Lesson 1 Flashcards
What is information security?
Information security refers to the policies, procedures, and technical measures that can be applied to prevent unauthorised use, modication and theft to computer based resources, such as hardware, software and data.
Why is information security important?
In today’s high technology environment, organisations are becoming more and more dependent on their information systems
What are the three basic information security concepts?
1) Confidentiality
2) Integrity
3) Availability
You visit an organisation’s website and you realised that you are able to view sensitive files on their web server. Even though it is not your fault, it is still considered an information security breach.
A. True
B. False
A. True
Since you were not allowed to access sensitive files
Verifying that users are who they say they are and that each input arriving at the system came from a trusted source.
A. Authenticity
B. Integrity
C. Confidentiality
D. None of the above
A. Authenticity
List the three stages in plan-protect-respond cycle
Planning, protection and response
In plan, protect and response cycle, which stage consumes the most time?
Protection
How is protection defined?
Protection is defined as the plan-based creation of operation and countermeasures.
How is response defined?
Response is defined as recovery according to plan.
Why is there a need to understand Threat Environment?
To know how the attacks are going to attack us, and thus how to defend our systems.
The changing nature of information security attacks is more common than the traditional attacks.
A. True
B. False
A. True
Automation, speed and action at distance are encouraging online attacks
A. True
B. False
A. True
The chances of getting punished is low as well.
Most obvious reason(s) for computer security attacks is (are):
Privacy violations,
Criminal attacks,
Publicity attacks,
Legal attacks
The fabrication of information that is purported to be from someone who is not actually the author is called:
Masquerading
(taking someone else’s identity)
The interruption or degradation of a data service or information access is called
Could be due to traffic of any other reason
Denial of service
Malware is a generic term for “evil/malicious software”
A. True
B. False
A. True
Distinguish between viruses and worms.
Virus needs a host program while worms are full programs and don’t need a host program. Both differ in the way they come to the target.
Similarities: Both can cause malicious damage and can be detected by antivirus programs.
How do most viruses spread between computers today?
Mostly via email messages, but also through thumb drives, file sharing programs, downloading infected programs from a malicious website, social networking sites.
Most mobile applications have been scanned and verified, only some are infected
What is a virus or worm payload?
Payloads are pieces of code that causes damage
Could be delete, steal, spy, make the system unstable, etc.
What is a Logic Bomb?
Malicious codes that execute when certain predefined events occur.
What are the likely motivations for hackers
A. Financial gain, publicity, espionage
B. They are too smart and want people to know about it
C. They do it for a challenge
D. They do it as they are bored
E. All of the above
E. All of the above
A) is the most common reason
B) This was part of the motivations in the early hacking era, however today there are more compelling reasons.
C & D) could be some of the reasons, but not the most common reason
What is the definition of hacking?
Hacking is intentionally accessing a computer resource without authorisation or in excess of authorisation.
Excess of authorisation - when you have authorisation that you’re not supposed to have
What is spyware?
Spyware refers to a broad spectrum of Trojan horse programs that gather information about you and make it available to an attacker.
Spyware is different from adware and malicious software. Spyware’s purpose is to gather information about someone.
Why can cookies be dangerous?
Cookies can record too much sensitive information about you and could become spyware.
Cookies are legal, and that’s what makes them dangerous
What is social engineering?
Social engineering attacks take advantage of flawed human judgement by convincing the victim to take actions that are counter to security policies.
What is spam?
Spam is unsolicited, unwanted, commercial e-mail.
What is phishing?
Phishing attack victims receive an email message that appears to come from a bank or another firm with which the victim does business with, but is not. Purpose of phishing is to trick people by misleading them.
How can social engineering be used to get access to a sensitive file?
Simply by asking someone to send the file or to give access to the file by tricking the user.
