Iss Test 2

Front 1

block cipher being developed as a successor to DES. It operates under the symmetric key model.

Back 1

Advanced Encryption Standard (AES)

Front 2

developed in the 1970s by the National Bureau of Standards with the help of the National Security Agency" with an algorithm submitted by IBM. It operates under the symmetric key model. This is the current standard

Back 2

Data Encryption Standard (DES) and Triple-DES (3DES)

Front 3

an encryption algorithm that employs the asymmetric key model.

Back 3

Diffie-Hellman

Front 4

block cipher used in PGP. unlike the other block cipher algorithms is patented by the Swiss firm of Ascom. They have, however, been generous in allowing, with permission, free noncommercial use of their algorithm, with the result that ______ is best known as the block cipher algorithm used within the popular encryption program PGP."

Back 4

International Data Encryption Algorithm (IDEA)

Front 5

993 by Bruce Schneier as a fast, free alternative to existing encryption algorithms. Since then it has been analyzed considerably, and it is slowly gaining acceptance as a strong encryption algorithm.

Back 5

Blowfish

Front 6

unpatented, and the source code is uncopyrighted and license-free; it is free for all uses." (Counterpane Internet Security: ________: A New Block Cipher) It operates under the symmetric key model.

Back 6

Twofish

Front 7

family of algorithms that employ the asymmetric key model. There are actually multiple incarnations of this algorithm; RC5 is one of the most common in use.

Back 7

Rivest-Shamir-Adelman (RSA)

Front 8

Select this check box to rely on a common passphrase rather than on public key cryptography. The file is encrypted using a session key, which encrypts using a passphrase that you will be asked to choose.

Back 8

Conventional Encryption

Front 9

Select this checkbox to create a self decrypting executable file. If you select this option, the file is encrypted using a session key, which encrypts (and decrypts) using a passphrase that you are asked to choose. To decrypt the file, double-click it and enter the appropriate passphrase. This option is especially convenient for user’s who are sending encrypted files to people who do not have PGP software installed.

Back 9

Self Decrypting Archive (SDA)

Front 10

focuses on immediate response, but if the attack escalates or is disastrous the process changes to disaster recovery and BCP

Back 10

IRP

Front 11

typically focuses on restoring systems after disasters occur, and as such is closely associated with BCP

Back 11

DRP

Front 12

occurs concurrently with DRP when the damage is major or long term, requiring more than simple restoration of information and information resources

Back 12

BCP

Front 13

A high-level manager to support, promote, and endorse the findings of the project

Back 13

Champion

Front 14

Leads the project and makes sure a sound project planning process is used, a complete and useful project plan is developed, and project resources are prudently managed

Back 14

Project Manager

Front 15

Should be the managers or their representatives from the various communities of interest: Business, IT, and Information Security

Back 15

Team Members

Front 16

Fill in the Blanks of the Contingency Planning Hierarchy.

Back 16

Contingency Planning, Incident Response, Disaster recovery, and business continuity

Front 17

Fill in the steps of the Contingency Planning Timeline.

Back 17

Incident Response (IRP), Disaster Recovery (DRP), and Business Continuity (BCP)

Front 18

What has the following steps.
1. Treat attack identification
2. Business unit analysis
3. Attack Success Scenarios
4. Potential Damage Assessment
5. Subordinate Plan Classification

Back 18

Business Impact Analysis (BIA)

Front 19

The detailed description of activities during an attack

Back 19

Attack Profile

Front 20

* The second major task within the BIA is the analysis and prioritization of business functions within the organization
* Identify the functional areas of the organization and prioritize them as to which are most vital
* Focus on a prioritized list of the various functions the organization performs

Back 20

Business Unit Analysis

Front 21

whether or not an organization is able to take effective action during the event to combat the effect of the attack

Back 21

Qualifying Differene

Front 22

________ is an attack against an information asset that poses a clear threat to the confidentiality, integrity, or availability of information resources

Back 22

An Incident

Front 23

Attacks are only classified as incidents if they have what three characteristics?

Back 23

Are directed against information assets
Have a realistic chance of success
Could threaten the confidentiality, integrity, or availability of information resources

Front 24

What are the following?
*intrusion detection systems, both host-based and network-based
*virus detection software
*systems administrators
*end users

Back 24

Possible Incident Detectors

Front 25

When Does an Incident Become a Disaster?

