Information Securities - Final Exam - Essay Portion

Front 1

• What is a mission statement?

Back 1

A mission statement is a formal statement declaring the ongoing purpose and reason for existence of a business.

Front 2

• What is Risk?

Back 2

Risk is the product of the likelihood of a negative event occurring multiplied by the impact of such an event happening.

Front 3

• What are the two steps of Risk Management?

Back 3

The two steps of risk management are risk assessment and risk treatment.

Front 4

• Explain Qualitative Risk Assessment?

Back 4

A qualitative risk assessment is the identification of vulnerabilities, threats, threat probability, impact, and countermeasures for a given scope of assets, basically the “quality” of a risk, a subjective approach to calculating risk.

Front 5

• Explain Quantitative Risk Assessment?

Back 5

Quantitative risk assessment is the calculated risk based on asset value and exposure factor, resulting in a single loss expectancy. The single loss expectancy can be multiplied by the annualized rate of occurrence to calculate the annual loss expectancy. This is a “quantity” risk, the cost to repair and/or replacement of an asset based on exposure and the rate of occurrence.

Front 6

• What are some forms of Risk Treatment?

Back 6

Forms of risk treatment include risk acceptance, risk avoidance, risk reduction, and risk transfer.

Front 7

• Explain Fail Open versus Fail Closed.

Back 7

Fail open and fail closed deal with the state of a mechanism after it fails. Fail open is when the mechanism permits all activity. Fail closed is when the mechanism blocks all activity.

Front 8

• What are the three pillars of Security?

Back 8

The three pillars of security are CIA: confidentiality, integrity, and availability.

Front 9

• What is PII? Provide examples.

Back 9

PII is personal identifiable information. Examples are name, Social Security number, phone number, driver’s license number, and credit cards.

Front 10

• How can you estimate the likelihood of an exploitation?

Back 10

The likelihood of an exploitation can be estimated from past experience, national and international standards and guidelines, consulting experts and specialists, using models (economic, engineering, etc), market research and analysis, and experiments and prototypes. At last resort, guesswork can be implemented to provide an estimate should no reasonable numbers emerge, provided management is notified.

Front 11

• What is COOP?

Back 11

COOP is the continued operations of a company at minimal essential levels following a disaster, resulting in a higher rate of survivability for the company

Front 12

• What is DR?

Back 12

DR is disaster recovery, which is the process of returning to “business as usual” following a disaster that destroys part or all of a site.

Front 13

• What is the purpose of COOP?

Back 13

The purpose of COOP planning is to develop a plan for efficient and timely continued operations following a disaster, to minimize business damage and loss, and to ensure survivability of critical equipment, records, and assets.

Front 14

• What is the purpose of DR?

Back 14

The purpose of disaster recovery is to assess, salvage, repair, and restore facilities and systems damaged during a disaster.

Front 15

• What are some essential elements of COOP?

Back 15

Some essential elements of COOP are plans and procedures (as well as testing and training), delegations of authority, having accessible alternate facilities, ability to access vital records and databases, coordinating personnel, and security.

Front 16

• What is the definition of a disaster?

Back 16

A disaster is a natural or man-made event that disrupts a business in such a way that recovery can only be achieved by a considerable effort.

Front 17

• What are the two types of disasters?

Back 17

The two types of disasters are natural disasters and man-made disasters.

Front 18

• What are some benefits of planning for COOP and DR?

Back 18

By planning for COOP and DR, a company can reduce its risk, has a marketplace advantage, and has improved availability and reliability.

Front 19

• How do you perform a Threat and Risk Analysis?

Back 19

To perform a Threat and Risk Analysis, one must identify threats, vulnerabilities, and risks for each key process, then rank each according to probability, impact, and cost, and identify mitigating controls.

Front 20

• What are the components of developing a Business Continuity and Recovery Plans?

Back 20

The components of developing Business Continuity and Recovery Plans are selecting recovery team members, designing an emergency response, assessing damage and salvaging assets, notifying those affected inside and outside the company, providing for personal safety, reestablishing communication, providing for lack of public utilities, and logistics and supplies.

Front 21

• What are the five levels of testing plans for COOP and DR?

Back 21

The five levels of testing plans for COOP and DR are document review, walkthrough, simulation, parallel testing, and cutover testing.

Front 22

• What is Reliability?

Back 22

Reliability is the probability of a component or system performing its mission over a certain length of time.

Front 23

• What is MTBF?

Back 23

MTBF is the mean time between failures – the expected reliability calculated on a statistical basis from known failure rates of components tested in a lab.

Front 24

• What are some reasons for data loss?

Back 24

Data loss can result from hardware failures, software malfunctions, accidental deletion or overwriting, natural disasters, and disgruntled employees.

Front 25

• What is Redundancy? Provide examples

Back 25

Redundancy is the ability of a system to continue functioning normally in the event of a component failure by having backup components that perform duplicate functions. Examples are multiple CPUs, RAID disks, and dual network connections.

Front 26

• What is Failover? Provide examples

Back 26

Failover is the process of data being immediately rerouted to an alternate path so that services remain interrupted following a physical disruption to a network component. Examples are an alternate server for the same services and a second switch for the same network.

Front 27

• Explain incremental backups

Back 27

An incremental backup is backing up only the files that have changed since the last full backup, which takes less time than a full backup and uses fewer resources as well as memory. However, when restoring data, it is necessary to restore the full backup then each of the incremental backups, resulting in a longer restore time.

Front 28

• What is Encipher/Decipher?

Back 28

Encipher is encryption, the process of changing plaintext into ciphertext. Decipher is decryption, the process to changing ciphertext into plaintext

Front 29

• In a cryptographic system, where does the encryption strength come from?

Back 29

Encryption strength comes from confusion and diffusion. Confusion is caused by changing key values each round, using substitution, and by the complication of the plaintext/key relationship. Diffusion results by changing the location of the plaintext in ciphertext and through transposition.

Front 30

• Explain how a Certificate Authority works.

Back 30

A Certificate Authority issues a digital certificate. The digital certificate contains a public key and identity of the owner. The certificate is a validation that the public key is owned by the corresponding identity. The public key encrypts data sent through a Web form submission when sending that data to the certificate owner.

Front 31

• How does a Digital Signature work?

Back 31

The sender’s digital signature encrypts the message using his private key. The message is encrypted a second time using the receiver’s public key. The receiver uses his own private key and the sender’s public key to decipher the message.

Front 32

• Which is better and why: Hardware or Software encryption?

Back 32

Hardware encryption is better for many reasons. Hardware encryption is faster because it uses a special chip inside the device. You only need the hardware for decryption. Software encryption is slower because it uses itself – the application – using additional system resources and extra steps to encrypt and decrypt. Hardware encryption never exposes the password to the computer – it is contained in the encryption chip inside the device. Software encryption exposes the password to the computer, which can allow the password to be recovered by hackers. Software encryption also stores the encrypted data as a visible file for anyone to copy. Files are not visible on encrypted hardware without use of a password.

Front 33

• What is Cryptography?

Back 33

Cryptography is the science of hiding information in plain sight to conceal it from unauthorized parties.

Front 34

• What is Encryption?

Back 34

Encryption is the process of transforming information using a cipher, making it unreadable without a key.

Front 35

• Why are Telnet and FTP bad? What should be used instead?

Back 35

All FTP transmissions are in plaintext and can be read by anyone sniffing the network. Anyone who has access to the router, switch, hub, or gateway between the two hosts using Telnet can obtain any data that is typed. SSL or TLS should be used instead.

Front 36

• Explain Shannon’s Fundamental Theory of Information Technology.

Back 36

Shannon’s Fundamental Theory of Information Technology states that a channel’s capacity is directly proportional to its bandwidth. This means that as bandwidth increases, so does the amount of information it can carry.

Front 37

• What is a Computer Network?

Back 37

A computer network is the collection of devices connected by wires or wirelessly to share resources – hardware, software, and databases, etc.

Front 38

• What are some benefits of computer networks?

Back 38

Some benefits of computer networks are: saving money – they can share resources, such as an Internet connection and printer; saving time by sharing files – access to materials, such as databases, for quick updates, rather than sending the files back and forth through emails; and security – with property network security protocols, files are more secure within the network than when providing access outside the network.

Front 39

• How does a modem work?

Back 39

A modem translates digital to analog for transmission through an analog medium, then translates analog to digital for purposes of receiving

Front 40

• Explain the difference between Centralized Processing, De-centralized processing, and Distributed processing?

Back 40

Centralized processing occurs in a single location, de-centralized processing occurs among various remote locations, and distributed processing occurs at remote locations but are connected via telecommunication devices.

Front 41

• In networking, what is a protocol?

Back 41

A protocol is the set of rules that guarantee communication among computers of different types and different manufacturers.

Front 42

• What is the difference between a switch and a hub?

Back 42

The difference between a hub and a switch is that a hub doesn’t manage the traffic the coming through it – every packet entering is being sent out through all other ports, resulting in packet collisions, whereas a switch creates a different collision domain for each port, resulting in transmissions that do not interfere with each other (no collisions).

Front 43

• What are some examples of network threats?

Back 43

A DoS attack is designed to flood or cause malfunction. During a teardrop attack, the attacker sends mangled packet fragments with overlapping and oversized payloads to the targeted system. A sequence number threat guesses upcoming sequence numbers as a method for hijacking a session. A smurf attack is a large number of ICMP echo requests, where the packets are sent to a target network’s broadcast address, which causes all systems on the network to respond.

Front 44

• What is the definition of Telecommunications (also provide examples)?

Back 44

Telecommunications is the transmission of messages over distances to communicate. Historic telecommunications consisted of smoke signals, coded drumbeats, and signal flags. Modern telecommunications include telephones, radio and microwave communications, fiber optics, and wireless transmissions.

Front 45

• What is Data Communications?

Back 45

Data communications is a specialized part of telecommunications that refers to electronic collection, processing, and distribution of data, usually between computer hardware devices

Front 46

• What is Bandwidth?

Back 46

Bandwidth is the rate of data transfer, measured in bits per second.

Front 47

• Explain packet fragmentation in Routers

Back 47

If a packet is oversized and the router is unable to forward it, the router fragments the packet into smaller packets. The TCP/IP stack performs the fragmentation and reassembly process.

Front 48

• What are the seven layers within the network model?

Back 48

Layer 1 – Physical, Layer 2 – Data link, Layer 3 – Network, Layer 4 – Transport, Layer 5 – Session, Layer 6 – Presentation, Layer 7 – Application

Front 49

• What is a virus?

Back 49

A virus is a computer program that can copy itself and infect a computer. A virus must be attached to a file or boot sector to be disruptive or destructive. Typically, viruses are created to steal information.

Front 50

• How often should one update anti-virus definitions?

Back 50

Anti-virus definitions are typically updated on a regular basis by one’s anti-virus software. If the “auto-update” option is not selected, a user should check for updates weekly, minimally.

Front 51

• How do you recover a file once it has been deleted?

Back 51

If you haven’t altered your hard drive since you deleted the file, it is recoverable. The deleted file is saved as it’s name, except the first letter of the filename was replaced with a question mark. There are file recovery software packages that will scan your hard drive and locate these files for you.

Front 52

• What is Spyware?

Back 52

Spyware is a program that secretly gathers information about you and your computer and relays it to an advertiser or other third party.

Front 53

• What is Adware?

Back 53

Adware is a program that tracks Internet habits, pushes ads, and performs other information-gathering events and relays the information to their developers.

Front 54

• How can you tell your system is 100% clean once you remove a virus?

Back 54

You can’t. The only way to guarantee you are 100% virus free is to format your computer.

Front 55

• Explain why it is not good to use the “Administrator” logon or rights all of the time?

Back 55

“Administrator” is the most common name for account logins. This is providing hackers with an easy piece of information making you an easier target than someone who doesn’t have an account named “Administrator”. Once a hacker has access to your Administrator account, they can do anything to your computer. If you are using a non-administrator rights account and someone infiltrates your system, by downloading a malware program for example, they are limited to the files that account has access to. You can delete that username and establish a new one free of that malware program.

Front 56

• How can you defend against a virus being loaded from behind your firewall?

Back 56

Each machine should have its own anti-virus protection. This limits the spread of the virus throughout the network. Also, but using a non-administrator account, one can sometimes limit infection from a virus and prevent spreading it to other users.

Front 57

• What is considered an insider threat?

Back 57

An insider threat is typically a disgruntled employee attempting to gain access to unauthorized areas for personal gain, espionage, or revenge.

Front 58

• What is Phishing?

Back 58

Phishing is an attempt to trick someone into giving out sensitive or personal information by causing the victim to think they are providing information to a legitimate source.

Front 59

• Explain Social Engineering

Back 59

Social engineering is “people hacking”. A person can manipulate another into revealing sensitive information, willingly or unwillingly. Social engineering typically occurs in a four-step process: gathering information, developing a relationship, exploitation, and execution.