Security Part 2 Flashcards
What is computer security?
the policies, procedures and technical measures used to prevent unauthorized access, alteration, theft, interruption or physical damage to information systems
What are the 6 security services?
authentication access control data confidentiality data integrity availability non-repudiation
Define authetication
assurance that the other party is the one
claimed (i.e. not an imposter)
Define access control
prevention of the unauthorized use of a
resource
Define data confidentiality
protection of data from unauthorized
disclosure
Define data integrity
assurance that data received is exactly what authorized entity sent (i.e. it has not been tampered with).
Define availability
assurance that services are available when needed
Define non-repudiation and two types
protection against denial by one of the
parties in a communication
1) the sender denies sending the data
2) the receiver denies receiving the data
How to password crackers work? (3)
-try common passwords
-words with a suffix + variations
to target a specific person gather info about them
What are the 3 authentication approaches to control access?
- something you know (password)
- something you have (card, token)
- something you are (biometrics)
Best method for passwords (2)
Use a password manager or convert a phrase meaningful to you
What are 4 ways to secure your system? (bare minimum)
- software/hardware firewalls
- look for unusual activities
- antivirus software -> look for bit patterns in programs called a signature
What are 2 best practices for securing your system?
isolate and encrypt sensitive data
minimize your attack surface
how can you effectively isolate and encrypt sensitive data?
AES-256 encrypted documents are safe
have a separate user account for banking and financial activities
how can you minimize your attack surface?
configure the firewall in your OS and your modem/router
disconnect from internet when not in use
Explain the business value of security and control
Inadequate security and control can result in lost of business and may create serious legal liabilities.
Failure to do so can lead to costly litigation for data exposure or theft.
What are the legal and regulatory requirements for security/control?
companies must be able to respond to legal requests for electronic documents relevant to a civil case (a discovery request)
Internal controls must be put in place to govern the accuracy of information in financial statements
What is the bottom line for the security and control network?
Many companies assume that a disaster too improbable and so security and control is not worth the investment in time and
money
What is the greatest cause of computer security breaches?
Lack of knowledge or lack of motivation
What are the 6 tools for the security and control framework?
Risk assessment security policy acceptable use policy disaster recovery planning business continuity planning security auditing
Explain a risk assessment
To do a risk assessment is to determine the level of risk to the firm for various classes of risks
explain security policy (3)
A security policy identifies:
- main security risks (e.g. power failures)
- acceptable security goals (downtime ≤ 3 minutes per year)
- mechanisms to achieve these goals (uninterruptible power supplies + diesel generator backup)
Explain acceptable use policy
Acceptable Use Policy (AUP) states the acceptable uses and
users of information and computers
For example:
-privacy, user responsibility, personal use of devices, access rules for different employees
- technical measures used to enforce the policies
Explain disaster recovery planning
Getting the IT systems (computing and communication) up and running after a disruption
Example: back-up files and maintain back-up systems
Explain business continuity planning
Getting the business up and running after a disaster
What are the 3 steps in business continuity planning?
• Identify and document critical business processes
- not relying on people who may be unavailable.
- Create action plans for these processes.
- Line up offsite resources, e.g. the cloud.
Explain security auditing
A security audit investigates if the current security and control framework is adequate
Explain how to perform a security audit
Create a comprehensive assessment of a company’s computer security policies, procedures, technical measures, personnel, training, documentation
May even simulate an attack.
