Im 341 Final Slimmed Down

Front 1

exposure/impact

Back 1

the potential dollar loss should a particular threat become a reality

Front 2

internal control

Back 2

the process implemented by the board of directors, management, and those under their direction to provide reasonable assurance that control objectives are achieved

Front 3

preventive control

Back 3

deter problems before they arise

Front 4

detective control

Back 4

needed to discover problems as soon as they arise

Front 5

corrective control

Back 5

remedy problems that have been discovered

Front 6

general control

Back 6

designed to make sure an organization’s control environment is stable and well managed

Front 7

application control

Back 7

prevent, detect, and correct transaction errors and fraud

Front 8

Foreign Corrupt Practices Act

Back 8

the primary purpose is to prevent the bribery of foreign officials in order to obtain business

Front 9

Sarbanes-Oxley Act (SOX)

Back 9

intended to prevent financial statement fraud

Front 10

Public Company Accounting Oversight Board (PCAOB)

Back 10

created to control the auditing profession

Front 11

diagnostic control system

Back 11

measures company progress by comparing actual performance to planned performance

Front 12

Control Objectives for Information and Related Technology (COBIT)

Back 12

a framework of generally applicable information systems security and control practices for IT control

Front 13

Committee of Sponsoring Organizations (COSO)

Back 13

a private-sector group consisting of the American Accounting Association, the AICPA, the Institute of Internal Auditors, the Institute of Management Accountants, and the Financial Executives

Front 14

Enterprise Risk Management--Integrated Framework (ERM)

Back 14

expands on the elements of the internal control integrated framework and provides an all-encompassing focus on the broader subject of enterprise risk management

Front 15

internal environment

Back 15

influences how organizations establish strategies and objectives, structure business activities, and identify/assess/respond to risk

Front 16

audit committee

Back 16

composed of outside independent directors; responsible for overseeing the corporation’s internal control structure and financial reporting process

Front 17

residual risk

Back 17

the risk that remains after management implements internal controls

Front 18

control activities

Back 18

policies, procedures, and rules that provide reasonable assurance that management’s control objectives are met and risk responses are carried out

Front 19

digital signature

Back 19

signing a document with a piece of data that cannot be forged

Front 20

segregation of accounting duties

Back 20

achieved when authorization, recording, and custody are separated

Front 21

collusion

Back 21

two or more people working together to override the preventive aspect of the internal control system

Front 22

segregation of systems duties

Back 22

control procedures implemented to divide authority and responsibility

Front 23

data control group

Back 23

ensures that source data have been properly approved, monitors the flow of work through the computer, maintains a record of input errors, and distributes systems output

Front 24

response time

Back 24

how long it takes the system to respond

Front 25

audit trail

Back 25

exists when individual company transactions can be traced through the system from where they originate to where they end up on financial statements

Front 26

time-based model of security

Back 26

focuses on the relationship between preventive, detective, and corrective controls

Front 27

defense-in-depth

Back 27

employs multiple layers of controls in order to avoid having a single point of failure

Front 28

authentication

Back 28

focuses on verifying the identity of the person or device attempting to access the system

Front 29

access control matrix

Back 29

a table specifying which portions of the system users are permitted to access and what actions they can perform

Front 30

social engineering

Back 30

attacks that use deception to obtain unauthorized access to information resources

Front 31

firewall

Back 31

is either a special-purpose hardware device or software running on a general-purpose computer

Front 32

demilitarized zone (DMZ)

Back 32

a separate network that permits controlled access from the Internet to selected resources

Front 33

Transmission Control Protocol (TCP)

Back 33

specifies the procedures for dividing files and documents into packets to be sent over the Internet and the methods for reassembly of the original document or file at the destination

Front 34

Internet Protocol (IP)

Back 34

specifies the structure of previously mentioned packets and how to route them to the proper destination

Front 35

access control list (ACL)

Back 35

a set of rules that determine which packets are allowed entry and which are dropped

Front 36

static packet filtering

Back 36

screens individual IP packets based solely on the contents of the source and/or destination fields in the IP packet header

Front 37

stateful packet filtering

Back 37

maintains a table that lists all established connections between the organization's computers and the Internet

Front 38

intrusion prevention systems (IPS)

Back 38

designed to identify and drop packets that are part of an attack

Front 39

vulnerabilities

Back 39

flaws that can be exploited to either crash the system or take control of it

Front 40

encryption

Back 40

the process of transforming plaintext into ciphertext

Front 41

decryption

Back 41

the reverse process of encryption

Front 42

key escrow

Back 42

a process which involves making copies of all encryption keys used by employees and storing the copies securely

Front 43

symmetric encryption systems

Back 43

use the same key both to encrypt and decrypt

Front 44

asymmetric encryption systems

Back 44

use two keys to encrypt and decrypt

Front 45

public key

Back 45

widely distributed and available to everyone

Front 46

private key

Back 46

kept secret and known only to the owner of that pair of keys

Front 47

hashing

Back 47

a process that takes plaintext of any length and transforms it into a hash

Front 48

digital signature

Back 48

information encrypted with the creator's private key

Front 49

digital certificate

Back 49

an electronic document that certifies the identity of the owner of a particular public key

Front 50

public key infrastructure (PKI)

Back 50

processes used to issue and manage asymmetric keys and digital certificates

Front 51

certificate authority

Back 51

the organization that issues public and private keys and records the public key in a digital certificate

Front 52

intrusion detection systems (IDS)

Back 52

create logs of network traffic that was permitted to pass the firewall and then analyze those logs for signs of attempted or successful intrusions

Front 53

vulnerability scans

Back 53

use automated tools designed to identify whether a given system possesses any well-known vulnerabilities

Front 54

computer emergency response team (CERT)

Back 54

responsible for dealing with major security incidents; leads through the 4 steps of Recognition, Containment, Recovery, and Follow-Up

Front 55

exploit

Back 55

the set of instructions for taking advantage of a vulnerability

Front 56

patch

Back 56

code released by software developers that fixes a particular vulnerability

Front 57

patch management

Back 57

the process for regularly applying patches and updates to all software used by the organization