Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

BTM 226 > Module 10: Information Security and Controls > Flashcards

Module 10: Information Security and Controls Flashcards

1
Q

What does information security refer to?

A

It refers to all of the processes and policies designed to protect an organization’s information and information systems (IS) from an unauthorized access. use, disclosure, disruption, modification, or destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a threat to an information resource?

A

It is any danger to which a system may be exposed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is exposure?

A

It is the harm, loss, or damage to a compromised resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an information resource’s vulnerability?

A

It is the possibility that the system will be harmed by a threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the two major categories of threats?

A

Unintentional threats are acts performed without malicious intent
Deliberate threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the ten common types of deliberate threats to information systems?

A

Espionage or trespass
Information extortion
Sabotage or vandalism
Theft of equipment or information
Identify theft
Compromises to intellectual property
Software attacks
Alien software
Supervisory control and data acquisition (SCADA) attacks
Cyberterrorism and cyberwarfare

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are organizations doing to protect themselves?

A

Developing security management strategies
Allocating sufficient resources managed by a Chief Security Office or CIO
Developing software and services that deliver early warnings
Early warning systems are proactive, they can scan the Web for new viruses. alert companies to danger

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the categories of controls?

A

Security is not only aspect of operational controls
Controls come in layers: control environment, general controls, application controls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the five key factors that threaten cybersecurity?

A
  1. Today’s interconnected, interdependent, wirelessly networked business environment
  2. Smaller, faster, cheaper computers and storage devices
  3. Decreasing skills necessary to be a computer hacker
  4. International organized crime taking over cybercrime
  5. Lack of management support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Why are Human Errors relevant to IT?

A

There are two important points to be made about employees
The higher the level of the employee, the greater the threat they pose to information security
Employees in two areas of the organization pose especially significant threats to information security: human resources and information systems (IS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some Human Erros?

A

Carelessness with laptops and other computing devices
Opening questionable e-mails
Careless internet surfing
Poor password selection and use
Carelessness with one’s office
Carelessness using unmanaged devices
Carelessness with discarded equipment
Carelessness monitoring of environmental hazards

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is social engineering?

A

It is an attack in which the perpetrator uses social skills to trick or manipulate a legitimate employee into providing confidential company information such as passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are some techniques of social engineering?

A

Impersonation: presenting to be a company manager of an information systems employee
Tailgating: following behind an employee to enter restricted areas
Shoulder surfing: watching over someone’s shoulder to view data or passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When does espionage or trespass occur?

A

It occurs when an unauthorized individual attempts to gain illegal access to organizational information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is competitive intelligence?

A

Legal information-gathering techniques

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is industrial espionage?

A

It crosses the legal boundary

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is theft of equipment or information?

A

Small, powerful devices with increased storage such as laptops, smart phones, digital cameras, thumb drives, and iPods are becoming easier for attackers to use to steal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the causes of identity theft?

A

Stealing mail or dumpster diving
Stealing personal information in computer databases
Infiltrating organizations that store large amounts of personal information
Impersonating a trusted organization in an electronic communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is intellectual property?

A

It is a property created by individuals or corporations which is protected under trade secret, patent or copyright laws

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a trade secret?

A

Intellectual work that is a company secret and is not based on public information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is a patent?

A

Grants the holder exclusive rights on an invention or process for 20 years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is copyright?

A

Provides creators of intellectual property with ownership of the property for life of the creator plus 50 years

23
Q

What is piracy?

A

It is copying a software program without making payment to the owner

24
Q

What are the types of software attacks?

A

Remote attacks requiring user action: virus, worm, phishing attack, spear phishing attack
Remote attacks needing no user action: denial-of-service attack, distributed denial-of-service attack
Attacks by a programmer developing a system: Trojan horse, back door, logic bomb

25
Q

What is Alien Software?

A

It is clandestine software that is installed on your computer without your knowledge also known as pestware

26
Q

What is adware?

A

It is software that causes pop-up advertisements to appear on your screen

27
Q

What is spyware?

A

Collects personal information about users without their consent

28
Q

What are keystroke loggers?

A

They record your individual keystrokes (including passwords) and your browsing history

29
Q

What are screen scrapers (screen grabbers)?

