Im 341 Final

Front 1

threat

Back 1

any potential adverse occurrence or unwanted event that could be injurious to either the AIS or the organization

Front 2

exposure/impact

Back 2

the potential dollar loss should a particular threat become a reality

Front 3

likelihood

Back 3

the probability that a threat will happen

Front 4

internal control

Back 4

the process implemented by the board of directors, management, and those under their direction to provide reasonable assurance that control objectives are achieved

Front 5

preventive control

Back 5

deter problems before they arise

Front 6

detective control

Back 6

needed to discover problems as soon as they arise

Front 7

corrective control

Back 7

remedy problems that have been discovered

Front 8

general control

Back 8

designed to make sure an organization’s control environment is stable and well managed

Front 9

application control

Back 9

prevent, detect, and correct transaction errors and fraud

Front 10

Foreign Corrupt Practices Act

Back 10

the primary purpose is to prevent the bribery of foreign officials in order to obtain business

Front 11

Sarbanes-Oxley Act (SOX)

Back 11

intended to prevent financial statement fraud

Front 12

Public Company Accounting Oversight Board (PCAOB)

Back 12

created to control the auditing profession

Front 13

belief system

Back 13

communicates company core values to employees and inspires them to live by them

Front 14

boundary system

Back 14

helps employees act ethically by setting limits beyond which an employee must not pass

Front 15

diagnostic control system

Back 15

measures company progress by comparing actual performance to planned performance

Front 16

interactive control system

Back 16

helps top-level managers with high-level activities that demand frequent and regular attention

Front 17

Control Objectives for Information and Related Technology (COBIT)

Back 17

a framework of generally applicable information systems security and control practices for IT control

Front 18

Committee of Sponsoring Organizations (COSO)

Back 18

a private-sector group consisting of the American Accounting Association, the AICPA, the Institute of Internal Auditors, the Institute of Management Accountants, and the Financial Executives

Front 19

Internal Control--Integrated Framework

Back 19

issued by COSO; defines internal controls and provides guidance for evaluating and enhancing internal control systems

Front 20

Enterprise Risk Management--Integrated Framework (ERM)

Back 20

expands on the elements of the internal control integrated framework and provides an all-encompassing focus on the broader subject of enterprise risk management

Front 21

strategic objective

Back 21

high-level goals that are aligned with and support the company’s mission

Front 22

operations objective

Back 22

deal with the effectiveness and efficiency of company operations, such as performance and profitability goals and safeguarding assets

Front 23

reporting objective

Back 23

help ensure the accuracy, completeness, and reliability of internal and eternal company reports, of both a financial and nonfinancial nature; improve decision making and monitor company activities and performance more efficiently

Front 24

compliance objective

Back 24

help the company comply with all applicable laws and regulations

Front 25

internal environment

Back 25

influences how organizations establish strategies and objectives, structure business activities, and identify/assess/respond to risk

Front 26

risk appetite

Back 26

the amount of risk a company is willing to accept in order to achieve its goals

Front 27

audit committee

Back 27

composed of outside independent directors; responsible for overseeing the corporation’s internal control structure and financial reporting process

Front 28

policy and procedures manual

Back 28

explains proper business practices, describes the knowledge and experience needed by key personnel, spells out management policy for handling specific transactions, and documents the systems/procedures employed to process those transactions

Front 29

background check

Back 29

includes verifying educational and work experience, talking to references, checking for a criminal record, and checking credit records

Front 30

event

Back 30

an incident or occurrence emanating from internal or external sources that affects implementation of strategy or achievement of objectives; they represent uncertainty

Front 31

inherent risk

Back 31

the risk that exists before management takes any steps to control the likelihood or impact of a risk

Front 32

residual risk

Back 32

the risk that remains after management implements internal controls

Front 33

expected loss

Back 33

expected loss = impact x likelihood

Front 34

control activities

Back 34

policies, procedures, and rules that provide reasonable assurance that management’s control objectives are met and risk responses are carried out

