Use LEFT and RIGHT arrow keys to navigate between flashcards;
Use UP and DOWN arrow keys to flip the card;
H to show hint;
A reads text to speech;
69 Cards in this Set
- Front
- Back
|
WHY ARE INFORMATION SYSTEMS VULNERABLE |
1. Bottom line: There is no such thing as privacy! 2. Systems connected to a network are vulnerable. Connectivity exposes systems to the outside world. 3. Trends in security vulnerabilities suggest that even "offline" systems are at risk 4. Systems are vulnerable from hardware, software, network, nature, and people perspectives |
|
|
INFORMATION SECURITY (INFOSEC) |
The protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability |
|
|
INFO AND INFO SYSTEMS: |
Do not need to be computer based. InfoSec is a general term that applies to protection of information regardless of where it created, stored, communicated, and destroyed |
|
|
CONFIDENTIALITY |
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
*Only those with the right or authorization to access information are able to do so |
|
|
INTEGRITY |
The property that data has not been altered in an unauthorized manner. Data integrity covers data in storage, during processing, and while in transit.
*Guarding against improper information modification or destruction, and include ensuring information non-repudiation and authenticity |
|
|
AVAILABILITY |
Ensuring timely and reliable access to and use of information
*For any information system to serve its purpose, the information must be available when it is needed |
|
|
TYPES OF ATTACKS: |
1. Malware 2. Unauthorized Access (hacking) 3. Denial-of-Service Attacks (DoS and DDoS) |
|
|
TYPES OF ATTACKERS |
1. Hackers 2. Disgruntled Employees/Ex-Employees 3. Other organizations, terrorists, even other countries |
|
|
MALWARE |
Malicious Software; most common type of attack; viruses, worms, trojan horses, spyware, root kits, key loggers, etc. |
|
|
VIRUSES |
A small program that is written to alter the way a computer operates, without the permission or knowledge of the user. A computer virus attaches itself to a program or file so it can spread from one computer to another; a host. It cannot infect a computer unless the program is run. Cannot spread without human intervention! |
|
|
WORMS |
Programs that replicate themselves from system to system without the use of a host file. Considered a subclass of a virus. The biggest danger is its ability to replicate itself on a system. Can send out hundreds or thousands of copies of itself to create a devastating effect |
|
|
TROJAN HORSE |
Software program that appears legitimate but is actually malicious; unlike viruses and worms, neither reproduce by infecting other files, nor do they self-replicate; must be invited onto your computer; create a back door to give access to another user |
|
|
SPYWARE |
General term that is used for the programs that covertly monitor your activity on your computer; gather personal information |
|
|
HACKING |
Intentionally using a computer resource without authorization or in excess of authorization |
|
|
TRADITIONAL HACKING PROCEDURE: |
1. Scan networks for computers which may have vulnerabilities 2. Once a computer or sever is found use an "exploit" (software based attack method) to break-in 3. After break-in, install "hacker tool-kit" (software that typically automates many hacking tasks!)--Delete log files, make hacker an admin user, etc. |
|
|
DENIAL OF SERVICE ATTACKS (DoS) |
A method that hackers use to prevent or deny legitimate users access to a computer; typically executed using the DoS tools that send many request packets to a targeted Internet server; the attack floods the server's resources and makes the system unusable. |
|
|
DISTRIBUTED DENIAL OF SERVICE ATTACK (DDoS) |
Multiple machines used to administer a DoS attack; zombie computers or Bot-nets; hackers use viruses, worms, trojans, to gain control over a large number of computers; they send commands to these "bots" or "zombie" computers to send data traffic to a target server. All major commercial and govt websites have been a victim |
|
|
SOCIAL ENGINEERING |
Tricking/manipulating victims into performing actions or divulging confidential information. May be technology based |
|
|
PHISHING |
A type of social engineerign attack in which an email or message is sent with a link to an authentic looking (but fake) web site where users are asked to enter confidential information |
|
|
THE "GOOD GUYS" |
1. Hackers 2. White Hat |
|
|
THE "BAD GUYS" |
1. Crackers 2. Black Hat |
|
|
SCRIPT KIDDIES |
Inexperienced individuals trying to become hackers by using readily available scripts and tools to carry out hacking activities. They are dangerous because there are too many wannabes. |
|
|
CRIMINAL HACKES |
Most active today and represent the majority of attackers. Motivation is typically money; steal credit card information, identities, extortion, steal trade secrets to sell to competitors, etc. |
|
|
HACKTIVISM |
Hacking as activism; targets typically include govt and large organizations. Famous groups include "Anonymous" and "Lulz-sec" |
|
|
WHY DISGRUNTLED EMPLOYEES ARE A THREAT |
1. They are familiar with systems and possible vulnerabilities 2. Have access 3. Know what can cause the greatest damage 4. Disgruntled IT staff, particularly those in networking, software development, and IT security, could be truly disruptive |
|
|
ADVANCED PERSISTENT THREATS (APTs) |
Large scale, sophisticated operations, such as governments or large organizations that target other entities and pose some of the most menacing cyber-threats |
|
|
BUSINESS CONTINUITY PLANNING |
Outlines procedures for keeping an organization operational in the event of a catastrophic event such as natural disasters, major information security breaches, geo-political and military events, etc. |
|
|
IS SECURITY PLANNING PRINCIPLES |
1. Risk analysis 2. Defense in depth 3. Minimum permissions |
|
|
RISK ANALYSIS |
The process of rationally weighing the costs of protection versus threats for individual IT and Data assets. When planning for security, orgs are better off conducting thoroughly. |
|
|
DEFENSE IN DEPTH |
A planning principle that specifies that there should be multiple layers of protection for IT assets. If one layer fails, then it is likely that the other layers are still able to protect. |
|
|
MINIMUM PERMISSIONS |
A security planning principle which specifies that users of our IT systems be given the "least" or "minimum" permissions they need to carry out their jobs. *sometimes known as "principle of least privilege" Bottom line: Give only those privileges that are absolutely essential to a user's work |
|
|
TECHNICAL AND NONTECHNICAL SAFEGUARDS |
1. Access Control 2. Firewalls 3. Cryptography 4. Securing wireless networks 5. Legal requirements |
|
|
ACCESS CONTROL |
1. Authentication 2. Authorization |
|
|
AUTHENTICATION |
Making sure the person claiming to be someone is actually that person 1. Something you have (ID card, access cards,or other security tokens) 2. Something you know (passwords, challenge questions, PINS, etc.) 3. Something you are (biometrics: fingerprint or palm scanning, iris scanning, etc.) |
|
|
AUTHORIZATION |
Ensuring that the authenticated person has privileges appropriate for his/her role |
|
|
FIREWALLS |
System designed to detect intrusion and prevent unauthorized access into and out of a corporate network; isolates a private/corporate network from the internet |
|
|
FIREWALL ISOLATION WORKS BOTH WAYS |
To and from a private network, known as "ingress" and "egress" filtering |
|
|
FIREWALLS COULD BE IMPLEMENTED AS: |
1. Hardware device only 2. Software only 3. Combination of both |
|
|
CRYPTOGRAPHY |
The use of techniques, based on mathematics, to ensure secure communications between two parties in the presence f a "third-party" or "adversary" |
|
|
ENCRYPTION |
The process of encoding information in such as way that third parties cannot read it |
|
|
PLAIN TEXT |
The message to be encrypted |
|
|
CIPHER |
An algorithm (or pair of algorithms) used to encrypt the plain text |
|
|
KEY |
A (usually) short string of characters used in conjuction with a cipher to carry out the encryption. It is held secret, while ciphers are publicly known |
|
|
CIPHER TEXT |
The message after it is encrypted |
|
|
ASYMMETRIC KEY ENCRYPTION, OR PUBLIC KEY CRYPTOGRAPHY |
A cryptography method in which both the sender and receiver have two keys each
|
|
|
PUBLIC KEY |
Made public; Public key of RECEIVER used for encryption |
|
|
PRIVATE KEY |
Kept secret; Private key of RECEIVER used for decryption |
|
|
SECURING WIRELESS NETWORKS:WLANS |
Inherently not as secure because the data signals get "broadcasted." Must use encryption to protect data traffic |
|
|
WAR DRIVING |
Eavesdroppers "drive by" buildings to detect "open networks" and attempt to break into them. All they need is a laptop, wireless antenna, and some hacking software. aka drive by hacking |
|
|
LEGAL REQUIREMENTS |
Laws (national and international) require organizations and their employees to treat IT security seriously. Also a major reason why organizations must worry about security. |
|
|
THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) |
US federal law requiring protection of Medical Health Records and now "electronic health records." |
|
|
FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT (FERPA) |
US federal law requiring the protection of student records |
|
|
GRAMM-LEACH-BLILEY ACT |
Requires financial institutions to ensure security and confidentiality of customer data |
|
|
SARBANES-OXLEY ACT (SOX) |
Imposes responsibility on management to safeguard accuracy and integrity of financial data. Also restricts what kind of information is shared |
|
|
IT INFRASTRUCTURE |
All of the hardware, software, networks, facilities, etc. that are required to develop, test, deliver, monitor, control, or support applications and IT services **does not include the associated people, processes, and documentation |
|
|
HARDWARE |
the tangible |
|
|
SOFTWARE |
Set of instructions or computer programs that tell the hardware what to do. |
|
|
2 BROAD TYPES OF SOFTWARE |
1. Systems software (operating systems, utilities) 2. Application software (used to carry on specific tasks |
|
|
APPLICATION SOFTWARE |
Can be bought "off-the-shelf" readymade, can be developed in-house, outsourced, or some combination of both |
|
|
NETWORKS |
Two or more computers that are connected via software and hardware so that they can communicate with each other |
|
|
CLOUD COMMPUTING |
An umbrella term used to denote accessing software applications, and/or data storage, and/or processing capacity over the internet |
|
|
THREE TERMS OF CLOUD COMPUTING |
1. Software as a service (SaaS) 2. Platform as a service (PaaS) 3. Infrastructure as a service (IaaS) |
|
|
SOFTWARE AS A SERVICE (SaaS) |
A software delivery model in which a vendor provides software and associate data to a client via the internet. Both the software and the data are hosed in the cloud. Clients access the software through a web browser **previously known as application service provision/providers (ASP) |
|
|
KEY BENEFITS OF SaaS |
1. No need to develop software. Pay by number of users 2. No need to have dedicated hardware to run those applications, the vendor does it in the cloud 3. Updates are taken care of 4. Software supposedly based on "best practices" |
|
|
CONS OF SaaS |
1. Cannot customize much (customization is possible but costly) 2. Possible loss of control.../vendor lock-in |
|
|
PLATFORM AS A SERVICE (PaaS) |
In this model, cloud providers deliver a computing platform, typically including operating system, programming language execution environment, database, and web/application server |
|
|
THE PLATFORM IS: |
1. A specific combination of software and hardware 2. It allows users to create/deploy own applications using vendor specific platform |
|
|
INFRASTRUCTURE AS A SERVICE (IaaS) |
Most basic form of cloud offering where vendors provide computers (typically servers) to their clients. |
|
|
KEY POINTS OF IaaS |
1. Servers are most likely "virtualized" such that a single physical machine can host multiple virtual servers belonging to one or more clients 2. The computers come with plenty of other products/services to make it extremely easy for clients to get started, scale up, or scale down as needed |
