1What is the process of reviewing known vulnerabilities and threats?
2What is an example of something that can expose confidentiality?
shoulder surfing
3Is it true that social engineering any technology that secretly gathers information about a person or organization?
it is false
4 What method is controlled entry into a facility and provides access to secure areas such as a research lab or data center?
mantrap
5List the required practices of the separation of duties principle.
that 2 or more employees must split critical task functions so that no new employee knows all of the steps of the critical task
6 What is risk mitigation?
it refers to applying safeguards designed to lower risks to a level deemed acceptable but without eliminating such risks.
7What is the window of vulnerability?
the period of time when an attacker may launch a Dos Attack.
8What is vulnerability?
a weakness or flaw in a information system.
9What is exploit?
a successful attack against a vulnerability.
10What is mitigation?
safguarding assets
11What is a threat?
anything that can harm an information system.
12What is risk?
likelihood that a threat will exploit a vulnerability
13What is safeguard?
reduces harm posed from information security vulnerabilities or threats
14What are the mechanisms that ensure information security?
1. Laws and legal duties 2. Contracts 3. Organizational Governance
15What are laws and legal duties?
an organization must make sure that it follows all the laws that apply to it.
16What are contracts?
an organization cannot avoid its legal duties by outsourcing functions.
17What is organizational governance?
1. Policies: How an organization must act and the consequences for failing to act properly 2. Standards: State the activities and actions needed to meet policy goals.
3. Procedures: Step by step checklists that explain how to meet security goals 4. Guidelines: Tell users about information security concerns and suggests ways to deal with them.
18What are the data protection models?
Public (government) Private(corporations)
19Name laws that influenced information security.
1. Gramm-Leach Bililey Act 2. Red Flags Rule 3. Sarbanes-Oxley Act 4.Payment Card industry standards 5. state breach notification acts
20What is shoulder surfing?
the practice of spying on the user of an atm, computer or other electronic device in order to obtain their personal access information.
21What is Phishing?
a target is conacted by email, telephone or other means by posing as a legitimate institution to lure individuals into providing sensitive data.
22What is malware?
software that is specifically designed to disrupt, damage or gain unauthorized access to a computer system.
23What is spyware?
software that enables a user to obtain convert information about another computers activities by transmitting data covertly from their hard drive.
24What are logic bombs?
a set of instructions secretly incorporated into a program so that if a particular condition is satisfied, they will be carried out, usually with harmful effects.
25What are “backdoors”?
refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access.
26What are Denial of Service attacks?
uses only a small number of attacking systems to overload the target.