A

Record your screen activity

30
Q

What is spamware?

A

It is unsolicited e-mail, usually advertising for products and services

31
Q

What are cookies?

A

They are small amounts of information that Web sites store on your computer, temporarily or more or less permanently; are used to enable you to log in to your favourite web sites

32
Q

What are tracking cookies?

A

Track your actions on a particular web site, such as what you looked at and how long you were there

33
Q

What are SCADA systesm?

A

They are used to monitor or to control chemical, physical, and transport processes

34
Q

What is cyberterrorism and cyberwarfare?

A

It refers to malicious acts in which attackers use a target’s computer systems, particularly via the internet, to cause physical real-world harm or sever disruption, usually to carry out a political agenda

35
Q

What are the difficulties in protecting information resources?

A

100s of threats
Many locations of computing resources
Broad access to information assets
Difficult to protect distributed networks
Rapid technological changes
Crimes can go undetected for long periods of time
Violation of “inconvenient” security procedures
Minimal knowledge needed to commit crimes
High costs of prevention
Difficult to conduct a cost-benefit justification

36
Q

What does risk management consist of?

A

Risk analysis
Risk mitigation
Controls evaluation

37
Q

What are the 3 steps of risk analysis?

A
  1. Assessing the value of each asset being protected
  2. Estimating the probability that each asset will be compromised
  3. Comparing the probable costs of the assets being compromised with the costs of protecting that asset
38
Q

What are the 2 functions of risk mitigation?

A

Implementing controls to prevent identified threats from occurring
Developing a means of recovery should the threat become a reality

39
Q

What are the three most common risk mitigation strategies?

A

Risk acceptance: accept the potential risk, continue operating with no controls, and absorb any damages that occur
Risk limitation: limit the risk by implementing controls that minimize the impact of the threat
Risk transference: transfer the risk by using other means to compensate for the loss, such as by purchasing insurance

40
Q

What are evaluation controls?

A

The organization identifies security deficiencies and calculates the cost of implementing controls
If the costs of implementing a control is greater than the value of the asset being protected, the control is not cost effective
Effective management reporting improves an organization’s ability to design and evaluate controls

41
Q

What is a control environment?

A

It encompasses management attitudes towards controls, as evidenced by management actions, as well as by stated policies that address ethical issues and quality of supervision

42
Q

What are the categories of general controls?

A

Physical: walls, doors, fencing, gates, locks, badges, guards, alarm systems, pressure sensors, and motion detectors
Access controls: can be physical or logical
Communication: firewalls, anti-malware systems, whitelisting and blacklisting, encryption, virtual private networks, transport layer security (TLS), and employee monitoring systems

43
Q

What is authentication?

A

To authenticate authorized personnel, an organization can use one or more of the following types of methods: something the user is, something the user has, something the user does, or something the user knows

44
Q

What are the basic guidelines for making strong passwords?

A

Difficult to guess
Long rather than short
Uppercase letters, lowercase letters, numbers, and special characters, do not use recognizable words
do not use the name of anything or anyone familiar
do not use a recognizable string of numbers

45
Q

What is authorization?

A

It determines which actions, rights, or privileges the person has, based on his or her verified identity

46
Q

What is a privilege?

A

It is the computer operations that a user is allowed to perform

47
Q

What is least privileg?

A

Users are granted the privilege for activities only if they need it for their job

48
Q

What are the advantaged of VPNs?

A

Allow remote users to access the company network
Provide flexibility to access the network remotely
Organizations can impose their security policies through VPNs

49
Q

What is input?

A

Edits that check for reasonable data ranges

50
Q

What is processing?

A

Automatically checks that each line of an invoice adds to the total

51
Q

What is output?

A

Supervisor reviews payroll journal ofr unisual amounts

52
Q

What is the purpose of Business Continuity Planning?

A

Provide continuous availability

53
Q

What are the strategies that organizations commonly use in the event of a major disaster?

A

Hot sites
Warm sites
Cold sites
Off-site data storage

54
Q

What are the types and examples of auditors?

A

External: public accounting firm
Government: Canada Revenue Agency
Internal: work for specific organizations
Specialist: IT auditors

BTM 226 (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions