Week 1 Unit 1 Legal Issues in Information Security- Information Systems Security Overview

Question 1

What is the “information security triad”?

Answer 1

Availability
Integrity
Confidentiality (AIC)

Question 2

Common information security concerns?

Answer 2

Shoulder surfing
Social Engineering
Spear phishing
Malware
Spyware
Logic bomb
Back door denial of service

Question 3

Data Classification: Military and Corporate

Answer 3

See Table 1

Question 4

Legal mechanisms to ensure information security

Answer 4

Laws
Information Regulations
Agencies

Question 5

Laws to ensure Information Security

Answer 5

Gramm-Leach-Bliley Act
HIPAA
Sarbanes-Oxley (SOX)
and others

Question 6

Information Regulations to ensure Information Security

Answer 6

Financial
Credit Card
Health
etc

Question 7

Agencies to ensure information security

Answer 7

FTC
Banks
DHHS
SEC
DOE
etc

Question 8

Risk Management Concepts

Answer 8

Vulnerability
Mitigation
Threat Agent
Exploits
Risks

Question 9

Vulnerability

Answer 9

Asset weaknesses

Question 10

Mitigation

Answer 10

Safeguard assets

Question 11

Threat Agent

Answer 11

Hacker or malware

Question 12

Exploits

Answer 12

Threats carried out

Question 13

Risks

Answer 13

minimized by asset owner

Question 14

Risk Management Process

Answer 14

See Chart 1

Question 15

Roles in Risk Management

Answer 15

See Chart 2

Question 16

Information Security in Different Contexts

Answer 16

See Table 2

Question 17

Access Control Models

Answer 17

Discretionary
Mandatory
Role-Based

Question 18

Discretionary Access control (DAC)

Answer 18

Discretion of the owner

Question 19

Mandatory Access Control (MAC)

Answer 19

Security labels & classifications

Question 20

Role-Based Access Control (RBAC)

Answer 20

Job function of role

Question 21

Law and Information Security

Answer 21

Cyberspace theft
Internet extortion
Online pedophilia
Jurisdiction issues
Electronic signature issues

Question 22

Confidentiality

Answer 22

Only people with the right permission can access and use information

Question 23

Integrity

Answer 23

Information systems and their data are accurate, and that changes cannot be mad to data without correct permissions

Question 24

Availability

Answer 24

Makes sure that data is accessible to the users