Writing Assignment: Module 01

Question 1

What is information security?

Answer 1

information security is a term refering to many interlinked programs and activities that work together to create confidentiality, integrity, and availability for the information used by organizations.

Question 2

How is the CNSS model of information security organized?

Answer 2

Committee on National Security Systems (CNSS)
Confidentiality, Integrity, Availability on the (Y axis),
Policy, Education, Technolgy (Z axis),
Storage, Processing and Transmission on the (X axis)

Question 3

What three principles are used to define the C.I.A. triad? Define each in the context in which it is used in information security.

Answer 3

Confidentiality, integrity and availability

Confidentiality is roughly equivalent to privacy.

Integrity involves maintaining the consistency, accuracy and trustworthiness of data.

Availability means the information should be consistently ready and accessible.

Question 4

What is a threat in the context of information security?

Answer 4

Any event or circumstance that has the potential to adversely affect operations and assets

Question 5

What is an asset in the context of information security?

Answer 5

organizational resource that is being protected be that be a Web site, software information, or data. Assets can also be physical, such as a person, a computer system, hardware, or other tangible objects.

Question 6

What is an attack in the context of information security?

Answer 6

an attempt to gain unauthorized access to a computer, system or network with the intent to cause damage be that disabling, disrupting, destroing or controling a computer system, by the means of altering, blocking, deleting, manipulating or stealing the data held within these systems

Question 7

What is a vulnerability in the context of information security?

Answer 7

A potential weakness in an asset or its defensive control system(s)

Question 8

What is a loss in the context of information security?

Answer 8

a single instance of a information asset that suffers damage or destruction, unintended or unauthorized modification or disclosure, or denial of use. As one example, when an organization’s informatio is stolen, it has suffered a loss.

Question 9

What is intellectual property? Describe at least one threat to this type of asset.

Answer 9

intellectual property can be trade secrets, proprietary processes, copyrights, trademarks, and patents. An attack on that could be stealing identifiable information of individuals

Question 10

What is an availability disruption? Pick a utility service provider and describe what might constitute a disruption.

Answer 10

A reduced level of service in an element of the critical infrastructure. CenturyLink a power outage could be considers a disruption to serveices

Question 11

What is a hacker and what are terms used to describe their skill levels?

Answer 11

a hackeris someone who spends long hours examining the types and structures of targeted system, the level of a hacker comes down to if they are an expert hacker or a novice hacker

Question 12

How does a brute force password attack differ from a dictionary password attack?

Answer 12

a Brute Force password attack trys every possible password combination, a Dictionary attack trys common passwords and includes information related to the target user, such as names of relatives or pets, and familiar numbers such as phone numbers, addresses, and even Social Security numbers.

Question 13

What is phishing, and how is spear phishing different?

Answer 13

Phishing attacks use two primary techniques, often in combination with one another: URL manipulation and Web site forgery. Phishing attacks aim to decive and fool as meny people as posible. spear phishing involves an attacker sending a targeted message that appears to be from an employer, a colleague, or some other legitimate correspondent.

Question 14

In general terms, what is policy?

Answer 14

a statement or set of principles of action to follow to help guide and regulate employee behavior.

Question 15

What is an enterprise information security policy, and how is it used?

Answer 15

a high-level information security policy that sets the strategic direction, scope, and tone for all of an organization’s security efforts.

Question 16

Why is shaping policy considered difficult?

Answer 16

Shaping policy is difficult because it must not conflict with laws, must stand up in court if challenged, and must be properly administered.

Question 17

What are standards? How are they different from policy?

Answer 17

Policies act as a statement, standards function as rules to achieve that statement

Question 18

What is an issue-specific security policy?

Answer 18

An ISSP is a organizational policy that provides detailed, targeted guidance to instruct all members of the organization in the use of a resource.

Question 19

List the critical areas covered in an issue-specific security policy.

Answer 19

Statement of policy, Authorized access and usage of technology, Prohibited usage of technology, Systems management, Violations of policy, Policy review and modification, Limitations of liability.

Question 20

What is a systems-specific security policy?

Answer 20

SysSPs are Organizational policies that often function as standards or procedures to be used when configuring or maintaining systems

Question 21

When is a systems-specific security policy used?

Answer 21

its used in configuring and maintaining systems

Question 22

What is risk management?

Answer 22

is forecasting and evaluation of potential risks

Question 23

What are the two main parts of risk management?

Answer 23

risk management framework and the risk management process.

Question 24

Who is expected to be engaged in risk management activities in most organizations?

Answer 24

The Risk Manager

Question 25

What are the basic strategies used to control risk? Define each.

Answer 25

Defense—Applying controls and safeguards that eliminate or reduce the remaining uncontrolled risk

Transference—Shifting risks to other areas or to outside entities

Mitigation—Reducing the impact to information assets should an attacker successfully exploit a vulnerability

Acceptance—Understanding the consequences of choosing to leave an information asset’s vulnerability facing the current level of risk, but only after a formal evaluation and intentional acknowledgment of this decision

Termination—Removing or discontinuing the information asset from the organization’s operating environment