Back 25

* the organization is unable to mitigate the impact of an incident during the incident
* the level of damage or destruction is so severe the organization is unable to quickly recover
* It is up to the organization to decide which incidents are to be classified as disasters and, thus, receive the appropriate level of response

Front 26

consists of actions that guide the organization to stop the incident, mitigate the impact of the incident, and provide information for the recovery from the incident

Back 26

Incident Reaction

Front 27

What are the following the steps of?

* There must be a clear establishment of priorities
* There must be a clear delegation of roles and responsibilities
* Someone must initiate the alert roster and notify key personnel
* Someone must be tasked with the documentation of the disaster
* If and only if it is possible, some attempts must be made to mitigate the impact of the disaster on the operations of the organization

Back 27

Disaster Recovery Plan (DRP)

Front 28

actions taken during and after a disaster focusing on the people involved and addressing the viability of the business

Back 28

Crisis Managment

Front 29

outlines reestablishment of critical business operations during a disaster that impacts operations

Back 29

Business Continuity Planning

Front 30

The bulk batch-transfer of data to an off-site facility.

Back 30

Electronic Vaulting

Front 31

The transfer of live transactions to an off-site facility; only transactions are transferred not archived data, and the transfer is real-time.

Back 31

Remote Journaling

Front 32

Not only processing duplicate real-time data storage, but also duplicates the databases at the remote site to multiple servers.

Back 32

Database Shadowing

Front 33

* Fully configured and ready to operate within a few hours of a disaster
* Can support a short- or long-term outage
* Flexible in its configuration and options

Back 33

Hot Site

Front 34

* Partially configured with some equipment
* Essentially provide the facility and some peripheral devices, but not a full configuration like a hot site

Back 34

Warm Site

Front 35

*Supplies basic computing environments including wiring, ventilation, plumbing, and flooring

Back 35

Cold Site

Front 36

What are these the six steps of?

1. Identifying the mission- or business-critical functions
2. Identifying the resources that support the critical functions
3. Anticipating potential contingencies or disasters
4. Selecting contingency planning strategies
5. Implementing the contingency strategies
6. Testing and revising the strategy

Back 36

Contingency Planning Process

Front 37

What is the major drawback to law enforcement involvement?

Back 37

You lose control of your data and systems.

Front 38

deals with many computer crimes that are categorized as felonies

Back 38

Federal Bureau of Investigation

Front 39

works with crimes involving US currency, counterfeiting, credit cards, identity theft, and other crimes

Back 39

US Secret Service

Front 40

has a bank fraud investigation unit and the Securities and Exchange Commission has investigation and fraud control units as well

Back 40

US Treasury Department

Front 41

What is the biggest advantage to law enforcement involvement?

Back 41

Better equipt

Front 42

what was

* Developed in a language called ABAP
* Platform that includes the operating system and database called Basis

Back 42

R/3

Front 43

*Language of choice is Java and ABAP
* Basis is replace with the SAP Web Application Server (WAS) which implements the J2EE 1.3 standard
* Extended by several products including BI, Portals and others

Back 43

SAP NetWeaver

Front 44

* Creates professional user interfaces while minimizing manual coding
* Uses visual design tools and reuses UI components
* Users Model-View-Controller architecture, clear separation between UI and backend services

Back 44

Web Dynpro

Front 45

* An abstraction of the database that allows more platform independence than JDBC
* Allows a direct relational interface or an object-based interface to access data with little work on the part of the developer

Back 45

Open SQL

Front 46

Facilitates unified access to enterprise applications to enable Drag and Relate operations

Back 46

Unification technology

Front 47

Renders HTML pages which users interact

Back 47

Page builder

Front 48

Create users and assign then roles

Back 48

Use role management

Front 49

Single sign on to all systems

Back 49

User management

Front 50

Built on proven technology. A solution verified for large data warehouses (5+ Tb)

Back 50

Performance/Scalability

Front 51

Integrates business processes. Provides a centralized metadata repository with a consistent business semantic. Read-to-go templates and best-practices – horizontal and vertical business content.

Back 51

Business Orientation

Front 52

Supports decision-making requirements of every user.

