• Shuffle
    Toggle On
    Toggle Off
  • Alphabetize
    Toggle On
    Toggle Off
  • Front First
    Toggle On
    Toggle Off
  • Both Sides
    Toggle On
    Toggle Off
  • Read
    Toggle On
    Toggle Off
Reading...
Front

Card Range To Study

through

image

Play button

image

Play button

image

Progress

1/179

Click to flip

Use LEFT and RIGHT arrow keys to navigate between flashcards;

Use UP and DOWN arrow keys to flip the card;

H to show hint;

A reads text to speech;

179 Cards in this Set

  • Front
  • Back
Law of large numbers
States that as the number of observations increases, actual results will approach expected results.
Stakeholders
Persons and entities that influence or are influenced by an organization in significant ways.

i.e.: Owners, distributors and retailers of its products, customers, suppliers, employees, communities in which facilities are located, government bodies, trade and professional groups
Strategic stakeholders
(The major stakeholder groups.) Insurance organizations typically address their concerns when setting corporate objectives and strategies.
Commissions
The primary form of agency compensation; paid as a percentage of the policy premium. Agencies may also be paid fees for the services that they perform on the company's behalf.
Contingent commissions
Bonuses for agents - based on the amount and profitability of the business written by the company. Commissions may be paid at different levels for the products the agency offers and are governed by the contractual relationships b/w the agencies and the companies they represent.
Binding authority
Allows independent agencies to commit an insurance company to provide insurance, at least for a limited time.
Agency management system
A computer system that performs, in an integrated fashion, the information processes that support agency accounting, policyholder record keeping, sales activities, company communication, and other important agency tasks.
Agency/company interface (or, simply "interface")
Direct communication b/w agency computers and company computers. (Hindered by technical dissimilarities of the info systems of the companies the agency represents, and by the diversity of systems installed by agencies)
Direct writing agents
Agents employed to work for a company. (Generally lower commissions; paid through base salary & incentives)
Exclusive agents
Agents who sell exclusively for one insurer but are independent contractors rather than company employees.
Insurance brokers
Represent their customers, unlike agents (who represent insurance companies)
Direct distribution
i.e., direct mail; direct-response advertising in newspapers and periodicals and on television and radio; telephone marketing; marketing to credit or debit card customers; increasing use of the Internet (web sites)
Primary companies
Companies that initially assume the risk of exposure to loss (i.e., Western National)
Reinsurance companies
Offers insurance to insurers
Treaty reinsurance
(my words) a kind of general reinsurance; can be done pro-rata (proportional sharing of all premiums, expenses, losses, etc.) or excess (pays only if losses or a single loss exceeds an agreed upper limit)
Facultative reinsurance
reinsurance on an individual risk basis; is negotiated for each risk.
Stock companies
Owned by stockholders who have invested funds in the organization.
Mutual companies
Those insurance companies owned by their policyholders.
Reciprocal
A form of cooperative insurance in which each member of the reciprocal exchange is insured by and provides insurance for all the other members.
Lloyds associations
Unincorporated groups of individual underwriters who assume specified portions of the liabilities under the policies they underwrite
JUAs
Joint Underwriting Associations - facilities established by states to provide automobile coverages to the residual market; insurers may subsidize these facilities for losses and expenses exceeding premium income, based on a formula developed from voluntary writings. Insurance companies may also fund these facilities by direct charges they collect from the insured public.
ACORD
Agency-Company Operations Research and Development; supplies the insurance industry with copies of standard paper forms and the software needed to create the forms electronically. It is working to apply IT at both the company and agency levels through seminars, software products, and insurance software reviews.
IVANS
Insurance Value Added Network Services; provides a common network for communications, including agency interface and electronic mail, within the insurance industry.
National Association of Insurance Commissioners (NAIC)
The organization of state insurance commissioners; it drafts model legislation for consideration by state legislatures. Also analyzes the financial condition of insurers. Has no legal jurisdiction over insurance companies, but it exerts considerable influence ont he insurance industry as it provides a forum for insurance commissioners to meet, discuss current issues, and achieve some consensus.
Coding
Divides the coverage into major perils and describes the attributes of the risk insured in detail. The coding structure used may be defined and required by the state in its statistical plans. (Company may also develop its own codes, which are later translated into statistical plan codes.)
Rating
Typically is an electronic process for standardized coverages; may also be a clerical process in which someone develops the rate for a policy by referring to a company rate manual.
Functional structures
A structure in which the company organizes personnel and activities around functional specialties such as underwriting and claims. (Fosters specialized expertise and reflects a belief that offsetting functional interests achieve a balance)
Line of business (product line structures)
Type of corporate structure w/ line of business (territorial) managers. Has the advantage of responding more quickly and efficiently to local conditions (and also to identify and train managers for broader responsibilities in the future)
Strategic business units (SBUs)
Organized around defined customer groups. Each operates as a virtually autonomous company - it develops the products and pricing and distribution methods to serve its customer group.
Rate advisory organizations
i.e., ISO and NAII (which both double as statistical agents); they provide rates to many small and medium-size companies that do not have a sufficiently large experience base to allow them to develop credible rates on their own.
Operational level information
Needed to handle the organization's basic activities. Information helps to make sales, produce policies, and pay losses. Operational systems record the premiums collected and hours worked, produce statements of account, issue paychecks, make journal entries, and pay vendors.
Managerial level information
Helps ensure that operational level activities are proceeding according to plan. Less detailed than operational level. Interpreting often requires considerable analysis and occasionally requires examining underlying detail to determine the causes of trends.
Strategic level information
a combination of summarized internal data from the operational and managerial level systems and external intelligence gathered from the trade press, industry data sources, personal interactions and other sources.
Data warehousing
A process of combining databases in which the data have been cleaned up from the basic data kept in the company's mainframe, makes the use of this level (strategic) of information much more efficient.
Customer information file
Typically contains information gathered from agency, company, and customer sources. Includes:

