Isa Chapter 12

Front 1

threat

Back 1

a person or organization that seeks to obtain or alter data or other assets illegally without the owner's permission and often without the owner's knowledgeÂ

Front 2

Vulnerability

Back 2

Opportunity for threats to gain access to individual or organizational assetsÂ

Front 3

Safe Guard

Back 3

some measure that individuals or organization take to block the threat from obtaining the assetÂ

Front 4

TargetÂ

Back 4

the asset that is desired by the threat

Front 5

sources of threat

Back 5

human error, computer crime, natural events and disasters

Front 6

Human Error Threat

Back 6

accidental problems caused by both employees and non employeesÂ

Front 7

Computer Crime Threat

Back 7

Employes and former employees who unintentionally destroy data or other system components

Front 8

Natural Events and Disasters ThreatsÂ

Back 8

fires, floods, hurricanes, earthquake, tsunamis, avalanches and other acts of natureÂ

Front 9

Types of Security Loss

Back 9

Unauthorized data disclosure Incorrect data modification faulty service denial of service loss of infrastructure

Front 10

Unauthorized Data Disclosure

Back 10

when a threat obtains data that is supposed to be protectedÂ

Front 11

PretextingÂ

Back 11

when someone deceives by pretending to be someone else over the phone or textingÂ

Front 12

SpoofingÂ

Back 12

pretending to be someone else from a real IP addressÂ

Front 13

IP spoofing

Back 13

pretending to be someone else from a real IP addressÂ

Front 14

Email Spoofing

Back 14

obtaining information while pretending to be someone else via email

Front 15

SniffingÂ

Back 15

intercepting computer communications, requires physical connection to network Â

Front 16

Faulty Service

Back 16

incorrect system operationÂ

Front 17

UsurpationÂ

Back 17

when computer criminals invade a computer system and replace legitimate programs with their own unauthorized ones that shut down legitimate applications and substitute their own processing to spy, steal, and manipulate dataÂ

Front 18

Denial of ServiceÂ

Back 18

human error following procedures or the lack of proceduresÂ

Front 19

denial-of-service attacks

Back 19

maliicious ahaver floods server, unintentially shut down,

Front 20

Advance persistent ThreatÂ

Back 20

sophisticated, possibly long running, computer hack that is perpetrated by large, well funded organization like governmentsÂ

Front 21

Goal of IS SecurityÂ

Back 21

to find an appropriate trade off between the risk of loss and the cost of implementing safe guards.Â

Front 22

Intrusion detecting system IDS

Back 22

a computer program that senses when another computer is attempting to scan the disk or otherwise access a computerÂ

Front 23

Responding to Security ThreatsÂ

Back 23

1. take security seriously, create strong passwords, use multiple passwords
4. send no valuable date via email or IM
5. use http at trusted reputable venders
6. clear growing history, temp files, and cookies
7. update anti-virus software
8. demonstrate security concern to your fellow workers
9. consider security for all business initiatives

Front 24

CookiesÂ

Back 24

small files that your browser store on your computer when you visit websitesÂ

Front 25

Manage Risk

Back 25

Proactively balance the trade off between risk and cost

Front 26

Technical Safeguards include

Back 26

identification and authentication, encryption, firewalls, malware protection, design for secure applications

Front 27

Technical Safeguards

Back 27

involve the hardware and software components of an information systemÂ

Front 28

Examples of identification and authenticationÂ

Back 28

smart cards, biometric authroization

Front 29

EncryptionÂ

Back 29

the process of transforming clear text into coded, intelligible text of secure storage or communicationÂ

Front 30

Key

Back 30

a number used to encrypt the data

Front 31

symmetric encryption

Back 31

same key is used to encode and decode, fast and preferredÂ

Front 32

asymmetric encryptionÂ

Back 32

two keys are used, one to encode and one to decodeÂ

Front 33

public key/private key

Back 33

a special version of asymmetric encryption used on the Internet, where each site has a public key for encoding messages and a private key for decoding

Front 34

HTTPS

Back 34

secure communication over the internetÂ

Front 35

Secure Socket Layer (SSL) or Transport Layer Security (TSL)

Back 35

protocol used to encrypt data with https; uses a combination of public key/private key and symmetric encryption

Front 36

FirewallsÂ

Back 36

computer device that prevents unauthorized network accessÂ

Front 37

Perimeter FirewallÂ

Back 37

the first device that Internet traffic encounters; sits outside the organizational networkÂ

Front 38

Internal Firewall

Back 38

inside organizational network

Front 39

worm

Back 39

a virus that propagates using the internet or computer network

Front 40

tojan horse

Back 40

viruses that masquerade as useful programs or files

Front 41

SpywareÂ

Back 41

installed on user's computer without their knowledge or permissionÂ

Front 42

payload

Back 42

program code caused unwanted or harmful activityÂ

Front 43

Account AdministrationÂ

Back 43

concerns the creation of new user accounts the modification of existing account permission and the removal of unneeded accountsÂ

Front 44

Stunex (APT)

Back 44

APT reputed to have been used to set back the Iranian nuclear program by causing Iranian centrifuges to malfunction

Front 45

Flame (ATP)

Back 45

(ATP) a large and complex computer program that is reputed to have hacked into computers and to operate as a cyber spy, capturing screen images, email and text messages, and even searching nearby smartphones using Bluetooth communication/

Front 46

beacons

Back 46

tiny files that gather demographic information, use a single code to identify users by age, gender, location, likely income, and online activity. A beacon code can contain your favorite movies, whether you read online news, your shopping habits, your online dating habits, and what type of research you conduct on computer.