Back 52

Actionable Information

Front 53

A platform for process integration based upon the exchange of XML messages

Back 53

Exchange Infrastructure (XI)

Front 54

To tap the contents of text documents by structuring and classifying them so relevant information is available

Back 54

Knowledge Management

Front 55

Is designed to provide a unified view of data from a distributed and heterogeneous environment

Back 55

Master Data Management (MDM)

Front 56

A model-driven development environment that allows applications to be assisted by the use of modeling to describe the structure of the application so that code and interfaces of various sorts can be generated.

Back 56

Composite Application Framework (CAF)

Front 57

Security mechanisms:

security clearance of personnel, pwd protection, information classification, security policies, application program controls, audit

Back 57

External procedures

Front 58

Security mechanisms:

hazards, fire, flooding, radiation

Back 58

Physical security

Front 59

Security mechanisms:

encryption, duplication, hot, cold sites

Back 59

Data storage

Front 60

Security mechanisms:

authentication, access, threat monitoring, audit trail

Back 60

Processor software

Front 61

Security mechanisms:

memory protection, reliability

Back 61

Processor hardware

Front 62

Security mechanisms:

encryption

Back 62

Communication lines

Front 63

A critical element of security and control in a financial application is monitoring of

Back 63

Great Plains Dynamics (GPD)

Front 64

What GPD tool combines inquiry and reporting capabilities to provide easier access to Dynamics business objects

Back 64

SmartList

Front 65

__________________________ can also be used to set the SmartList views that will be available to a specific user or to a specific user class.

Back 65

SmartList Security window

Front 66

For security by ___________, the settings apply to the members of the class without regard to what Dynamics Company they work with.

Back 66

user class

Front 67

For a ______________, select the company these settings should apply to.

Back 67

single user

Front 68

what is a classification feature in Dynamics in which users are grouped and given the same levels of access to the accounting system.

Back 68

user class

Front 69

states that in lists of numbers from many real-life sources of data, the leading digit is 1 almost one third of the time, and larger numbers occur as the leading digit with less and less frequency as they grow in magnitude, to the point that 9 is the first digit less than one time in twenty. This is based on the observation that real-world measurements are generally distributed logarithmically, thus the logarithm of a set of real-world measurements is generally distributed uniformly.

This counter-intuitive result applies to a wide variety of figures, including electricity bills, street addresses, stock prices, population numbers, death rates, lengths of rivers, physical and mathematical constants, and processes described by power laws (which are very common in nature). Even more counter-intuitively, the result holds regardless of the base in which the numbers are expressed, although the exact proportions of course change.

Back 69

Benford's law

Front 70

Is used to analyze data and produce reports for both non-technical and expert users. It saves you time and money by accomplishing in minutes what used to take hours or even days.

Back 70

ACL

Front 71

is the perceived level of risk that a material misstatement may occur in the client's un-audited financial statements, or underlying levels of aggregation, in the absence of internal control procedures.

Back 71

Inherent risk (IR)

Front 72

is the perceived level of risk that a material misstatement in the client's un-audited financial statements, or underlying levels of aggregation, will not be detected and corrected by the management's internal control procedures

Back 72

control risk (CR)

Front 73

is the perceived level of risk that a material misstatement in the client's un-audited financial statements, or underlying levels of aggregation, will not be detected by the auditor.

Back 73

detection risk (DR)

Front 74

The higher the assessment of inherent and control risk the more ________________ the IS auditor should normally obtain from the performance of substantive audit procedures.

Back 74

audit evidence

Front 75

_______________ is broadly defined as a process, effected by an entity's board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
Effectiveness and efficiency of operations.
Reliability of financial reporting.
Compliance with applicable laws and regulations.

Back 75

Internal control

Front 76

has established a common definition of internal controls, standards, and criteria against which companies and organizations can assess their control systems.

Back 76

COSO

Front 77

is a term used for a number of concepts involving either the performance of an investigation of a business or person, or the performance of an act with a certain standard of care. It can be a legal obligation, but the term will more commonly apply to voluntary investigations.

Back 77

Due diligence

Front 78

identifying, assessing and evaluating the levels of risk facing the organization, also begins in this stage.

Back 78

risk management task

Front 79

has been considered the industry standard for computer security since the development of the mainframe. It was solely based on three characteristics that described the utility of information: confidentiality, integrity, and availability.

