Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Information Systems final > Security > Flashcards

Security Flashcards

1
Q

What is information security?

A

All the processes and policies designed to protect an orgs info and IS from unauthorized access, use, disclosure, disruption, modification, or destruction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Threat to an info source?

A

any danger to which a system may be exposed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the exposure of an info resource?

A

The harm, loss, or damage that can result if a threat compromises that resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is an info resources vulnerability

A

Possibility that a threat will harm that resource

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is cybercrime?

A

illegal activities conducted over computer networks, particularly the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are 5 factors contributing to vulnerability of organizational resources?

A
  1. Interconnected, interdependent, wirelessly networked business environment
  2. Smaller, faster, cheaper computers and storage devices
  3. Decreasing skills necessary to be a computer hacker
  4. International organized crime taking over cybercrime
  5. Lack of management support
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are human errors risk areas

A

Higher level employees and greater access privileges are a greater threat

2 areas: HR and IS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are human mistakes

A
  1. Carelessness with devices
  2. Opening questionable emails
  3. Careless internet surfing
  4. Poor passwords
  5. Carelessness with one’s office
  6. Carelessness using unmanaged devices
  7. Carelessness with discarded equipment
  8. Careless monitoring of environmental hazards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is social engineering

A

An attack in which the perpetrator uses social skills to trick a legitimate employee into providing confidential company information such as passwords

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are social engineering methods

A
  1. Impersonation: pretending to be a manager of an IS employee
  2. Tailgating: following behind an employee to enter restricted areas
  3. Shoulder surfing: watching over shoulder
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Examples of deliberate threats to IS

A
  1. Espionage
  2. Theft of equipment and info
  3. ID theft
  4. Software attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is espionage/trespass

A

Occurs when an unauthorized individual attempts to gain illegal access to an orgs info.

Used for competitive intelligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is identity theft

A

Deliberate assumption of another person’s identity, usually to gain access to their financial info or to frame them for a crime

Stealing mail, stealing personal info, infiltrating orgs that store large amounts of personal info, phishing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the types of software attacks?

A
  1. Remote attacks needing user action
  2. Remote attacks needing no user action
  3. Attacks by a programmer developing system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are types of remote attacks needing user action

A
  1. Virus: malicious actions by attaching to another computer program
  2. Worm: malicious actions and will spread by itself
  3. Phishing: deception to acquire info
  4. Spear phishing: attacks a large group of people
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are types of remote attacks needing no user action

A
  1. Denial-of-service attack: an attacker sends so many info requests to a computer system that the target cannot handle them successfully and crashes
  2. Distributed denial of service attack: first takes on many computers, these computers are zombies or bots, the attacker uses the bots to form a botnet to deliver coordinated stream of info requests to a target computer causing it to crash
17
Q

What are types of attacks by a programmer developing system

A
  1. Trojan horse: software program that hide in other computer programs and reveal their designed behaviour only when activated
  2. Back door: password only known to attacker that allows them to access a computer system at will
  3. Logic bomb: code that is embedded within an orgs existing computer programs designed to activate and perform destructive action under specific conditions
18
Q

What is a ransomware

A

Malicious software that blocks access to a computer system or encrypts an orgs data until the org pays a sum of money

19
Q

What are orgs doing to protect info resources

A

Risk management with 3 processes:
risk analysis
risk mitigation
controls evaluation

20
Q

What is involved in risk analysis

A
  1. Assessing the value of the asset
  2. Estimate the probability that each asset will be compromised
  3. Compare the probable cost of the asset being compromised with the cost of protecting it
21
Q

What is risk mitigation?

A

Process where an org takes concrete actions against risks

implementing controls to prevent threats from occurring and developing a means of recovery if the threat becomes a reality

22
Q

What are the most common risk mitigation strategies

A
  1. Risk acceptance: accept the potential risk, continue operating with no controls
  2. Risk limitation: implementing controls that minimize impact of threat
  3. Risk transference: transfer the risk by using other means to compensate for the loss, such as by purchasing insurance
23
Q

What are controls evaluation

A

Org identifies security deficiencies and calculates the costs of implementing adequate control measures to compare against the value of those measures

if the costs of implementing a control is greater than the value of the asset, the control is not cost effective

24
Q

What are info security controls

A
  1. Physical controls: stop unauthorized individuals. Walls, doors, gates…
  2. Access controls: physical or logical (PIN, password programs, advanced biometric security)
  3. Communication/network controls: can data securely move across your network. Firewalls, VPN
25
Q

What is authentication and authorization?

A

Authentication: confirms the ID of the person requiring access–> something the user is, something they have, something they do (signature), something they know (PIN)

Authorization: determines which actions, rights or privileges the person has, based on their verified ID

26
Q

What is encryption?

A

Process of converting an original message into a form that cannot be read by anyone except the intended receiver, all systems use a key which is the code that scrambles and decode the messages

27
Q

Symmetric vs symmetric key algorithms

A

Symmetric: encryption which use the same key for encryption and decryption

Asymmetric: a pair of keys a public key and private key
Public keys are used for encryption or signature verification
Private keys decrypt and sign

28
Q

What is a digital certificate

A

Electronic document attached to a file that certifies that the file if from the org it claims to be from and has not been modified from its original format

Information Systems final (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions