MIDTERM EXAM | LESSON 3-6 Flashcards
a business policy that permits, and in some cases encourages, employees to use their own mobile devices
Bring Your Own Device
Common Computer Attacks/Type of Exploits
virus
worm
Trojan horse
spam
distributed denial-of-service
rootkit
phishing
spear-phishing
smishing
vishing
a piece of programming code, usually disguised as something else, that causes a computer to behave in an unexpected and usually undesirable manner.
Virus
a harmful program that resides in the active memory of the computer and duplicates itself
Worms
a program in which malicious code is hidden inside a seemingly harmless program
Trojan Horse
a form of low-cost commercial advertising, sometimes for questionable products such as pornography, phony get-rich-quick schemes, and worthless stock
Spam
a malicious hacker takes over computers via the Internet and causes them to flood a target site with demands for data and other small tasks
Distributed Denial-of-Service (DDoS) Attacks
is a set of programs that enables its user to gain administrator-level access to a computer without the end user’s consent or knowledge
rootkit
is the act of fraudulently using email to try to get the recipient to reveal personal data.
Phishing
a variation of phishing in which the phisher sends fraudulent emails to a certain organization’s employees. It is known as ____ because the attack is much more precise and narrow,
Spear-phishing
another variation of phishing that involves the use of Short Message Service (SMS) texting
Smishing
a type of phishing attack where scammers use phone calls to trick individuals into revealing personal information
Vishing
Types of Perpetrators
HACKERS
CRACKERS
MALICIOUS INSIDERS
INDUSTRIAL SPIES
CYBERCRIMINALS
HACKTIVISTS
CYBERTERRORISTS
Types of Perpetrators
Test limits of system and/or gain publicity
Hackers
Types of Perpetrators
Cause prob;em, steal data, and corrupt system
Crackers
Types of Perpetrators
Gain financially and/or disrupt company’s informatio and business operations
Malicious Insiders
Types of Perptrator
Capture trade secrets and gain competitie advantage
Industrial Spies
Types of Perpetrators
Gain Financially
Cybercriminals
Types of Perpetrators
Promote Political ideology
Hacktivists
Types of Perpetrators
Destroy infrastructure componenent of financial institutions, utilities, and emergency response units
Cyberterrorrists
Common Ethical Issues for IT Users
- Software Piracy
- Inappropriate Use of Computing Resources
- Inappropriate Sharing of Information
Creating an IT Usage Policy
- Establishing Guidelines for Use of Company Software
- Defining the Appropriate Use of IT Resources
- Structuring Information Systems to Protect Data and Information
Some employees use their computers to surf popular Web sites that have nothing to do with their jobs, participate in chat rooms, view pornographic sites, and play computer games.
Inappropriate Use of Computing Resources
is hardware or software that serves as a barrier between an organization’s network and the Internet;
Firewall
____ means to be in accordance with established policies, guidelines, specifications, or legislation
Compliance
Why Computer Incidents Are So Prevalent
- Increasing Complexity Increases Vulnerability
- Virtualization
- Higher Computer User Expectations
- Expanding and Changing Systems Introduce New Risks
- Bring Your Own Device
- Increased Reliance on Commercial Software with Known Vulnerabilities
The computing environment has become enormously complex. The number of possible entry points to a network expands continually as more devices are added, increasing the possibility of security breaches.
Increasing Complexity Increases Vulnerability
____ also introduces further complications into today’s computer environment. ____ software operates in a software layer that runs on top of the operating system.
Virtualization
As a result, computer help desks are under intense pressure to respond very quickly to users’ questions.
Higher Computer User Expectations
Business has moved from an era of stand-alone computers, in which critical data was stored on an isolated mainframe computer in a locked room, to an era in which personal computers connect to networks with millions of other computers, all capable of sharing information.
Expanding and Changing Systems Introduce New Risks
this practice raises many potential security issues as it is highly likely that such devices are also used for nonwork activity that exposes them to malware much more frequently than a device used strictly for business purposes
Bring Your Own Device
a method of computing that delivers secure, private, and reliable computing experiences based on sound business practices
Trustworthy computing
The security of any system or network is a combination of technology, policy, and people and requires a wide range of activities to be effective.
THIS STATEMENT IS TRUE
____ is the process of assessing security-related risks to an organization’s computers and networks from both internal and external threats.
Risk Assessment
A ____ defines an organization’s security requirements, as well as the controls and sanctions needed to meet those requirements.
security policy
A good security policy delineates responsibilities and the behavior expected of members of the organization.
A security policy outlines what needs to be done but not how to do it.
TRUE STATEMENTS
The following is a partial list of the templates available from the SANS Institute:
- Ethics Policy
- Information Sensitivity Policy
- Risk Assessment Policy
- Personal Communication Devices and Voice-mail Policy
template defines the means to establish a culture of openness, trust, and integrity in business practices.
Ethics Policy
This sample policy defines the requirements for classifying and securing the organization’s information in a manner appropriate to its level of sensitivity.
Information Sensitivity Policy
This template defines the requirements and provides the authority for the information security team to identify, assess, and remediate risks to the organization’s information infrastructure associated with conducting business.
Risk Assessment Policy
This sample policy describes security requirements for personal communication devices and voice mail.
Personal Communication Devices and Voice-mail Policy
Educating Employees and Contract Workers
Employees and contract workers must be educated about the importance of security so that they will be motivated to understand and follow the security policies.
TRUE STATEMENT
TOP RATED FIREWALL FOR PERSONAL COMPUTERS
- Norton 360
- Norton Internet Security
- Kaspersky PURE 2.0 Total Security
- Kaspersky Internet Security 2013
- Zone Alarm Extreme Security 2012
- Zone Alarm Free
____ is software and/or hardware that monitors system and network resources and activities, and notifies network security personnel when it detects network traffic that attempts to circumvent the security measures
intrusion detection system (IDS)
two fundamentally different approaches to intrusion detection
Knowledge-based approaches and behavior-based approaches
____ contain information about specific attacks and system vulnerabilities and watch for attempts to exploit these vulnerabilities
Knowledge-based IDS
models normal behavior of a system and its users from reference information collected by various means.
Behavior-based IDS
Antivirus software should be installed on each user’s personal computer to scan a computer’s memory and disk drives regularly for viruses.
TRUE STATEMENT
____ scans for a specific sequence of bytes, known as a virus signature, that indicates the
presence of a specific virus.
Antivirus software
Conducting Periodic IT Security Audits Steps
- D etection
- Response
- Incident Notification
- Protection of Evidence and Activity Logs
- Incident Containment
- Eradication
- Incident Follow-Up
____ is a discipline that combines elements of law and computer science to identify, collect, examine, and preserve data from computer systems
Computer Forensics
a violation is when employees copy software from their work computer to use at home
Sofrware Piracy
