Isys 331 Final

Front 1

An email virus

Back 1

?

Front 2

A methodology and the probability of success

Back 2

?

Front 3

The physical design

Back 3

?

Front 4

The issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse

Back 4

?

Front 5

The _________ model and 6 general phases

Back 5

Waterfall; Conception, Initiation, Analysis, Design, Construction, Testing, Production/Implementation, and Maintenance

Front 6

Individuals with the primary responsibility for administering the systems that house the information used by the organization

Back 6

System administrator

Front 7

Having ownership or control of some object or item

Back 7

possession

Front 8

Phase 1 of the SecSDLC

Back 8

The investigation phase of the SecSDLC begins with a directive from upper management, dictating the process, outcomes, and goals of the project, as well as its budget and other constraints. Frequently, this phase begins with an enterprise information security policy, which outlines the implementation of a security program within the organization. Teams of responsible managers, employees, and contractors are organized; problems are analyzed; and the scope of the project, as well as specific goals and objectives, and any additional constraints not covered in the program policy, are defined. Finally, an organizational feasibility analysis is performed to determine whether the organization has the resources and commitment necessary to conduct a successful security analysis and design.

Front 9

Human error or failure

Back 9

Largest security risk

Front 10

Denial-of-service attacks

Back 10

an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

Front 11

The shoulder looking technique

Back 11

This technique is used in public or semipublic settings when individuals gather information they are not authorized to have by looking another individual's shoulder or viewing the information from a distance

Front 12

Online vandalism

Back 12

the act of committing vandalism through access to Internet

Front 13

Software programs

Back 13

?

Front 14

The attacker sends a large number of connection or information requests to a target

Back 14

denial-of-service attack

Front 15

A computer virus

Back 15

?

Front 16

Worms

Back 16

?

Front 17

HIPAA

Back 17

This act gives the right to privacy to individuals under 18, but at or above 12. The provider must have a signed disclosure from the affected before giving out any information on provided health care to anyone, including parents.

Front 18

A policy and a law

Back 18

?

Front 19

Ethics

Back 19

?

Front 20

The Privacy of Customer Information Section of the common carrier regulation

Back 20

?

Front 21

Laws to counter threats from computer related acts and offenses

Back 21

Computer Fraud and Abuse Act

Front 22

Stiffer penalties for prosecution of terrorist crimes

Back 22

?

Front 23

Family law, commercial law, and labor law

Back 23

?

Front 24

The requirements for a policy

Back 24

Dissemination, Review, Comprehension, Compliance, Uniform enforcement

Front 25

Once the threats have been identified

Back 25

?

Front 26

Examples of exceptionally grave damage

Back 26

Top Secret

Front 27

One problem with benchmarking

Back 27

unreliable

Front 28

Phases of risk management

Back 28

Identification, Analysis, Control, Transfer, Review

Front 29

Classification scheme

Back 29

?

Front 30

_________ feasibility addresses user acceptance and support

Back 30

?

Front 31

The relative importance of each asset

Back 31

?

Front 32

Access controls

Back 32

?

Front 33

Every policy should contain provisions for...

Back 33

?

Front 34

Security policies

Back 34

?

Front 35

Management controls

Back 35

?

Front 36

The mission, vision, and direction of the organization

Back 36

?

Front 37

An outline of the overall information security strategy for the organization

Back 37

?

Front 38

A buffer against outside attacks

Back 38

?

Front 39

Policies and an expiration date

Back 39

?

Front 40

Electronic vaulting

Back 40

transfer of data by electronic means to a backup site

Front 41

A packet's content

Back 41

?

Front 42

A content filter

Back 42

?

Front 43

Physical design

Back 43

?

Front 44

The restrictions most commonly implemented in packet filtering firewalls

Back 44

?

Front 45

The application gateway

Back 45

?

Front 46

Telnet protocol packets

Back 46

?

Front 47

The circuit gateway firewall

Back 47

?

Front 48

Firewall use

Back 48

?

Front 49

A passive response

Back 49

?

Front 50

Intrusion detection

Back 50

?

Front 51

Services using the TCP/IP port

Back 51

?

Front 52

_____ is an event that triggers alarms

Back 52

?

Front 53

A specifically configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device

Back 53

?

Front 54

TCP session

Back 54

?

Front 55

The process of attracting attention to a system by placing tantalizing bits of information in key locations

Back 55

?

Front 56

IDPS

Back 56

?

Front 57

The most common hybrid system

Back 57

?

Front 58

Popular cryptosystems

Back 58

?

Front 59

A key is....

Back 59

?

Front 60

The entire range of values that can possibly be used to construct an individual key

Back 60

?

Front 61

A one-way hash value that is encrypted with a symmetric key

Back 61

?

Front 62

The _______ protocol provides system to system authentication and data integrity verification, but...

Back 62

?

Front 63

The process of making and using codes to secure the transmission of information

Back 63

?

Front 64

Encryptions

Back 64

?

Front 65

Consulting in the area of physical security

Back 65

?

