Midterm Exam Study

Question 1

If a key is 43 bits long, how much longer will it take to crack it by exhaustive search if it is extended to 50 bits?

Answer 1

128 times as long

Question 2

If a key is 47 bits long, how much longer will it take to crack it by exhaustive search if it is extended to 50 bits?

Answer 2

8 times as long

Question 3

If a key is 42 bits long, how much longer will it take to crack it by exhaustive search if it is extended to 50 bits?
**how did you calculate this?

Answer 3

256 times as long
–multiply each successive bit added to the length by a factor of 2. so 42 bits extended to 50 bits is a total of 8 bits extended on. so 2 x 1 = 2 (two times as hard) then multiply this answer by 2 for the next successive bit so… =2 (x) 2 = 4… 4x(the next successive bit = 2) = 8… 8x2=16, 16x2=32, 32 x 2 = 64, 64x2= 128 , 128 x 2 (the last successive bit) = 256. so 256 as long!

Question 4

what is the CIA triangle?

Answer 4

CIA= C -Confidentiality, I- Integrity, A - Availability.
*Data is only seen by those that need to see it and best practices to protect private data, info can’t be changed or destroyed and those that need access to info have it.

Question 5

what are the 3 types of countermeasures to thwart compromises?

Answer 5

Preventative, Detective and Corrective: the prevention keep attacks from occurring, detective: detection of attacks and fast detection = minimal damage, Corrective: get the corporation back on track.
**safe guards, protection and controls.

Question 6

what is SQL injection? describe..

Answer 6

SQL injection: sending modified SQL programming statements (and/or) to web applications/ servers. modifies a database. easy to execute commands.

Question 7

What kind of threats are there by employees?

Answer 7

attacks on own company network out of spite, anger, extortion, to make $, etc.
examples: Logic bomb, steal trade secrets (non proprietary), sell info or IT security or data deleted.

Question 8

how do Worms spread?

Answer 8

Direct Propagation Worms: take advantage of/ detect security flaws in computers and moves from one pc to the next without the user doing anything at all. this allows to worm to move quickly throughout a network and even the WEB as a whole. each infected computer becomes a base where the worm can infect other computers.

Question 9

what are blended threats?

Answer 9

programs placed on websites as downloadable but are in-fact hidden viruses with worms embedded or the viruses create vulnerability allowing the worm/future attacks to do damage. *often the virus contains a Pay-load. sometimes the payload is a Trojan or root kit.

Question 10

Trojan horses and Root kits are what?

Answer 10

Trojan horses: pretend to be a legit program but are in-fact damaging once installed. sometimes are remote access software.
Root Kits: software that takes administrative control and then hides from the administrative detecting techniques in root system files(i think?).

Question 11

2 types of Trojan horses are?

Answer 11

Down-loaders: small programs enable larger Trojan horses to download.
*RAT: Remote Access Trojans: allow computer to be accessed and used remotely for malicious reasons.

Question 12

what is spyware?

Answer 12

software that gathers personal info, cookies, keystrokes and data mining.

Question 13

what is spam, hoaxing / phishing?

Answer 13

emails sent to trick users into giving away personal info, download attachments or open emails with code hidden in photos/ images. often used to use-up bandwidth.

Question 14

how do attackers get info about a network:?

Answer 14

Reconnaissance is done to gather info: programs used to scan for ip addresses used on the network, ip addresses are then scanned with port scanning software to determine which ports are open, used and the OS being used.

Question 15

once attackers have info about a network (ports, OS used, etc.) how do they use this info?

Answer 15

certain applications use certain ports like HTTP = port 80 so attackers can use attacks against HTTP that are known.

Question 16

what is a DDOS?

Answer 16

Distributed Denial Of Service attack: a(hacker) controls 100’s of bots/ zombie computers. the bots then do a denial of service attack onto a target computer. (example= flood with Transmission Control Protocol connection opening requests, once resources used up server crashes.)

Question 17

what is plan protect respond?

Answer 17

plan is created to respond to attacks, protect has countermeasures in place and response is built so that if an attack occurs then it is quickly found and fixed.

Question 18

steps of developing a security plan?

Answer 18

plans must include all resources and classified based on sensitivity to attack and importance to business, identify security gaps, remediation plans or gaps, focus on biggest security risk pay offs once fixed first.

Question 19

what is the: Sarbanes-Oxley act?

Answer 19

companies are required by law to report any material control deficiencies in their financial reporting process. this means if there is a significant likely-hood that there will be errors in book keeping then it must be reported or the stock can lose value or the CFO can lose job. chief financial officer.

Question 20

name some privacy protection laws and explain them:

Answer 20

HIPPA: private health care info, Gramm leach: protection for personal financial info, EU Data protection: commercial data protection in Europe.

Question 21

what is PCI-DSS?

Answer 21

Payment Card Industry - Data Security Standard: credit card accepting companies for payment must follow the PCI-DSS standards to protect customers credit card data.

Question 22

what is FISMA?

Answer 22

Federal Information Security Act: mandated yearly audits of any and all servers that store federal/gov. information. this can also include contracted services.

Question 23

what are the 2 stages of the FISMA?

Answer 23

the 2 stages of the federal information security act:
1- Certification: certified by itself or from an outside org.
2- ATO: Authorization To Operate: is given by an official if a higher level beyond certification of security is needed. this is done after the official reviews the certification security practices of the said device.

Question 24

CSO? what is its role?

Answer 24

Chief Security Officer: head of the IT security department.

Question 25

CIO:

Answer 25

Chief Information Officer.
**held accountable for security breaches and often IT
security is under this person.

Question 26

describe Risk Analysis

Answer 26

formula that compares probable losses with security protections, how countermeasures will alter losses, do countermeasures produce benefits that exceed costs?
-loss expectancy, probability of occurrence and costs of countermeasures. *hard to use in real life

Question 27

how do companies respond to risk?

Answer 27

risk reduction: implement security.

• acceptance: if security costs more than data lost
• insurance: pay mo. fee for someone to cover your losses
• avoidance: if a merger with another company or some other business thing is considered then not doing it because it makes the company too vulnerable to attack.

Question 28

what is policy? give examples:

Answer 28

statements/plans of what SHOULD be done under specific circumstances NOT how it should be done.
provides direction, allows best implementation at any time.
**Example: policy: all new employees must have a background check.
-implementors decide on the type/option of background check services and pick the one that matches the company policy, they don’t get hung up on details b/c the policy lays out what is required.
_guidelines for fingerprints in one example: some kitchen staff have unreadable fingerprints for machines and are given a code instead.

Question 29

diff. between Standards and Guidelines for implementors that implement policies.

Answer 29

standards are rules that must be followed, no interpretation takes place. guidelines are recommendations or allow flexibility in decisions.

Question 30

request/ authorization control?

Answer 30

person that makes request can never be the one who authorizes that request.

Question 31

what are Baselines?

Answer 31

describe the details of what is to be achieved without specifically describing how to do them. so may tell staff to apply passwords but wont tell them how to do this.

Question 32

recommended practices are what?

Answer 32

prescriptive practices gives to companies by gov. or other organizations.

Question 33

what is Promulgation?

Answer 33

formally announcing/ making users aware of new policies.

Question 34

how/why is monitoring done in a network?

Answer 34

to protect the network from abuse from employees. all employees should be told they are monitored and why.

Question 35

Auditing is what?

Answer 35

controls of financial processes health is being reviewed. not used to punish organizations but instead looks at samples of financial data to see if accurate, to come up with overall health of financial controls.