Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information Security and Assurance > Lesson 1 > Flashcards

Lesson 1 Flashcards

1
Q

__________ is the study of how to protect your information assets from destruction, degradation, manipulation and exploitation. But also, how to recover should any of those happen.

A

Information Assurance (IA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Aspects of information needed protection:

: timely, reliable access to data and information services for authorized users;

A

Availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Aspects of information needed protection:

: protection against unauthorized modification or destruction of information;

A

Integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Aspects of information needed protection:

: assurance that information is not disclosed to unauthorized persons;

A

Confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Aspects of information needed protection:

: security measures to establish the validity of a transmission, message, or originator.

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Aspects of information needed protection:

: assurance that the sender is provided with proof of a data delivery and recipient is provided with proof of the sender’s identity, so that neither can later deny having processed the data.

A

Non-repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Four major categories of Information Assurance:

A
  • Physical security
  • Personnel security
  • IT security
  • Operational security
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Proper Practice of Information Assurance:

A
  • enforcing hard-to-guess passwords
  • encrypting hard drives
  • locking sensitive documents in a safe
  • assigning security clearances to staffers
  • using SSL for data transfers
  • having off-site backup of documents
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

It refers to the protection of hardware, software, and data against physical threats to reduce or prevent disruptions to operations and services and loss of assets.

A

Physical security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

It is a variety of ongoing measures taken to reduce the likelihood and severity of accidental and intentional alteration, destruction, misappropriation, misuse, misconfiguration, unauthorized distribution, and unavailability of an organization’s logical and physical assets, as the result of action or inaction by insiders and known outsiders, such as business partners.

A

Personnel security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

______ is the inherent technical features and functions that collectively contribute to an IT infrastructure achieving and sustaining confidentiality, integrity, availability, accountability, authenticity, and reliability.”

A

IT security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

This involves the implementation of standard operational security procedures that define the nature and frequency of the interaction between users, systems, and system resources, the purpose of which is to:
* achieve and sustain a known secure system state at all times, and
* prevent accidental or intentional theft, release, destruction, alteration, misuse, or sabotage of system resources.

A

Operational security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

According to _______, a computing environment is made up of five continuously interacting components: activities, people, data, technology, and networks. IA includes computer and information security.

A

Raggad’s taxonomy of information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

According to Blyth and Kovacich, IA can be thought of as protecting information at three distinct levels:

A

Physical
Information infrastructure
Perceptual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Level: data and data processing activities in physical space

A

physical

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Level: information and data manipulation abilities in cyberspace

A

information infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Level: knowledge and understanding in human decision space.

A

perceptual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

The lowest level focus of IA is the _________.

A

Physical level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Computers, physical networks, telecommunications and supporting systems such as power, facilities and environmental controls. Also at this level are the people who manage the systems.

A

Physical level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What level:
Desired Effects: to affect the technical performance and the capability of physical systems, to disrupt the capabilities of the defender.

Attacker’s Operations: physical attack and destruction, including: electromagnetic attack, visual spying, intrusion, scavenging and removal, wiretapping, interference, and eavesdropping.

Defender’s Operations: physical security, OPSEC, TEMPEST. Thus, IA includes aspects of COMPSEC, COMSEC, ITSEC, OPSEC

A

Physical level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

The second level focus of IA is the ___________.

A

Information Infrastructure Level

22
Q

This covers information and data manipulation ability maintained in cyberspace, including: data structures, processes and programs, protocols, data content and databases.

A

Information Infrastructure Level

23
Q

What level:

Desired Effects: to influence the effectiveness and performance of information functions supporting perception, decision making, and control of physical processes.

Attacker’s Operations: impersonation, piggybacking, spoofing, network attacks, malware, authorization attacks, active misuse, and denial of service attacks.

Defender’s Operations: information security technical measures such as: encryption and key management, intrusion detection, anti-virus software, auditing, redundancy, firewalls, policies and standards.

A

Information Infrastructure Level

24
Q

The third level focus of IA is the _______, also called social engineering:

A

Perceptual level

25
Q

This is abstract and concerned with the management of perceptions of the target, particularly those persons making security decisions.

A

Perceptual level

26
Q

What level:

Desired Effects: to influence decisions and behaviors.

Attacker’s Operations: psychological operations such as: deception, blackmail, bribery and corruption, social engineering, trademark and copyright infringement, defamation, diplomacy, creating distrust.

Defender’s Operations: personnel security including psychological testing, education, and screening such as biometrics, watermarks, keys, passwords.

A

Perceptual level

27
Q

This is the flip side of Information Assurance. In fact, one can think of the offensive part of IW as ‘information operations,’ and the defensive part as ‘information assurance’.

A

Information Warfare (IW)

28
Q

This type involves managing an opponent’s perception through deception and psychological operations. In military circles, this is called Truth Projection.

A

Type I

29
Q

This type involves denying, destroying, degrading, or distorting the opponent’s information flows to disrupt their ability to carry out or co- ordinate operations.

A

Type II

30
Q

This type gathers intelligence by exploiting the opponent’s use of information systems.

A

Type III

31
Q

The offensive players in the world of IW come in six types:

A

Insiders
Hackers
Criminals
Corporations
Governments and agencies
Terrorists

32
Q

It consists of employees, former employees and contractors.

A

Insiders

33
Q

They are the one who gains unauthorized access to or breaks into information systems for thrills, challenge, power, or profit.

A

Hackers

34
Q

They target information that may be of value to them: bank accounts, credit card information, intellectual property, etc.

A

Criminals

35
Q

Those who actively seek intelligence about competitors or steal trade secrets.

A

Corporations

36
Q

Those who seek the military, diplomatic, and economic secrets of foreign governments, foreign corporations, and adversaries. May also target domestic adversaries.

A

Governments and agencies

37
Q

They are those who usually politically motivated and may seek to cause maximal damage to information infrastructure as well as endanger lives and property.

A

Terrorists

38
Q

True or False:
IA is both proactive and reactive involving: protection, detection, capability restoration, and response.

A

True

39
Q

True or False:
IA environment protection pillars: “ensure the availability, integrity, authenticity, confidentiality, and non-repudiation of information”

A

True

40
Q

: “timely attack detection and reporting is key to initiating the restoration and response processes.”

A

Attack detection

41
Q

: “relies on established procedures and mechanisms for prioritizing restoration of essential functions. Capability restoration may rely on backup or redundant links, information system components, or alternative means of information transfer.”

A

Capability restoration

42
Q

This is the resource being protected, including: physical assets: devices, computers, people; logical assets: information, data (in transmission, storage, or processing), and intellectual property; system assets: any software, hardware, data, administrative, physical, communications, or personnel resource within an information system.

A

Asset

43
Q

The items being protected by the system (documents, files, directories, databases, transactions, etc.)

A

Objects

44
Q

The entities (users, processes, etc.) that execute activities and request access to objects.

A

Subjects

45
Q

Operations, primitive or complex, that can operate on objects and must be controlled.

A

Actions

46
Q

Critical Aspects:
authorized users are able to access it;

A

Availability

47
Q

Critical Aspects:
the information is free of error and has the value expected;

A

Accuracy

48
Q

Critical Aspects:
the information is genuine;

A

authenticity

49
Q

Critical Aspects:
the information has not been disclosed to unauthorized parties;

A

confidentiality

50
Q

Critical Aspects:
the information is whole, complete and uncorrupted;

A

integrity

51
Q

Critical Aspects:
the information has value for the intended purpose;

A

utility

52
Q

Critical Aspects:
the data is under authorized ownership and control.

A

possession

Information Security and Assurance (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions