Test 2 Flashcards
Threats to AIS
- Natural and political disasters
- Software errors and equipment malfunctions
- Unintentional acts
- Intentional Acts
An intentional act where the intent is to destroy a system or some of its components
Sabotage
Gaining an unfair advantage over another person
Fraud
Legally, for an act to be fraudulent there must be:
- False statement, representation, disclosure
- Material facts
- An intent to deceive
- Justifiable reliance
- Injury or loss
Typically, business people who commit fraud. Criminals usually resort trickery or cunning, and their crimes usually involve a violation of trust or confidence
white-collar criminals
Dishonest conduct by those in power and it often involves actions that are illegitimate, immoral, or incompatible with ethical standards
Corruption
Misrepresenting or leaving out facts in order to promote and investment that promises fantastic profits with little or no risk
Investment fraud
The theft of company assets by employees
Misappropriation of assets
Fraudulent financial reporting
Intentional or reckless conduct, whether by act or omission, that results in materially misleading financial statements
4 actions to reduce fraudulent financial reporting
- Establish an environment that contributes to integrity
- Identify and understand factors that lead to fraudulent financial reporting
- Assess the risk of fraudulent reporting within the company
- Design and implement internal controls
SAS requires auditor’s to:
- Understand fraud
- Discuss the risks of material fraudulent misstatements
- Obtain information
- Identify, assess, and respond to risks
- Evaluate the results of their audit tests
- Document and communicate findings
- Incorporate a technology focus
Fraud Triangle
- Opportunity
- Rationalization
- Pressure
A person’s incentive or motivation for committing fraud
Pressure
The condition or situation that allows a person or organization to commit and conceal a dishonest act and convert it to a personal gain
Opportunity
Concealing the theft of cash by means of a series of delays in posting collections to accounts receivable
Lapping
Customer A, B, C…
Cash is created using the lag between the time a check is deposited and the time it clears the bank
Check kiting
Allows perpetrators to justify their illegal behavior
- justification, attitude, lack of personal integrity
Rationalization
Any type of fraud that requires computer technology to perpetrate it
Computer fraud
Computer fraud classifications
- Input fraud
- Processor fraud
- Data fraud
- Output fraud
- Computer instructions fraud
Input fraud
Simplest and most common way to commit a computer fraud is to alter or falsify computer inout
Processor fraud
Includes unauthorized system use, including the theft of computer time and services
Computer instructions fraud
Includes tampering with company software, copying software illegally, using software in an unauthorized manner, and developing software to carry out an unauthorized activity
Data fraud
illegally using, copying, browsing, searching, or harming company data
Output fraud
Output can be stolen, copied, or misused
- television like signals
A probability distribution for the likelihood of a digit in a large set of naturally occurring numbers
Benford’s Law
6 steps criminals use to attack information systems
- Conduct reconnoissance
- Attempt social engineering
- Scan the map target
- Research
- Execute the attack
- Cover tracks
The unauthorized access, modification, or use of an electronic device or some element of a computer system
Hacking
Gaining control of a computer to carry out illicit activities without the user’s knowledge
Hijacking
Short for robot network, is a powerful network of hijacked computers, called zombies, that are used to attack systems or spread malware
Botnet
Hijacked computers, typically part of a botnet, that are used to launch a variety of internet attacks
Zombies
Installs software that responds to the hacker’s electronic instructions on unwitting PCs
Bot herder
The attacker sends so many e-mail bombs or web page requests, often more randomly generated false addresses, that the internet service provider’s e-mail server or the web page server is overloaded and shuts down
Denial-of-service attack (DoS)
A trial-and-error method that uses software to guess information, such as the user ID and the password, needed to gain access to a system
Brute force attack
(1) the computing power used and (2) enough time to generate the number of combinations needed
Passwords stored in or transmitted by a computer system are recovered by trying every possible combination of upper- and lower-case letters, numbers, and special characters and comparing them to a cryptographic hash of the password
Password cracking
Software generates user IDs and password guesses using a dictionary of possible user IDs and passwords to reduce the number of guesses required
Dictionary attack
Simultaneously sending the same unsolicited message to many people at the same time, often in an attempt to sell something
Spamming
Making an e-mail appear as though it originated from a different source
E-mail spoofing
Making an electronic communication look as if someone else sent it to gain the trust of the recipient
Spoofing
Displaying an incorrect number on a caller ID display to hide the caller’s identity
Caller ID spoofing
Creating Internet protocol (IP) packets with a forged source IP address to conceal the identity of the sender or to impersonate another computer system
IP address spoofing
Using the short message service (SMS) to change the name or number a text message appears to come from
SMS spoofing
software program flaws that a hacker can exploit to either crash a system or take control of it
Vulnerabilities
an attack between the time a new software vulnerability is discovered and the time a software developer releases a patch that fixes the problem
zero-day attack
code released by software developers that fixes a particular vulnerability
patch
a vulnerability in dynamic web pages that allows an attacker to bypass a browser’s security mechanisms and instruct the victim’s browser to execute code, thinking it came from a desired website
Cross-site scripting (XSS)
Happens when the amount of data entered into a program is greater than the amount of memory (the input buffer) set aside to receive it
buffer overflow attack
Malicious code in the form of an SQL query is inserted into input so it can be passed to and executed by an application program
SQL injection attack
Places a hacker between a client and a host and intercepts network traffic between them
man-in-the middle attack
Pretending to be an authorized user to access a system
masquerading/impersonation
an unauthorized party gains access to some system in connection with an authorized party
piggybacking
programming a computer to dial thousands of phone lines searching for dial-up modem lines
War dialing
driving around looking for unprotected wireless networks
war driving
attacking phone systems to obtain free phone line access; use phone lines to transmit malware; and access, steal, and destroy data
Phreaking
Using a small device with storage capacity, such as an iPod or flash drive, to download unauthorized data
Podslurping
Stealing tiny slices of money from many different accounts
Salami technique
All interest calculations are truncated at two decimal places and the excess decimals put into an account the perpetrator controls
round-down fraud
Theft of information, trade secrets, and intellectual property
Economic espionage
Using an internet auction site to defraud another person
Internet action fraud
Using the internet to pump up the price of a stock and then selling it
Internet pump-and-dump fraud
Investors are defrauded in a variety of cryptocurrency-related fraud schemes
cryptocurrency fraud
Manipulating click numbers to inflate advertising bills
Click fraud
The unauthorized copying or distribution of copyrighted software
software piracy
Techniques or psychological tricks used to get people to comply with the perpetrator’s wishes in order to gain physical or logical access to a building, computer, server, or network - usually to get the information needed to access system and obtain confidential information
Social engineering
Assuming someone’s identity, usually for economic gain, by illegally obtaining and using confidential information, such as a social security number or a bank account or credit card number
Identity theft
Using an invented scenario to increase the likelihood that a victim will divulge information or do something
Pretexting
Creating a seemingly legitimate business, collecting personal info while making a sale, and never delivering the product
Posing
Sending an electronic message pretending to be a legitimate company, usually a financial institution, and requesting information or verification and often warning of a negative consequence if it is not provided
Phishing
Voice phishing, is like phishing except the victim enters confidential data by phone
Vishing
Activities performed on stolen credit cards, including making online purchases
Carding
Redirecting website traffic to a spoofed website
Pharming
Wireless network with the same name as a legitimate wireless access point
Evil twin
setting up similarly named websites so that users making typographical errors when entering a website name are sent to an invalid site
Typosquatting/ URL hijacking
Searching documents and records to gain access to confidential information
Scavenging/dumpster diving
Perpetrators look over a person’s shoulders in a public place to get information such as ATM PIN numbers or user IDs and passwords
Shoulder surfing
The perpetrator inserts a sleeve into an ATM that prevents the ATM from ejecting the card
Lebanese looping
Double-swiping a credit card in a legitimate terminal or covertly swiping a credit card in a small, hidden, handheld card reader that records credit card data for later use
Skimming
Planting a small chip that records transaction data in a legitimate credit card reader
chipping
Any software that is used to do harm
Malware
Software secretly monitors and collects personal information about users and sends it to someone else
- gathered by logging keystrokes, monitoring websites visited, and scanning documents on the computer’s hard drive
Spyware
Spyware that can pop banner ads on a monitor, collect information about the user’s web-surfing and spending habits, and forward it to the adware creator
Adware
Software records computer activity, such as user’s keystrokes, e-mails sent and received, websites visited, and the chat session Participation
Keylogger
Set of malicious computer instructions in an unauthorized and otherwise properly functioning program
Trojan horse
Processes implemented to provide reasonable assurance
Internal Controls
Deter problems before they arise. Examples include hiring qualified personnel, segregating employee duties, and controlling physical access to assets and information
Preventative controls
Discover problems that are not prevented. Examples include duplicate checking of calculations and preparing bank reconciliations and monthly trial balances
Detective controls
Identify and correct problems as well as correct and recover from the resulting errors. Examples include maintaining backup copies of files, correcting data entry errors, and resubmitting transactions for subsequent processing
Corrective controls
Make sure an organization’s control environment is stable and well managed. Examples include security; IT infrastructure; and software acquisition, development, and maintenance controls
General controls
Prevent, detect, and correct transaction errors and fraud in application programs. They are concerned with the accuracy, completeness, validity, and authorization of the data captured, entered, processed, stored, transmitted to other systems, and reported
Application controls
Describes how a company creates vale, helps employees understand management’s vision, communicates company core values, and inspires employees to live by those values
Belief system
Helps employees act ethically by setting boundaries on employee behavior
Boundary system