Front 66

For laptops there are burglar alarms

Back 66

?

Front 67

True online UPS

Back 67

?

Front 68

Most guards have clear _____ that

Back 68

?

Front 69

Electronic monitoring

Back 69

?

Front 70

The locks

Back 70

?

Front 71

A small enclosure that has an entry point and a different exit point

Back 71

?

Front 72

Physical loss

Back 72

?

Front 73

An information security department or program of its own

Back 73

?

Front 74

The primary drawback to the direct changeover approach

Back 74

?

Front 75

A trained project CEO

Back 75

?

Front 76

If the task is to write firewall specifications

Back 76

?

Front 77

The best approach to security project implementation

Back 77

?

Front 78

A process to resolve potential conflict and disruption that uncoordinated change can introduce

Back 78

?

Front 79

The tasks or action steps that come before the specific task at hand

Back 79

?

Front 80

The process of change

Back 80

?

Front 81

The staff of information security teams

Back 81

?

Front 82

The position of security technician

Back 82

?

Front 83

SCP

Back 83

?

Front 84

Many information security professionals enter the field from

Back 84

?

Front 85

A certification program

Back 85

?

Front 86

The biometrics and PKI

Back 86

?

Front 87

Accountability for the day-to-day operation of the information security program

Back 87

?

Front 88

When an employee prepares to leave an organization

Back 88

?

Front 89

Policies can be considered enforceable even if

Back 89

?

Front 90

Configuration management

Back 90

?

Front 91

Documentation procedures

Back 91

?

Front 92

When the amount of data stored on a particular hard drive averages 30-40% of available capacity for a prolonged period

Back 92

?

Front 93

A maintenance model such as the ISO model

Back 93

?

Front 94

Security personnel

Back 94

?

Front 95

The administration of changes in the strategy, operation, or components of the information security program

Back 95

?

Front 96

_______ enables organizations to charge their internal departments for system

Back 96

?

Front 97

When the memory usage associated with a particular CPU-based system averages

Back 97

?

Front 98

Information security management system

Back 98

?

Front 99

The baseline of systems and services

Back 99

?

Front 100

Configuration management

Back 100

?

Front 101

Phase 2 of SecSDLC

Back 101

Analysis
In the analysis phase, the documents from the investigation phase are studied. The development team conducts a preliminary analysis of existing security policies or programs, along with that of documented current threats and associated controls. This phase also includes an analysis of relevant legal issues that could affect the design of the security solution. Increasingly, privacy laws have become a major consideration when making decisions about information systems that manage personal information. Recently, many states have implemented legislation making certain computer-related activities illegal. A detailed understanding of these issues is vital. The risk management task also begins in this stage. Risk management is the process of identifying, assessing, and evaluating the levels of risk facing the organization, specifically the threats to the organization’s security and to the information stored and processed by the organization.

Front 102

Phase 3 of SecSDLC

Back 102

The logical design phase creates and develops the blueprints for information security, and examines and implements key policies that influence later decisions. Also at this stage, the team plans the incident response actions to be taken in the event of partial or catastrophic loss. The planning answers the following questions:
- Continuity planning: How will business continue in the event of a loss?
- Incident response:What steps are taken when an attack occurs?
- Disaster recovery:What must be done to recover information and vital systems immediately after a disastrous event?
Next, a feasibility analysis determines whether or not the project should be continued or be outsourced.

Front 103

Phase 4 of SecSDLC

Back 103

In the physical design phase, the information security technology needed to support the blueprint outlined in the logical design is evaluated, alternative solutions generated, and a final design agreed upon. The information security blueprint may be revisited to keep it in line with the changes needed when the physical design is completed. Criteria for determining the definition of successful solutions are also prepared during this phase. Included at this time are the designs for physical security measures to support the proposed technological solutions. At the end of this phase, a feasibility study should determine the readiness of the organization for the proposed project, and then the champion and sponsors are presented with the design. At this time, all parties involved have a chance to approve the project before implementation begins.

Front 104

Phase 5 of SecSDLC

Back 104

The implementation phase in of SecSDLC is also similar to that of the traditional SDLC. The security solutions are acquired (made or bought), tested, implemented, and tested again. Personnel issues are evaluated, and specific training and education programs conducted. Finally, the entire tested package is presented to upper management for final approval.

Front 105

Phase 6 of SecSDLC

Back 105

The maintenance and change phase, though last, is perhaps most important, given the current ever-changing threat environment. Today’s information security systems need constant monitoring, testing,modification, updating, and repairing. Traditional applications systems developed within the framework of the traditional SDLC are not designed to anticipate a vicious attack that would require some degree of application reconstruction. In information security, the battle for stable, reliable systems is a defensive one. Often, repairing damage and restoring information is a constant effort against an unseen adversary. As new threats emerge and old threats evolve, the information security profile of an organization requires constant adaptation to prevent threats from successfully penetrating sensitive data. This constant vigilance and security can be compared to that of a fortress where threats from outside as well as from within must be constantly monitored and checked with continuously new a