Various 2 Flashcards
The time when computer systems are susceptible to compromise while the system is loading and before the security front end becomes active is called? Computer software is also vulnerable to configuration changes at this time.
Initial program load (IPL)
An internationally recognized, government-mandated standard for crisis command during disaster recovery and business continuity events
Incident Command System (ICS)
A short sequence of six to eight characters used in type 1 (weak) authentication
Password
Creates reports that may be used only for internal purposes. These reports contain a known bias, which reduces their corresponding representations to a low or moderate value.
Internal audit
A malicious hacker program designed to unsuspectingly install a backdoor without the consent of the system user. This will subvert the operating system kernel security and operate in stealth to hide its existence.
Root kit
A check file of a fixed length created by a source file of any length. The purpose is to indicate whether the source file may have been changed.
Message hash
Having no significant bearing on the final outcome, also known as trivial information
Irrelevant
What are the names of the keys used for PKI?
The public key and the private (secret) key
Criteria based on impact, anticipated duration of outage, or immediate lack of sufficient information to calculate the actual impact. It’s always better to overreact when compared to the consequences of delay.
Activation criteria for business continuity and disaster recovery
The most common method of providing secure access to the network for a remote user that uses encryption
IPsec virtual private network (VPN)
To grant a right to perform some type of action
Authorization
The progressive development of software through a succession of multiple versions
Iterative development
An organization that is responsible for issuing and maintaining certificates
Certificate authority (CA)
The persons and organization being audited
Auditee
The lowest level of control, usually governing system use or internal program controls. These types of controls are easily subverted if higher-level controls governing the operating environment are missing or ineffective.
Application controls
The term used when an auditor has no reservations with their findings, and there are no special restrictions on the use of the audit report.
Unqualified opinion
The process of streamlining existing operations in an effort to improve efficiency and reduce cost. Benefits may be derived by eliminating unnecessary steps as the organization has progressed through the learning curve, or by expanding capability for more work.
Business process reengineering (BPR)
A less formal process used to determine value or relevance to the intended use. The results will be of low to moderate value. These results are used for internal purposes only.
Assessment
Multiple communication channels that are multiplexed over a single cable
Broadband
A historical score of business process performance. Unfortunately, the score may indicate that a failure has occurred before corrective action can be taken.
Key performance indicator (KPI)
When two or more obligators (persons or organizations) bind themselves without actual partnership or corporate designation in a specific venture with the risk, liability, and potential profits shared between the parties. All parties share a communal liability for the failure of the other party.
Joint venture
An engineering technique used to steal the secrets of your competitor for the purpose of developing your own product. Usually a violation of the software user license agreement.
Reverse engineering
Changing the normal function of keys to execute different commands
Keyboard remapping
What is the name of the protection method used when encryption keys are re-encrypted with a different algorithm using a different key to obscure the original key?
Key wrapping
Electronic access to a system without being physically present
Logical access
A best practice for recording the analysis of problems and improvements that worked
Lessons learned
A biometrics technique that maps the unique pattern of veins in the back of the human eyeball
Retinal scan
What is the purpose of a certification practice statement (CPS)?
The CPS is a formal document outlining the issuer’s certificate policy and enforcement policy.
The process of copying the current data files for records retention but ignoring deleted files and temporary system data in swap space
Logical backup
What are the most important actions to be taken when someone is terminated or laid off?
Disable user accounts, physically remove access to desktops, and collect any company property remaining in their possession
Early hierarchical design created by IBM for connecting different computers
Systems Network Architecture (SNA)
A method of transmitting data through a variety of different paths en route to its destination. The user is billed by the data packets sent and not by the route or distance traveled.
Packet-switched
Connection of redundant network links
Meshed network
A potential danger that, if realized, will have a negative effect on assets
Threat
A computer system or network device to be evaluated under the Common Criteria standard (ISO 15408)
Target of evaluation (TOE)
A term for utility software that operates on the program interfaces and is invisible to both the user and the database server. Performs an intermediary service between two programs.
Middleware
Lower-level controls placed on specific procedures
Detailed controls
The ability for hardware and software systems from different manufacturers to communicate with each other
Interoperability
To conserve processing, space occupied by these files is simply marked as eligible for overwriting. The contents remain on the disk.
Deleted files
A programmed procedure inside a computer software application designed to cause damage on the occurrence of a particular event, date, or time. Extremely difficult to locate.
Logic bomb
