID badge with an embedded radio frequency identification chip. This chip can store information about the badge holder, such as authentication information and security access levels is called ___.
RADIO FREQUENCY IDENTIFICATION (RFID) BADGES
An encrypted password database used in Unix and Linus operating systems is called ___.
SHADOW PASSWORD
A group of 188 nations that have signed treaties to protect intellectual property across national borders is called ___.
WORLD INTELLECTUAL PROPERTY ORGANIZATION (WIPO)
- Information security falls strictly under the jurisdiction of federal law–state law does not restrict information security practices.
TRUE OR FALSE
FALSE
- The two primary federal law that are concerned with information security are the Digital Millennium copyright Act and the ____.
Computer Fraud and Abuse Act
- Which federal law discussed in the chapter allows civil actions to be brought against individuals who sell passwords?
- CFAA
- DMCA
- DCMA
- CFFA
CFAA
- Which federal law provides penalties for circumventing digital rights management?
- CFAA
- DMCA
- DCMA
- CFFA
DMCA
- Which law discussed in the chapter is concerned with preventing identity theft?
- California Identity Theft Statute
- Federal Identity Theft Statute
- Idaho Identity Theft Statute
- Colorado Identity Theft Statute
California Identity Theft Statute
- Which of the following are effective physical security policies?
- All physical security must comply with all applicable regulations such as building and fire codes.
- Access to secure computing facilities will be grand only to individuals with a legitimate business need for access
- All secure computing facilities that allow visitors must have an access log
- Visitors must be escorted at all times
- All the above
ALL THE ANSWERS
- All physical security must comply with all applicable regulations such as building and fire codes.
- Access to secure computing facilities will be grand only to individuals with a legitimate business need for access
- All secure computing facilities that allow visitors must have an access log
- Visitors must be escorted at all times
- What are the two primary causes of access control failure discussed in the chapter? (More than one may apply)
- People
- Planning
- Technology
- Implementation
- Follow-up analysis
People.
Technology
- Which of the following are types of security breaches? (Choose all that apply)
- System exploits
- DoS attacks
- PII
- Eavesdropping
- Social engineering
System exploits
DoS attacks
Eavesdropping
Social engineering
- Anything from an organization’s operating system to its choice of Web browser or instant messaging client could be an access point for unauthorized access to the systems.
TRUE OR FALSE
TRUE
- When should a privacy impact assessment be performed?
- During the planning stages of a new system
- After a new system is designed
- After a new system is implemented
- After a security breach
During the planning stages of a new system
- The two most common motives for a security breach are monetary gain and gain ____.
VANDALISM
- A security breach can result in criminal penalties as well as financial losses.
TRUE OR FALSE
TRUE