- name address, telephone # and e-mail
- business or occupation
- # employees (if applicable)
- customer's existing coverages, premiums, insurers and expiration dates
- customer's loss history
- info about contacts, relationships, marketing materials sent, and other specific data pertinent to the customer
Client program information
A program of risk protection developed w/ the agent/broker/accountant/expert system/etc.; includes:

- the level of losses that the applicant will cover w/ its own funds through deductibles and self-insured retentions
- limits of coverage for single-loss claims and for multiple claims from the same event
- limits of coverage against catastrophic or total loss
- amount of money (premium) that the applicant is willing to pay for the coverage
- terms of payment desired
Statutory Accounting Principles
(SAP) Financial reporting requirements mandated by state insurance regulatory authorities. The primary concern at the regulatory level is to provide assurance that an insurance company will be able to meet its financial commitments to its customers. SAP take a conservative approach to the valuation of assets and the recording of income. Emphasize the liquidity value of a firm.
Generally Accepted Accounting Principles (GAAP)
Look at a firm as an ongoing concern. Applies to all firms in all industries.
Reserve for incurred but not reported losses (IBNR reserve)
Created to recognize losses that have taken place but have not yet been reported to the insurer as of a given statement date. The IBNR reserve is an estimate of the insurer's liability for these unreported losses.
Decision support systems (DSS)
Systems designed around the decisions that the firm's executives and managers make regularly. Decision support systems become sophisticated enough to allow for the importation of external data maintained by trade associations and statistical agents.
Executive information systems
Systems designed to combine external databases, like news services or market research databases, and information from the organization's information technology systems in an easy-to-use form.
Policy database
The "central file concept"; a centrally stored database where information can be retrieved automatically to ensure that later transactions are correctly applied.
Information database
A central library of information shared by many applications. When data are centralized, data redundancy is reduced. The information in the database is available for retrieval throughout the organization and can be used in many ways.
Database manager
Software that assigns new information to specific locations int he database; maintains linkages b/w related information; retrieves info on request.
Strategy
An organization's plan of action
Tactics
Support strategy; they are shorter-term objectives and plans that focus on a portion of the strategy and which are short-term steps to its achievement. (i.e., a strategy may be withdrawing from unprofitable personal lines; a tactic may be to establish withdrawal dates for specific lines in designated regions)
Management information system (MIS)
Uses data from an organization's various departments to produce reports that help managers analyze the organization's performance. Top managers need an MIS that allows them to search the company's database for data to verify their models and supplement the information that they gather from documents, telephone calls, meetings, and the observations they make as they travel.
Pioneers
Companies that believe that those who lag behind int he use of the latest technologies will suffer and find it difficult, if not impossible, to catch up.
Followers
Organizations that deliberately let the pioneers innovate the use of new technology and then follow the pioneers. (includes the "close seconds")
Centralized information processing
What it's called when mainframe computers are used to perform as much of the processing as possible
Decentralized information processing
Occurs at locations other than at a central processor, such as at a branch office or even one's own desk.
Distributed data processing (DDP)
(refers to decentralized processing) came into wide use int he late 1970s with the advent of minicomputers. DDP originally meant the dispersion of computer hardware, software and data to multiple locations within a firm. In a DDP system, instead of all of a firm's information being kept in and processed on a giant mainframe system, some storage and processing operations take place in smaller computers located throughout the firm. DDP allows the actual processing of information to occur with the end users, meeting their actual needs for the use of the information within the structure of their assigned duties.
Local area network (LAN)
A network using decentralized processing; refers to wiring and communications equipment, but in casual usage LAN also refers to the cable-linked computers that store and share data and programs. By extension, LAN also refers tot he distribution of computing activity among networked computers.
Cost/benefit analysis
a common way to evaluate automation and other projects or uses of funds. Requires careful estimation of the costs and financial benefits associated w/ a project.
Capital costs
Includes all of the costs associated w/ the purchase of an information technology system. Included are the system acquisition costs and the project costs.
System acquisition costs
equipment, software, space, and conversion from old system to new
Project costs
costs of the system design project (value of system design and programming done in-house should be included when considering)
Operating costs
Staff, supplies, security, power, service and service contracts, and overhead.
Overhead costs
Those that benefit an organization in general (i.e., corporate legal services, the mail room, receptionists, and building maintenance)
Marketing (insurance agency's viewpoint)
From an insurance agency's viewpoint, marketing refers to the process of securing coverage from an insurer. When an agent speaks of marketing, he or she means submitting an application to a company or "shopping" for a company to accept the risk or to write it at a favorable premium.
Marketing concept
The belief that satisfying customers is the key element in achieving an organization's goals is known as the "marketing concept"
Telemarketing
(telephone marketing) the use of the telephone to develop leads and sales.
Overhead costs
Those that benefit an organization in general (i.e., corporate legal services, the mail room, receptionists, and building maintenance)
Marketing (insurance agency's viewpoint)
From an insurance agency's viewpoint, marketing refers to the process of securing coverage from an insurer. When an agent speaks of marketing, he or she means submitting an application to a company or "shopping" for a company to accept the risk or to write it at a favorable premium.
Marketing concept
The belief that satisfying customers is the key element in achieving an organization's goals is known as the "marketing concept"
Telemarketing
(telephone marketing) the use of the telephone to develop leads and sales.
Multiple-lines company
(you know)
All-lines company
(you know this, too)
Loss control services
focus on loss prevention and loss reduction. Sometimes called engineering and safety services.
Replacement cost system
System that can calculate the actual replacement cost of a property upon receiving certain data, including dimensions, location, occupancy, and construction materials used.
Rate advisory services
Service organizations that collect and publish loss data. Many of the data definitions and information processes that support an insurer's ratemaking activities must conform to requirements established by rate advisory organizations.
Judgement method
A ratemaking method that is just what the name implies. THe underwriter uses this method on an individual case basis for special coverages or unusual exposure sfor which there is little or no loss experience. An example of judgment ratemaking in ocean marine insurance is setting the rate for a new supertanker.
Loss ratio method
Primarily used for property coverages, and it involves the comparison of the actual loss ratio with the expected loss ratio. (This is a ratemaking method.)
Pure premium method
Ratemaking method used mainly for third-party lines of insurance, such as workers compensation and liability. The pure premium is the portion of the rate allocated for payment of losses and loss adjustment expenses. In the pure premium method, the pure premium is first calculated, and an expense and profit loading is then added.
Prospective loss costs
The expected future costs of losses by classes of business; the outputs of a rate advisory service's ratemaking activity
Premium audit
Practice of verifying the actual units of exposure when they are known; used to determine adjustments to an initial premium paid for the coverage
Artificial intelligence
A group of related technologies that attempt to develop machines to emulate human-like qualities such as learning, reasoning, communicating, seeing and hearing
Expert systems
Interactive computer programs that help users solve problems that would otherwise require the assistance of a human expert
Knowledge engineers
Specialists who build a knowledge base with the if/then statements and decision rules obtained form the expert underwriters.
Inference engine
Part of an expert system that defines inferences and is combined with a processing program.
Claim reserve
An estimate of the settlement amount expected. It is an accounting entry that recognizes the anticipated expense and serves as a guide in claim handling.
Aggregate loss reserve
Refers to the total reserve amount on the insurer's books. If the aggregate loss reserve is unnecessarily large - that is, more than adequate but inaccurate - the company's profits will appear to drop, the company's income taxes may be reduced, and premium rates may be unnecessarily increased. (Problems when unnecessarily small as well)
Case reserve
the reserve created for an individual loss or claim. The amount of a case reserve is determined after an analysis of the facts of the individual situation.
Loss development
measurement of the increase in aggregate loss values over time. Estimating the extent of future loss development is primarily an actuarial department task.
Imaging system
Converts text, drawings and photographs into a digital form that can be sorted in a computer system and then manipulated using different software programs. Imaging stops the paper shuffle that has plagued the insurance industry for years, and it offers the possibility of having scanners read information from the image rather than having a human enter the data (reducing error)
Electronic commerce
the buying and selling of goods via an electronic medium, a very broad definition that encompasses both the sale of goods through telemarketers and the sale of goods over the Internet. From a consumer's view point, electronic commerce may provide access to more information, faster and economically, and may result in lower product and service acquisition costs. Electronic commerce can also help organizations meet their goals of enhanced customer service, the economical dissemination of consumer information and increased sales.
Computer network
two or more computers which are connected to each other and can transmit information from computer to computer.
Internet
Today, it's comprised of thousands of computer networks located throughout the world.
Uniform Resource Locators (URLs)
known popularly as "domain names" - used to identify Web sites.
Web site
provides basic information about an organization, but is interactive in the sense that it can lead to a completed sales transaction.
Requests for quotations (RFQ)
Typically involve a questionnaire that the consumer must complete to obtain an instant quote for insurance. RFQs allow the consumer to obtain information directly and relatively quickly.
Contracts of adhesion
a contract between two parties that does not allow for negotiation (due to the unequal bargaining power of the parties) and ambiguities are therefore construed against the insurer and in favor of the consumer.
Application
the act of a consumer offering to purchase insurance or accepting the insurer's offer to provide insurance
Offer and/or Acceptance
an insurer applying it sunderwriting standards and issuing the policy. In those instances where a risk is not acceptable to the underwriter, but coverage could be provided at a higher premium, the issuance of a policy at the higher rates or for different coverages would be considered a counteroffer that could be rejected or "accepted" by the consumer
Delivery and Consideration
premiums paid in exchange for the contract delivered by the insurer in which the insurer agrees to provide benefits at some future date (if certain conditions are met)
Digital signatures
Provide at least 2 levels of security: integrity (validation that the signature was transmitted in an unaltered state) and authenticity (validation that the signature is true and correct).
Certificate authority
A trusted third party that provides secure mathematical computations that result in unique individual digital certificates that cannot be duplicated
Stylus signature
Stylus pen displays signature on computer screen
NAIC Producer Data Base
(PDB) Industry gained access in late 1990s through the Insurance Regulatory Information Network (IRIN). For those states participating in PDB, industry will have electronic access to producer licensing information. This will substantially reduce the number of phone calls and written requests state insurance departments currently receive from industry for verification of good standing and/or licensing status.
B2B
e-commerce conducted b/w a business and other businesses
B2C
e-commerce conducted b/w a business and its end-customers
XML
Extensible Markup Language - a format for structured documents on the Web. (Used in some circumstances by ACORD)
Channel conflict
alienation of agents by companies selling insurance through the Internet
Infomediary
# An infomediary is a Web site that provides specialised information on behalf of producers of goods and services and their potential customers.
Touch point
(my words) Channel of communication. i.e., the telephone, which is the most common touch point to date.
Selective retrieval
Retrieval of clients' and prospects' data based on the content of the stored data elements (allowed by automation)
Client snapshot
Shows a client's name, address, policies in force, pending claims, open suspenses, and unpaid items, as well as brief comments previously entered by agency employees.
Function interrupt
Capability that allows a user who is performing one function to stop that function temporarily, move to a different set of screens, and then return to continue the interrupted function.
Advance billing
When renewal invoices are generated well before the renewal date. System options allow the agency to specify the following:

1. That a follow-up statement will or will not be automatically generated in thirty days

2. That the invoice amount will or will not be shown on the client's monthly statement

3. That the receivable will or will not be included in the agency balance sheet statement of assets.
Binder billing
Binder invoices can be generated when the binder is issued. The binder will be carried as a client receivable, will begin to age immediately, and will be classed as an agency asset. System options allow adjustments to the policy number, premium amount, and commission amount when the company confirms this information.
Payables control
provided by monthly company reconciliation reports, producer statements, broker statements, and payables reports for vendors. Data on company, producer, and broker payables are captured as a byproduct of regular insurance processing, and checks to these parties can be generated automatically.
Errors and omissions (E&O) insurance
indemnifies the agency (or individual agent) for any loss sustained because of an error or oversight on the agency's or agent's part.
Company terminal interface
Improved turnaround, reduced errors, and gave the agency access to company policy, claim and billing information. Is a complex process that required years of development and refinement.
SEMCI
Single-Entry Multi-Company Interface
Bandwidth
the range between a link's lower and upper frequency limit; constrains the data-carrying capacity of the link. Measured in cps (cycles per second)
Protocol
The rules of etiquette and procedure that a transmitter and receiver must follow in electronic communications. The transmitter and receiver of data must agree on the following:

1. The direction of data flow
2. The indicator for the start of a message
3. The indicator for the end of a message
4. The error-detection procedure
5. The means of signaling correct or incorrect reception of a message
6. The bit pattern for each character
Baud rate
Number of signal changes per second (measurement of the data-carrying capacity of the link)
Modem
modulator/demodulator; typically transmits at a minimum of 28,800 baud
Leased line
as in "leased phone line"; wired directly b/w two points, bypasses the telephone company switching centers, and is not shared with other users. Thus, it provides a higher quality (less noisy) transmission.
Transmission logs
parts of the electronic interface system that keep track of whether individual transactions have been received by the electronic interface system of the intended receiver. They are used only for controlling the communication session.
Diary
A reminder system or daily action list to remind the agency to take follow-up action on those items for which processing has not been completed.
Suspense
a mechanism that maintains the full business information about each transaction so that the transaction can be recreated as needed when follow-up action is taken. It is the equivalent of keeping a copy of each suspended transaction that is sent to a company. Some transactions may not be suspended.
Standards (in interface)
technical specifications for the way data are formulated or expressed and the way data are transmitted electronically from one device to another.
Technical communications standards
For communicating any information b/w agency computers and company computers, it was necessary to define the format of the "envelope" in which transactions would be transmitted. (eventually agreed on a translator to translate bisynchronous transmissions to SNA - an IBM protocol - and back again)
Common Data Transmission Standards
Described record formats, or layouts, in which information was sent - they did not describe how information was stored. They also described some characteristics of the information, such as the length of a data element and whether the element was alphabetical or numeric. The standards also described the sequence to be used in combining the information elements into insurance transactions and packaging the information for transmission. The standards did not attempt to describe how an insurance transaction should be used, nor did they describe what items of information were necessary for a company to write insurance.
Line of business standards
standards for data elements common to all personal lines and commercial lines transactions (p. 266-7)
Insurance Regulatory Information System (IRIS)
Developed by the NAIC to standardize and simplify the process of examining insurers' financial results. IRIS helps insurance departments to select those companies that merit highest priority in the allocation of regulators' resources. It consists of 2 phases: a statistic phase that produces key financial ratios and financial statement data; and an analytical phase consisting of a review of Annual Statements and financial ratios by experienced financial examiners.
Rate advisory services
(aka rating bureaus) organizations that provide a statistic base for the determination of rates. In general, they no longer publish premium rates but, instead, publish data on loss costs for insurers to use in developing their own rates.
Annual Statement
An annual report that each insurance company must submit to the state insurance department in all states in which they write business. The NAIC prescribes a common format. The Annual Statement provides detailed information about assets and liabilities, including data on premiums, losses, reserves, expenses, dividends, taxes and investments. When possible, A.S. data are separately identified by line of business, by state or both. In addition to its basic financial presentation, the Annual Statement includes numerous special schedules and supplements that contain more detailed information about particular lines of business or certain items, such as investments and expenses
Statistical agents
perform 2 important functions:

1. they develop statistical plans to meet the statistical needs of individual state insurance regulators, and they collect and report statistics under the various plans on behalf of insurers that choose to use the statistical agents' services.
Insurance Services Office (ISO)
the largest supplier of statistical, actuarial and underwriting information for and about the property and casualty insurance industry. ISO does the following:

- Compiles data and provides it to insurers and state regulators
- Uses data compiled form participating companies and develops advisory prospective loss costs
- Develops standardized policy language for most lines of property and casualty insurance
- Helps insurers and their agents set up procedures to develop multistate and state-specific rating and underwriting rules
Statistical plans
Detailed instruction books, filed with regulators, that define the data elements (for example, line of business, coverage, class, state, territory, premium and losses) as well as the formats for company reporting. The plans specify the way each insurer is to code its premium and loss data.
Objects
Software modules that define what they contain and how they work, and that can be copied and placed in other applications. (think "object-oriented programming"). Users can drag and drop a "data" object on object-aware applications. Those applications will know what "kind" of data it contains and where and how the data fit it. Every time the application is opened, it will automatically check the link to the object and update the data if changes have been made.
Updates
involve relatively minor revisions to a system, ranging from correcting errors to improving the performance of existing features. A vendor may send some updates to all system users w/o charge
Upgrades
provide new versions of hardware and/or software. They typically provide improvements in system functionality, such as expanding from single-user to multi-user status. Compared to updates, upgrades usually require more time to implement. Because upgrades may be costly, not all users are likely to purchase the system upgrades offered by the vendor.
Enhancements
major changes to a system, such as adding a new subsystem or function. Enhancements usually require considerable time and effort to implement. They may require training users in new functions and procedures.
Ergonomics
the effects of equipment design on the people who use it.

It is 3 things:
- a science
- a design consideration
- a contemporary issue
Transactional filing
Where documents are filed in folders by date rather than by policy number or customer. If properly integrated with an information technology system, transactional filing can save many hours of tedious work and lost or misplaced files.

