Accounting 3600 Chapter 7

Front 1

system reliability

Back 1

information generated by systems must be reliable in order to be useful in decision making

Front 2

1) security
2) confidentiality
3) privacy
4) processing integrity
5) availability

Back 2

trust services framework 5 components of system reliability

Front 3

security

Back 3

access to system and data is controlled; FOUNDATION

Front 4

confidentiality

Back 4

sensitive company information is protected from unauthorized disclosure

Front 5

privacy

Back 5

personal data about customers is collected, used, and stored in an appropriate way

Front 6

processing integrity

Back 6

data in systems is processed accurately, timely, completely, with proper authorization

Front 7

availability

Back 7

system can be accessed when needed

Front 8

time based model of security

Back 8

used to determine how effective a company's security procedures are; used to determine the appropriate mix of detective/corrective controls

Front 9

P - time it takes to break thru preventive controls
D - time it takes to recognize that there is a breach
C - time it takes to respond to the attack

Back 9

3 variables in time based model of security

Front 10

P > D+C

Back 10

effective security procedures equation

Front 11

1. difficult to reasonably estimate values
2. changes in technology make estimates quickly obsolete

Back 11

main problems/disadvantages with the time based model of security

Front 12

defense in depth

Back 12

used for day-to-day management of security procedures; employing multiple layers of controls; redundant

Front 13

1. access
2. physical access
3. training
4. encryption

Back 13

4 preventive controls for security

Front 14

1. authentication
2. authorization

Back 14

2 aspects of access controls

Front 15

authentication

Back 15

process of verifying the identity of the person/device attempting to access the system

Front 16

authorization

Back 16

limiting where authenticated users can go in the system and restricting what actions can be performed

Front 17

1. passwords
2. smart card/id badge
3. biometric identifiers

Back 17

3 authentication controls

Front 18

1. length
2. random
3. combination
4. changed frequently
5. secret

Back 18

5 characteristics of a strong password

Front 19

biometric identifier

Back 19

physical characteristics used to authenticate someone

Front 20

multifactor identification

Back 20

using more than one authentication control technique

Front 21

access control matrix

Back 21

authorization control - matrix of user/access - compatibility test used to match authentication credentials

Front 22

physical access controls

Back 22

access controls for buildings/rooms (keeping all doors locked except one)

Front 23

training

Back 23

preventive control for security for employees

Front 24

social engineering

Back 24

tricks that a fraudsters use to get employees to divulge confidential information

Front 25

phishing

Back 25

act of attempting to acquire information (usernames, passwords) using thru fake webpages

Front 26

piggybacking

Back 26

social engineering technique here an unauthorized user follows an authorized user thru a locked door

Front 27

encryption

Back 27

process of taking normal language plain speak --> unreadable gibberish (cipher text)

Front 28

1. log analysis
2. security testing

Back 28

2 detective controls for security

Front 29

log

Back 29

system tracking who has access to the system and what action they have performed

Front 30

log analysis

Back 30

process of regularly reviewing logs to identify potential attackers

Front 31

1. failed login attempts
2. failed attempts to perform some action

Back 31

log analysis searching for: (2 things)

Front 32

1. legitimate user not remembering password
2. legitimate user attempting to perform an unauthorized action
3. external intruder trying to gain access

Back 32

possible reasons for things found in log analyses (3)

Front 33

penetration test

Back 33

aspect of security testing - authorized attempt by internal audit team or external security consulting firm to break into the system

Front 34

1. CIRT team
2. patch management system

Back 34

2 correct controls for security

Front 35

computer incident response team CIRT

Back 35

team responsible for dealing with all major security issues

Front 36

1. recognition
2. containment
3. recovery
4. follow up

Back 36

incident response process

Front 37

recognition

Back 37

incident response process - understand/recognize that there is a problem; result of log analysis

Front 38

containment

Back 38

incident response process - isolate damage, prevent spread to other parts of the system

Front 39

recovery

Back 39

incident response process - fix damage caused by the breach

Front 40

follow up

Back 40

incident response process -
1. understand/analyze problem
2. modify security procedures

Front 41

patch management system

Back 41

correct control for security - fix known vulnerabilities in security software, operating systems, other application programs

Front 42

patches

Back 42

the most recent fix; code that repairs