Assurance, Security and Prvy - Chapter 2

Attacks on information systems are a daily occurrence

Attacks on information systems are a rare occurrence

Primary mission of information security is to ensure systems and contents stay the same

Primary mission of information security is to ensure systems and contents are always changing

What do organizations protect when it comes to information security?

An object, person, or other entity that represents a constant danger to an asset

Management must be informed of the different threats facing the organization

Existence of a weakness that can lead to undesirable event compromising the system

A breach of an IT system through vulnerability

If no threats existed, resources could be focused on improving systems, resulting in vast improvements in ease of use and usefulness

Management (general and IT) is responsible for implementation

Only IT is responsible for implementation

Information security is both management issue and people issue

Information security is a management issue only.

Organization should address information security in terms of business impact and cost

Organization should not address information security

Organization needs environments that safeguard applications using IT systems

Organization does not need environments that safeguard applications using IT systems

Management must continue to oversee infrastructure once in place, not relegate to IT department

Management must relegate infrastructure to IT department

Organization, without data, loses its record of transactions and/or ability to deliver value to customers

Organizations can still deliver value to its customers and record transactions even without data

Protecting data in motion and data at rest are both critical aspects of information security

Protecting data in motion is the only critical aspect of information security

Organizations must have secure infrastructure services based on size and scope of enterprise

Organizations must have insecure infrastructure services based on size only

Additional security services may be needed as organization grows

No additional security services is needed even if the organization grows

More robust solutions may be needed to replace security programs the organization has outgrown

No robust solution is needed to replace security programs the organization has outgrown

Piracy, copyright infringement

Viruses, worms, macros, denial of service

ISP, power, or WAN service issues from service providers

Unauthorized access and/or data collection

Fire, flood, earthquake, lightning

Accidents, employee mistakes

Blackmail, information disclosure

Loss of access to information systems due to disk in place drive failure without proper backup and recovery plan organizational policy or planning

Network compromised because no firewall security controls

Destruction of systems or information

Illegal confiscation of equipment or information

Equipment failure

Bugs, code problems, unknown loopholes

Antiquated or outdated technologies

Ownership of ideas and control over the tangible or virtual representation of those ideas

The most common IP breaches involve ______

Which one is a watchdog organization that investigates software abuse?

Which one is a watchdog organization that investigates software abuse?

Enforcement of copyright law has been attempted with technical security mechanisms

Enforcement of copyright law has never been attempted

Acts or actions that exploits vulnerability (i.e., an identified weakness) in a system

Accomplished by threat agent (e.g. Hacker or script) that damages or steals organization’s information

What are the two types of software attacks?

Includes execution of viruses, worms, Trojan horses, and active Web scripts with intent to destroy or steal information

Transmission of a virus hoax with a real virus attached; more devious form of attack

______ is designed to damage, destroy, or deny service to target systems

Which one is a type of malware?

Which one is a type of malware?

Which one is a type of malware?

Which one is a type of malware?

Which one is a type of malware?

Which one is a type of malware?

Which one is a type of malware?

A small program written to alter the way a computer operates, without the permission or knowledge of the user.

Programs that replicate themselves from system to system without the use of a host file.

Files that claim to be something desirable but, in fact, are malicious.

Attacker sends large number of requests to a target

Target system cannot handle successfully along with other, legitimate service requests - May result in system crash or inability to perform ordinary functions

Coordinated stream of requests is launched against target from many locations simultaneously

Attacker routes large quantities of e-mail to target

Floods the target with requests

Use Zombie computers to launch the attack

Program or device that monitors data traveling over network; can be used both for legitimate purposes and for stealing information from a network

Technique used to gain unauthorized access; intruder assumes a trusted IP address

Attacker monitors network packets, modifies them, and inserts them back into network

Using social skills to convince people to reveal access credentials or other valuable information to attacker

An attempt to gain personal/financial information from individual, usually by posing as legitimate entity

Redirection of legitimate Web traffic (e.g., browser requests) to illegitimate site for the purpose of obtaining private information

Unsolicited commercial e-mail; more a nuisance than an attack, though is emerging as a vector for some attacks

Don’t believe everything you read and don’t help spread hoaxes - Be smart about it - Breaking news don’t come from your friends (there are sources for news)

______ is the overall performance of a network as seen by the users

We have expectations. Problems occur when our expectations are not met.

Information system depends on many interdependent support systems

Information system depends on many interdependent support systems, such as:

Internet service, communications, and power irregularities dramatically affect availability of information and systems

Access of protected information by unauthorized individuals

Competitive intelligence is ______

Industrial espionage is ______

______ can occur anywhere a person accesses confidential information

Without full understanding, uses software written by others to exploit a system

A master of many skills who develops software scripts and program exploits

Removes software protection designed to prevent unauthorized duplication

Hacks the public telephone network

Includes acts performed without malicious intent (Inexperience - Improper training)

Employees are among the greatest threats to an organization’s data

Employees are the least threating aspect to an organization’s data

Which one is not considered a human error?

Which one is not considered a human error?

Many of human error threats can be prevented with controls

All human errors can be prevented by using controls

______ is defined as the practice of obtaining something, especially money, through force or threats

Attacker steals information from computer system and demands compensation for its return or nondisclosure

Internal threat due to Missing, Inadequate, or Incomplete organizational policies and/or controls

Threats can range from petty vandalism to organized sabotage, such as ______

Threats can range from petty vandalism to organized sabotage

Threat of hacktivist or Cyber-activists groups is rising

Threat of hacktivist or Cyber-activists groups is declining

Much more sinister form of hacking

Web site defacing can erode consumer confidence, dropping sales and organization’s net worth

Web site defacing can increase consumer confidence, sales and organization’s net worth

Theft can be physical or digital

Theft is physical only

Directly associated with physical security (stealing a laptop for example)

Is often more technical and complex

Bugs and poorly written ______ can lead to serious security breaches

______ defects can lead to failure and ultimately affect system and business operations

An example of Technical Failure: Software is ______

Antiquated/outdated infrastructure can lead to unreliable, untrustworthy systems

Proper managerial planning should prevent technology obsolescence

Proper managerial planning cannot prevent technology obsolescence