If transactional filing is used in an organization, any automation, whether new or improved, should provide a means for capturing the filing information quickly, easily and routinely. Retrieving the information should be flexible and convenient.
Internal vendor
may include the systems or information services department, individual programmers, or systems managers such as those in charge of local area networks
EIM
Electronic image management (as done w/ ImageRight)
OEMs
Original equipment manufacturers; usually value-added firms that purchase or distribute a manufacturer's hardware products and add software and other services to provide a "turnkey" system.
External vendor
include hardware vendors, software vendors, system integrators or computer stores, or combination vendors sometimes called original equipment manufacturers (OEMs)
Design brief
A report used to update executives and managers on the current status of the project and to gain approval to proceed with the recommendations made.
- Describes the system to be developed or purchased
- Explains how the system meets the organization's needs
- Serves as the basis for obtaining approval to proceed
- Provides information to support decisions within or about the project
- Facilitates communication among system specialists, users, vendors and other parties
System log
records computer runs and other aspects of system use, such as the number of invoices or letters that are printed and the performance of a backup run. Problems reported by users are reported to the log keeper so that the symptoms and context of each problem can be recorded. Many systems automatically log system activity.
Cluster
a group of two or more agencies that share markets and other resources but maintain independent ownership of their business. IT makes clusters easier to manage and, therefore, more practical.
Obsolescence
the decline in value that most capital assets undergo when better assets become available.
Technological obsolescence
a decline in the mechanical or physical performance of a product. A computer system or other asset becomes technologically obsolescent when a product that performs better becomes available.
Economic obsolescence
Refers to the relative decline int he economic value or utility of a product when a superior one becomes available. This declien in economic value occurs because the new product can provide the same service at a lower cost than, or can provide superior service at the same cost as, the present product.
Tangible system assets
physical objects, such as computers, disk drives, CD-ROM drives, printers, modems, scanners, software media, system peripherals, and telecommunications hardware and wiring. Such assets can be damaged, stolen or rendered unusable
Intangible system assets
Consist of the commercial and proprietary software and data repositories in a computer system. Data repositories include files, databases and data in active memory. These assets can also be damaged, stolen or made inaccessible because of computer glitches. Moreover, unlike tangible items, information assets can be compromised and corrupted w/o any physical evidence or even the owner's knowledge
Natural perils
1. Fire
2. Flood
3. Earthquake
4. Windstorm, lightning, avalanche, static electricity, and animals
5. Liquid
Hackers
one who gains unauthorized admittance to a system. Motivations include self-satisfaction and greed
Virus
programs that spread by infecting other programs in a manner similar to biological microorganisms
Worms
virus programs that replicate themselves continuously to clog systems by consuming active or storage memory.
Bombs
viruses in which a triggering event (e.g., a calendar date or a system boot) activates a disruptive program
Virus life cycle
Creation --> Infection --> Attack
Downtime
a hardware or software condition that renders a system unavailable for use until fixed. i.e., when a PC application program conflicts w/ itself or with the operating system, the system can freeze, allowing no further processing until the system is rebooted.
Hard crashes
equipment failures that destroy all data in memory and require major procedures to be restored
Head crashes
occur when the read and write heads of a disk drive collide with themselves or a disk.
Business effect analysis
measures the financial effects of a loss on a business. Analysis estimates not only the systems' costs but also business costs in a recovery - including staff resources, office space, info in both hard-copy and electronic formats, etc.
Operating systems
programs that orchestrate and coordinate the functioning of various components of a computer. most provide some level of security, such as sign-on access controls.
Application systems
programs that perform specific transaction tasks. An example of an application system is a policywriting system.
Structured programming
partitions program code into logical packets or modules, provides operational efficiencies and facilitates investigation. Structured programming emphasizes modularity and code documentation
CASE
computer assisted software engineering - a type of code generator used to monitor system security
Development life cycle
describes the phases through which systems evolve from conception to implementation. A common cycle progresses through needs analysis, system evaluation and acquisition, installation, training, conversion and maintenance. Information security should be considered at each step int he development life cycle.
Turnover
the term used for delivering completed and tested code for field testing or production use. Turnover procedures should be specified, and the systems manager should keep records of each turnover and the persons involved.
Redundancy (as a processing control)
writing to two or more files or drives on the same or different machine (sometimes called "mirroring" or "shadowing")
Audit trail
tracks system use. Every successful and unsuccessful attempt to sign onto a network or shared system should be logged by the system and date- and time-stamped.
Open systems
permit all users unlimited access to most system areas, databases and tables, unless explicitly forbidden. Some users may be restricted form accessing certain segments. For example, most users should not have access to audit files or to budgets.
Closed systems
The strictest security policy; it denies access to all users unless explicitly authorized. Access is given only on a need-to-know basis
Subschema or views
provide security by limiting database access to predefined, cross-sectional views of information. Instead of being able to read various tables completely, the user is presented w/ a summary of the selected columns or rows that can be accessed
Disaster plans
prepare firms for the effect and consequences of an information disaster. They should specify the procedures to be taken before and during a disaster that disrupts computer operations.
Contingency planning
provides for the continuing information operating needs of an organization during and after an emergency.
Extra-expense coverage
provides insurance benefits for the continuation of operations (my words: during/following a loss). Benefits are limited to the additional expense above what the cost would have been if no loss had occurred.
Business interruption insurance
provides coverage to reimburse businesses for lost income that results from physical damage to information systems.
Turnkey consultants
provide hardware and software system solutions for their clients. Businesses often engage a turnkey consultant when they have no internal systems experience or expertise. The consultant recommends and purchases hardware, installs software, trains employees and provides ongoing support.
Express warranties
result from statements made by a vendor to clients during marketing. Some buyers attach copies of promotional material in a contract as evidence of vendor representations. By their inclusion in a contract, such vendor promises become express warranties.
Implied warranties
More general legal assumptions that the merchant or consultant is the party entitled to sell the software or services, that products are fit for the purpose intended, and that the products do not infringe on the title or ownership rights of others. Whether or not a product is fit for its intended use is often a matter of judgment and is the subject of disputes b/w buyers and sellers.
Torts
Civil wrongs involving a legal duty rather than a breach of contract.