IT Risks and Responses Flashcards
T/F: a successful organization cannot operate without technology
True; as organizations integrate more technology into their operations, new and greater risks materialize
as part of the security life cycle, organizations must identify the risks, assess the impact of those risks, develop a protection strategy, and monitor the risks and mitigation efforts
T/F: fundamental risks inherently exist in technology
True; some of those risks are described below:
technology risk - the risk of disruption to business as a result of any information technology activity
security risk - comprises the risks associated with unauthorized access or use of an organization’s information technology
availability risk - the risk that an organization will not be able to access and utilize its information technology as needed
operational risk - the risk that an organization is unable to operate effectively or efficiently due to issues concerning information technology
financial risk - the risk of losing financial resources as a result of them being misused, lost, wasted, or stolen
compliance risk - it is focused on the issues related to information technology not sufficiently meeting the requirements of regulatory bodies
strategic risk - the risk of misalignment of business and IT strategies
What are the 4 types of threats IT faces at an organization?
natural and political disasters, errors in software and equipment malfunctions, accidental actions, and intentional actions
T/F: a common misconception is that it risks can be mitigated through software and hardware-based controls alone
True; mitigation of IT risks starts with the people within the organization; specifically, risk mitigation is a management concern; management must determine what the overall risk appetite is for the organization and in turn develop a security strategy that includes policies and procedures to align that risk appetite with information systems and information technology
when designing controls to fully safeguard a system, an organization must include threat identification controls designed to safeguard confidentiality
What are the 2 categories of IT controls?
general IT controls - they are designed to ensure that an organization’s control environment (people, processes, and IT) is stable and well-managed
application controls - software-specific mechanisms within a computer program that manage user access, permissions, and functionality
What are the 3 ways in which controls can be implemented?
manual controls - a control performed by a person without making direct use of automated systems
automated controls - an action or process initiated automatically without the need for a person to initiate that action or process, so that a system maintains integrity
IT dependent manual controls - relies on an individual performing a control function with some use of an IT component, such as an IT-generated report; these controls have components of both manual and automated controls
What are the 3 functions a control can serve?
preventive controls - takes precautions to prevent problems in the future
detective controls - finds and reveals issues or deficiencies not averted by preventive controls
corrective controls - have the ability to identify, repair, restore, and recover from issues that cause damage to a system or process
Fact: it is essential that information within an organization is both reliable and secure; to ensure that this goal is met, it is vital that system access controls and segregation of duties exist to mitigate risks of fraud and error
logical access controls - utilize software and protocols to monitor and control access to information and an organization’s IT infrastructure; logical access controls are typically built into software packages and operating systems to enforce security measures for access rights from local as well as remote locations for internal or external users
user access controls - controls must be put in place to identify which users access the system and to track their activity while using this system; as a result, each system user needs a unique identity to ensure that if error or fraud occurs within a system, it can be traced to the perpetrator
authentication controls - a robust user verification process must be in place when users access a system so that their identity can be authenticated and specific access level or clearance granted based on their job role; examples are: passwords, PIN numbers, biometrics, smartcards or physical tokens, push notifications, multifactor authentication, and CAPTCHA (completely automated public turing test to tell computers and humans apart)
Fact: passwords are designed to protect access to secure systems, applications, and information
a strong password management policy must address the following password characteristics: password requirement, password length, password complexity, password age, password reuse
T/F: access control lists are a form of authorization control
True; although authentication verifies identity, authorization restricts access and actions of authenticated users based on granted permissions; access control lists list users, information, and applications, and provide the types of access and rights granted; typical rights include the ability to do the following to an application or file: create (or write) access, read only, update access, delete
Fact: when an individual is onboarded, changes position, is promoted/demoted, or is discharged from an organization, it is important that his or her access, authentication, and authorization is modified as appropriate; this typically involves coordination between HR and IT
an organization must have security in place to protect its private network from unauthorized access; a firewall is a security measure that may be composed of both software and hardware that prevent unauthorized access to an organization’s private network
organizations use operating systems and software applications that need to be reviewed when installed and on an ongoing basis to ensure proper authorization and usage; the vulnerability controls include:
hardening - when applications or systems are first installed, they should be hardened, meaning they can reduce their surface vulnerability by turning off features or functions that are not needed during operations
patch management - as vulnerabilities are discovered in operating systems or applications, they should be addressed by patches (fixes) before they are exploited
anti-malware program - malware consists of malicious programs such as worms and viruses that have the ability to self-propagate and spread, allowing pathways for unauthorized access to occur; malware can enter networks and specific host computers through websites, programs, and data files
What is data encryption?
it is an essential foundation for electronic commerce; it involves using a password or a digital key to scramble a readable (plaintext) message into an unreadable (ciphertext) message; the intended recipient of the message then uses another digital key to decrypt or decipher the ciphertext message back into plaintext
with encryption keys, the longer the length of the key, the less likely it is that the message or transaction will be decrypted by the wrong party and that the key will be broken by a brute-force attack (the attacker simply tries every possible key until the right one is found); there are two types of encryption:
symmetric - the sender and the recipient use the same shared key
asymmetric - two keys are used; one is public and the other is private (more secure and more common place now)
What are digital certificates?
another form of data security, they are electronic documents that are created and digitally signed by a trusted party and that certify the identity of the owners of a particular public key; digital certificates operate on what is known as a public key infrastructure (PKI), which is the system and processes used to issue and manage asymmetric keys and digital certificates
a digital signature uses asymmetric encryption to create legally binding electronic documents (ex. Docusign)
What are physical controls?
they are used to deter unauthorized access, monitor facilities, and control the workplace environment; these controls are established to protect the entire facility; however, they can be applied to specific areas or rooms within the facility as well; examples include: locked doors, fencing and barricades, security systems, security monitoring
What is segregation of duties?
it is one of the most important controls in accounting and is particularly important within the IT infrastructure; it reduces opportunities for anyone to be in a position to both perpetrate and conceal errors or fraud in the normal course of one’s duties
the following areas within the IT infrastructure need to have a proper segregation of duties: system programming, end user transaction/data entry, data custody and storage, and authorization responsibility and monitoring