Back 79

The C.I.A. triangle

Front 80

weaknesses or faults in a system or protection mechanism that expose information to attack or damage

Back 80

Vulnerability

Front 81

a category of objects, persons, or other entities that represents a potential danger to an asset.

Back 81

Threats

Front 82

to take advantage of weaknesses or vulnerability in a system

Back 82

Exploit

Front 83

an act that is an intentional or unintentional attempt to cause damage or compromise to the information and/or the systems that support it.

Back 83

Attack

Front 84

a subject or object’s ability to use, manipulate, modify, or affect another subject or object.

Back 84

Access

Front 85

the probability that something can happen.

Back 85

Risk

Front 86

an active entity that interacts with an information system and causes information to move through the system for a specific end purpose

Back 86

Subject

Front 87

he action of gathering, analyzing, and applying information about products, domain constituents, customers, and competitors for the short term and long term planning needs of an organization

Back 87

Competitive intelligence

Front 88

Name the threat Category:

Accidents, employee mistakes

Back 88

Acts of human error or failure

Front 89

Name the threat Category:

Piracy, copyright infringement

Back 89

Compromise to intellectual property

Front 90

Name the threat Category:

Unauthorized access and/or data collection

Back 90

Deliberate acts of espionage or trespass

Front 91

Name the threat Category:

Blackmail of information disclosure

Back 91

Deliberate acts of information extortion

Front 92

Name the threat Category:

Destruction of systems or information

Back 92

Deliberate acts of sabotage or vandalism

Front 93

Name the threat Category:

Illegal confiscation of equipment or information

Back 93

Deliberate acts of theft

Front 94

Name the threat Category:

Viruses, worms, macros, denial-of-sevice

Back 94

Deliberate software attacks

Front 95

Name the threat Category:

Fire, flood, earthquake, lightning

Back 95

Forces of nature

Front 96

Name the threat Category:

Power and WAN service issues

Back 96

Deviations in quality of services from service providers

Front 97

Name the threat Category:

Equipment failures

Back 97

Technical hardware failures or errors

Front 98

Name the threat Category:

Bugs, code problems, unknown loophols

Back 98

Technical software failures or errors

Front 99

Name the threat Category:

Antiquated or outdated technologies

Back 99

Technological obsolescence

Front 100

A risk management strategy calls on us to “know ourselves” by identifying, classifying, and prioritizing the organization’s information assets

Back 100

Risk Identification

Front 101

Modification of Systems Development Life Cycle for risk managment

Back 101

waterfall methodology

Front 102

We can determine the relative risk for each of the vulnerabilities through a process called _______________.

Back 102

Risk Assessment

Front 103

what formula is used for Risk Determination

Back 103

RISK ={(likelihood of vulnerability occurrence)*(value or impact)}- percentage risk already controlled + an element of uncertainty

Front 104

strategies for risk management:

Apply safeguards

Back 104

avoidance

Front 105

strategies for risk management:

Transfer the risk

Back 105

transference

Front 106

strategies for risk management:

Reduce the impact

Back 106

mitigation

Front 107

strategies for risk management:

Inform themselves of all of the consequences and accept the risk without control or mitigation

Back 107

acceptance

Front 108

is simply how often you expect a specific type of attack to occur, per year

Back 108

Annualized Rate of Occurrence (ARO)

Front 109

is the calculation of the value associated with the most likely loss from an attack

Back 109

Single Loss Expectancy (SLE)

Front 110

is the percentage loss that would occur from a given vulnerability being exploited

Back 110

exposure factor (EF)

Front 111

What is the formula for Single Loss Expectancy (SLE)?

Back 111

asset value x exposure factor (EF)

Front 112

What is the formula for Annualized Loss Expectancy (ALE) ?

Back 112

= Single Loss Expectancy (SLE) * Annualized Rate of Occurrence (ARO)

Front 113

Rather than use the financial value of information assets, review peer institutions to determine what they are doing to protect their assets

Back 113

benchmarking

Front 114

_________is the analysis of measures against established standards

Back 114

Baselining

Front 115

___________ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility

Back 115

Risk appetite

Front 116

What are the three types of plans that help mitigate damages causes by incidents?

Back 116

1. incident response planning (IRP)
2. disaster recovery planning (DRP)
3. business continuity planning (BCP)

Front 117

_________ direct how issues should be addressed and technologies used

Back 117

Policies

Front 118

What are the following examples of?

* high risk, moderate risk, low risk
* board confidential, senior management confidential, department confidential, company confidential, public

Back 118

Information Classification

Front 119

One of the foundations of security architectures is the requirement to implement security in layers. __________________ requires that the organization establish sufficient security controls and safeguards, so that an intruder faces multiple layers of controls

Back 119

Defense in depth

Front 120

The point at which an organization’s security protection ends, and the outside world begins, is referred to as the __________________. Unfortunately the _________ does not apply to internal attacks from employee threats, or on-site physical threats.

Back 120

security perimeter

Front 121

An ___________________________ is used to detect many types of malicious network traffic and computer usage that can't be detected by a conventional firewall. This includes network attacks against vulnerable services, data driven attacks on applications, host based attacks such as privilege escalation, unauthorized logins and access to sensitive files, and malware (viruses, trojan horses, and worms).

Back 121

intrusion detection system

Front 122

What is this model known as?

Back 122

The Triangle model

Front 123

Positive identification of person/system seeking access to secured information/services

Back 123

Authentication

Front 124

Predetermined level of access to resources

Back 124

Authorization

Front 125

Logging use of each asset

Back 125

Accounting

Front 126

Unique alphanumeric identifier used to identify an individual when logging onto a computer/network

Back 126

Username

Front 127

Secret combination of keystrokes that, when combined with a username, authenticates a user to a computer/network

Back 127

Password

Front 128

____________ prevents eavesdropping or replay attacks, and ensures the integrity of the data. Its designers aimed primarily at a client-server model, and it provides mutual authentication — both the user and the server verify each other's identity.

__________ builds on symmetric key cryptography and requires a trusted third party.

Back 128

Kerberos

Front 129

Point-to-Point Protocol (PPP) mechanism used by an authenticator to authenticate a peer

Back 129

Challenge Handshake Authentication Protocol (CHAP)

Front 130

Electronic means of verifying identity of an individual/organization

Back 130

Digital Certificates

Front 131

Converts plain text message into secret message

Back 131

Encryption

Front 132

Converts secret message into plain text message

Back 132

Decryption

Front 133

Uses only one key

Back 133

Symmetric cipher

Front 134

Uses a key pair (private key and public key)

Back 134

Asymmetric cipher

Front 135

Trusted, third-party entity that verifies the actual identity of an organization/individual before providing a digital certificate

Back 135

Certificate authority (CA)

Front 136

Practice of using a trusted, third-party entity to verify the authenticity of a party who sends a message

Back 136

Nonrepudiation

Front 137

* Authentication devices assigned to specific user
* Small, credit card-sized physical devices
* Incorporate two-factor authentication methods
* Utilize base keys that are much stronger than short, simple passwords a person can remember

Back 137

Security Tokens

Front 138

Security Token Type:

* Act as a storage device for the base key
* Do not emit, or otherwise share, base tokens

Back 138

Passive

Front 139

Security Token Type:

* Actively create another form of a base key or encrypted form of a base key that is not subject to attack by sniffing and replay
* Can provide variable outputs in various circumstances

Back 139

Active

Front 140

what type of authentication does the following?

* Uses measurements of physical or behavioral characteristics of an individual
* Generally considered most accurate of all authentication methods
* Traditionally used in highly secure areas
Expensive

Back 140

Biometrics

Front 141

This is what percent of the time will an authorized person be rejected by the system.

Back 141

FRR (False Rejection Rate)
Type 1 error rate

Front 142

This is what percent of the time will an unauthorized person be accepted by the system?

Back 142

FAR (False Acceptance Rate)
Type 2 error rate

Front 143

Point at which FRR and FAR is?

Back 143

cross over

Front 144

Known to be the most secure type of biometric authentication.

Back 144

Retina

Front 145

What are the important factors to consider when choosing a biometric technology for your application? ______________will show you how each technology ranks for cost, accuracy, effort and ease of use.

Back 145

Zephyr Analysis

Front 146

_____________ is the art and science of writing hidden messages in such a way that no one apart from the intended recipient knows of the existence of the message; this is in contrast to cryptography, where the existence of the message itself is not disguised, but the content is obscured. Quite often, _________________ is hidden in pictures.

Back 146

Steganography

Front 147

What does this diagram represent?

Back 147

The Zephyr Analysis