Managing IS/IT Security Behaviour Flashcards
Identity theft
Identity theft is a form of stealing someone’s identity in which someone pretends to be someone else by assuming that person’s identity, typically in order to access resources or obtain credit and other benefits in that person’s name. The victim can suffer adverse consequences if they are held accountable for the perpetrator’s actions.
Internet troll
Someone who posts inflammatory, extraneous, or off-topic messages in an online community, such as a forum, chat room, or blog, with the primary intent of provoking readers into an emotional response or of otherwise disrupting normal on-topic discussion.
commercial computer security breach?
A commercial computer security breach is a security incident in which sensitive, protected or confidential data/information is copied, transmitted, viewed, stolen or used by an individual unauthorised to do so. This may involve financial information such as credit card or bank details.
Two types of security control
Physical
Logical
Physical
Physical security control (e.g. restrict access to the computer room, locks, alarms, guards)
Logical
Logical security control (e.g. control access to data through passwords, control access to networks with firewalls, protect data from malicious damage with virus protection)
How can transactions, that must be secure, be conducted over an insecure network like the Internet?
Authentication Authorisation Verification Encryption Malicious Attacks
Authentication
The process by which a person accessing a system proves who they are
A strong authentication protocol usually requires two means of identification (e.g. password + security token)
Good password practice
Use passwords that are:
Easy to remember BUT Hard to guess
Security token
e.g. A small electronic device that displays numbers on a small screen (e-banking devices)
The number changes periodically, the sequence of which is only known to the authenticating server
These may also be combined with biometric data (e.g. the user’s fingerprint)
Authorisation
Processes whereby a person gains access only to the resources they are entitled to use:
Can be achieved with:
Access control lists
Computer system permissions
Verification
Processes to ensure data is not changed without authorisation
Encryption
Protection against unauthorised invasion/interception
Encryption systems
Symmetric (Shared) Key Encryption
e.g. The Advance Encryption Standard (AES)
Public Key Encryption
Private key decryption
Malicious attacks
Denial of service
Malicious damage (Viruses, hackers)
Denial of service
Activities that deny authenticated users access to resources to which they should have authorised access