Front 35

authorization

Back 35

empowerment of employees to follow established policies

Front 36

digital signature

Back 36

signing a document with a piece of data that cannot be forged

Front 37

specific authorization

Back 37

management review and approval required for certain things

Front 38

general authorization

Back 38

employees are authorized to handle routine transactions without special approval

Front 39

segregation of accounting duties

Back 39

achieved when authorization, recording, and custody are separated

Front 40

collusion

Back 40

two or more people working together to override the preventive aspect of the internal control system

Front 41

segregation of systems duties

Back 41

control procedures implemented to divide authority and responsibility

Front 42

systems administrator

Back 42

responsible for ensuring that the different parts of an information system operate smoothly and efficiently

Front 43

network manager

Back 43

ensure that all applicable devices are linked to the organization’s internal and external networks and that the networks operate continuously and properly

Front 44

security management

Back 44

ensures that all aspects of the system are secure and protected from all internal and external threats

Front 45

systems analyst

Back 45

help users determine their information needs and then design an information system to meet those needs

Front 46

programmer

Back 46

take the design provided by systems analysts and create an information system by writing computer programs

Front 47

computer operator

Back 47

run the software on the company’s computers and ensure that data are input properly

Front 48

information system library

Back 48

a separate storage area of corporate databases, files, and programs

Front 49

data control group

Back 49

ensures that source data have been properly approved, monitors the flow of work through the computer, maintains a record of input errors, and distributes systems output

Front 50

strategic master plan

Back 50

shows the projects that must be completed to achieve long-range company goals and addresses the company’s hardware, software, personnel, and infrastructure requirements

Front 51

project development plan

Back 51

shows how a project will be completed

Front 52

project milestone

Back 52

significant points when progress is reviewed and actual and estimated completion times are compared

Front 53

performance evaluation

Back 53

evaluation made of team members as each project is completed

Front 54

data processing schedule

Back 54

what data processing tasks are organized to

Front 55

steering committee

Back 55

formed to guide and oversee systems development

Front 56

system performance measurements

Back 56

what a system is evaluated by (throughput, utilization, and response time)

Front 57

throughput

Back 57

output per unit of time

Front 58

utilization

Back 58

percentage of time the system is productively used

Front 59

response time

Back 59

how long it takes the system to respond

Front 60

post-implementation review

Back 60

performed after a development project is completed to determine if the anticipated benefits were achieved

Front 61

systems integrator

Back 61

a vendor who uses common standards and manages a cooperative systems development effort involving its own development personnel and those of the client and other vendors

Front 62

change management

Back 62

the process of making sure changes do not negatively affect systems reliability, security, confidentiality, integrity, and availability

Front 63

analytical review

Back 63

an examination of the relationships between different sets of data

Front 64

audit trail

Back 64

exists when individual company transactions can be traced through the system from where they originate to where they end up on financial statements

Front 65

computer security officer (CSO)

Back 65

in charge of AIS security and should be independent of the information system function and report to the COO or CEO

Front 66

chief compliance officer (CCO)

Back 66

handles all compliance issues

Front 67

forensic accountant

Back 67

specialize in fraud detection and investigation

Front 68

computer forensics specialists

Back 68

discover, extract, safeguard, and document computer evidence such that its authenticity will not succumb to legal challenges

Front 69

neural network

Back 69

programs that mimic the brain and have learning capabilities

Front 70

fraud hot line

Back 70

an effective way to comply with the law and anonymously report fraud

Front 71

time-based model of security

Back 71

focuses on the relationship between preventie, detective, and corrective controls

Front 72

defense-in-depth

Back 72

employs multiple layers of controls in order to avoid having a single point of failure

Front 73

authentication

Back 73

focuses on verifying the identity of the person or device attempting to access the system

Front 74

biometric identifier

Back 74

some physical characteristic used to authenticate a user (i.e., a fingerprint)

Front 75

multifactor authentication

Back 75

the use of two or all three methods of authentication in conjunction

Front 76

authorization

Back 76

restricts access of authenticated users to specific portions of the system and specifies what actions they are permitted to perform

Front 77

access control matrix

Back 77

a table specifying which portions of the system users are permitted to access and what actions they can perform

Front 78

compatibility test

Back 78

matches a user’s authentication credentials against the access control matrix to determine whether that employee should be allowed to access

Front 79

social engineering

Back 79

attacks that use deception to obtain unauthorized access to information resources

Front 80

border router

Back 80

connects an organization’s information system to the Internet

Front 81

firewall

Back 81

is either a special-purpose hardware device or software running on a general-purpose computer

Front 82

demilitarized zone (DMZ)

Back 82

a separate network that permits controlled access from the Internet to selected resources

Front 83

Transmission Control Protocol (TCP)

Back 83

specifies the procedures for dividing files and documents into packets to be sent over the Internet and the methods for reassembly of the original document or file at the destination

Front 84

Internet Protocol (IP)

Back 84

specifies the structure of previously mentioned packets and how to route them to the proper destination

Front 85

routers

Back 85

special-purpose devices designed to read the destination address fields in IP packet headers to decide where to send the packet next

Front 86

access control list (ACL)

Back 86

a set of rules that determine which packets are allowed entry and which are dropped

Front 87

static packet filtering

Back 87

screens individual IP packets based solely on the contents of the source and/or destination fields in the IP packet header

Front 88

stateful packet filtering

Back 88

maintains a table that lists all established connections between the organization’s computers and the Internet

Front 89

deep packet inspection

Back 89

firewalls examining data in the body of an IP packet to provide more effective access control

Front 90

intrusion prevention systems (IPS)

Back 90

designed to identify and drop packets that are part of an attack

Front 91

Remote Authentication Dial-In User Service (RADIUS)

Back 91

a standard method used to verify the identity of users attempting to obtain dial-in access to the network

Front 92

war dialing

Back 92

does a periodic check for the existence of rogue (unauthorized) modems by calling every telephone number assigned to the organization to identify those which are connected to modems

Front 93

hosts

Back 93

workstations/servers/printers/other devices

Front 94

vulnerabilities

Back 94

flaws that can be exploited to either crash the system or take control of it

Front 95

hardening

Back 95

the process of turning off unnecessary features

Front 96

encryption

Back 96

the process of transforming plaintext into ciphertext

Front 97

plaintext

Back 97

normal text

Front 98

ciphertext

Back 98

unreadable gibberish text

Front 99

decryption

Back 99

the reverse process of encryption

Front 100

key escrow

Back 100

a process which involves making copies of all encryption keys used by employees and storing the copies securely

Front 101

symmetric encryption systems

Back 101

use the same key both to encrypt and decrypt

Front 102

asymmetric encryption systems

Back 102

use two keys to encrypt and decrypt

Front 103

public key

Back 103

widely distributed and available to everyone

Front 104

private key

Back 104

kept secret and known only to the owner of that pair of keys

Front 105

hashing

Back 105

a process that takes plaintext of any length and transforms it into a hash

Front 106

hash

Back 106

a short code

Front 107

digital signature

Back 107

information encrypted with the creator’s private key

Front 108

digital certificate

Back 108

an electronic document that certifies the identity of the owner of a particular public key

Front 109

public key infrastructure (PKI)

Back 109

processes used to issue and manage asymmetric keys and digital certificates

Front 110

certificate authority

Back 110

the organization that issues public and private keys and records the public key in a digital certificate

Front 111

e-signature

Back 111

a cursive-style imprint of a person’s name applied to an electronic document

Front 112

log analysis

Back 112

the process of examining logs to monitor security

Front 113

intrusion detection systems (IDS)

Back 113

create logs of network traffic that was permitted to pass the firewall and then analyze those logs for signs of attempted or successful intrusions

Front 114

vulnerability scans

Back 114

use automated tools designed to identify whether a given system possesses any well-known vulnerabilities

Front 115

penetration test

Back 115

an authorized attempt to break into the organization’s information system

Front 116

computer emergency response team (CERT)

Back 116

responsible for dealing with major security incidents; leads through the 4 steps of Recognition, Containment, Recovery, and Follow-Up

Front 117

exploit

Back 117

the set of instructions for taking advantage of a vulnerability

Front 118

patch

Back 118

code released by software developers that fixes a particular vulnerability

Front 119

patch management

Back 119

the process for regularly applying patches and updates to all software used by the organization