Security - Chapter 17 Flashcards
A system that monitors network use for potential hacking attempts. Such a system may take preventative action to block, isolate, or identify attempted infiltration, and raise further alarms to warn security personnel.
Intrusion detection systems
An attack where a firm’s computer systems are flooded with thousands of seemingly legitimate requests, the sheer volume of which will slow or shut down the site’s use. These attacks are often performed via botnets.
distributed denial of service (DDoS)
A seemingly tempting, but bogus target meant to draw hacking attempts. By monitoring infiltration attempts against a these, organizations may gain insight into the identity of hackers and their techniques, and they can share this with partners and law enforcement.
honeypots
A two key system used for securing electronic transmissions. One key distributed publicly is used to encrypt (lock) data, but it cannot unlock data. Unlocking can only be performed with the private key. The private key also cannot be reverse engineered from the public key. By distributing public keys, but keeping the private key, Internet services can ensure transmissions to their site are secure.
public key encryption
A term that may, depending on the context, refer to either 1) breaking into a computer system, or 2) a particularly clever solution.
hack
Those scrambled character images that many sites require to submit some sort of entry (account setup, ticket buying) and are meant to be a Turing Test—a test to distinguish if a task is being performed by a computer or a human.
CAPTCHAs
An acronym for Completely Automated Public Turing Test to Tell Computers and Humans Apart
A term that, depending on the context, may be applied to either 1) someone who breaks into computer systems, or 2) to a particularly clever programmer.
hacker
Criminals that purchase assets from data harvesters to be used for illegal financial gain. Actions may include using stolen credit card numbers to purchase goods, creating fake accounts via identity fraud, and more.
cash-out fraudsters
Scrambling data using a code or formula, known as a cipher, such that it is hidden from those who do not have the unlocking key.
encryption
Attacks that are so new that they haven’t been clearly identified, and so they haven’t made it into security screening systems.
zero-day exploits
Highly restrictive programs that permit communication only with approved entities and/or in an approved manner.
whitelists
Programs that deny the entry or exit of specific IP addresses, products, Internet domains, and other communication restrictions.
blacklists
A trusted third party that provides authentication services in public key encryption schemes.
certificate authority
A con executed using technology, typically targeted at acquiring sensitive information or tricking someone into installing malicious software.
Phishing
Term used in security to refer to forging or disguising the origin or identity. E-mail transmissions and packets that have been altered to seem as if they came from another source are referred to as this.
spoofed
An attack that exhausts all possible password combinations in order to break into an account. The larger and more complicated a password or key, the longer this type of attack will take.
brute-force attack
Someone who uncovers computer weaknesses without exploiting them. Their goal is to improve system security.
white hat hackers
Code that unlocks encryption.
key
When identity is proven by presenting more than one item for proof of credentials. Multiple factors often include a password and some other identifier such as a unique code sent via e-mail or mobile phone text, a biometric reading (e.g. fingerprint or iris scan), a swipe or tap card, or other form if identification
multi-factor authentication
A protester seeking to make a political point by leveraging technology tools, often through system infiltration, defacement, or damage.
hacktivists
black hat hackers
A computer criminal.
Hordes of surreptitiously infiltrated computers, linked and controlled remotely, also known as zombie networks.
Botnets
Combing through trash to identify valuable assets.
dumpster diving
A system that acts as a control for network traffic, blocking unauthorized traffic while permitting acceptable use.
firewalls
Technologies that measure and analyze human body characteristics for identification or authentication. These might include fingerprint readers, retina scanners, voice and face recognition, and more.
Biometrics
Gaining compromising information through observation (as in looking over someone’s shoulder).
shoulder surfing
Cybercriminals who infiltrate systems and collect data for illegal resale.
data harvesters
honeypots
A seemingly tempting, but bogus target meant to draw hacking attempts. By monitoring infiltration attempts against a honeypot, organizations may gain insight into the identity of hackers and their techniques, and they can share this with partners and law enforcement.
Intrusion detection systems
A system that monitors network use for potential hacking attempts. Such a system may take preventative action to block, isolate, or identify attempted infiltration, and raise further alarms to warn security personnel.
distributed denial of service (DDoS)
An attack where a firm’s computer systems are flooded with thousands of seemingly legitimate requests, the sheer volume of which will slow or shut down the site’s use. DDoS attacks are often performed via botnets.
con games that trick employees into revealing information or performing other tasks that compromise a firm are known as
social engineering
Firms use information for what two purposes
Transactional purposes
Analytical purposes
Transactional purposes firms use information for
Day-to-day operations
Analytical purposes firms use information for
Trend analyses, forecasts, and input generation for strategies that improve profit or long-term sustainability - compete on analytics
Major purpose of a database
To keep track of related information about more than one thing
public key encryption
A two key system used for securing electronic transmissions. One key distributed publicly is used to encrypt (lock) data, but it cannot unlock data. Unlocking can only be performed with the private key. The private key also cannot be reverse engineered from the public key. By distributing public keys, but keeping the private key, Internet services can ensure transmissions to their site are secure.
DBMS
Database Management Systems
The set of defenses put in place to counter threats to technology infrastructure and data resources
Security
The process of identifying and measuring information systems security risks, and devising the optimal risk mitigation strategy
IT Risk Managment
social engineering
con games that trick employees into revealing information or performing other tasks that compromise a firm are known as
What is the CIA triad?
Confidentiality - integrity - availability
Fundamental conflict in security; balancing the three
If data cannot be seen by unauthorized people, its
Confidential
Involves ensuring the consistency, accuracy, and trustworthiness of data - data cannot be changed in transit and/or by unauthorized people
Integrity
If data can be accessed by people who should have access to it, it is appropriately ______.
Available
Why is it sometimes difficult to make the business case for security measures?
IT security risks are hard to assess in the absence of an attack
Security is a negative deliverable
Forward looking investment with hypothetical benefits
Recurring investment
IT departments have limited budgets
Integrity
Involves ensuring the consistency, accuracy, and trustworthiness of data - data cannot be changed in transit and/or by unauthorized people
Confidential
If data cannot be seen by unauthorized people
Security
The set of defenses put in place to counter threats to technology infrastructure and data resources
