Principles Of Information Systems Security

Front 1

The four types of access that may be granted to a database are ___________, __________, __________, and ________ (CRUD), and also represent the four types of security breaches that may occur in systems.

Back 1

create
read
update
delete

Front 2

Successful ___________ control procedures should record the state of a system, then examine, verify, and correct the recorded states

Back 2

auditing

Front 3

While security controls often concentrate on the prevention of intentional security breaches, most breaches are _______________.

Back 3

accidental

Front 4

Application controls address the ____________ of a failure.

Back 4

prevention

Front 5

Audit controls address the _______________ of a failure (i.e., audit controls attempt to determine if the application controls are adequate).

Back 5

detection

Front 6

Controls which are used at the analysis and design stages of the systems life cycle as a tool to understand and document other control points within a system re called ______________ controls

Back 6

modeling

Front 7

Good ____________ controls not only answer what are the functions of a system and how those functions are being accomplished, the controls address the question of why the system is performing those particular functions.

Back 7

documentation

Front 8

Name a model used for assessing the security engineering aspects of the target organization.

Back 8

The SSE-CMM architecture is designed to enable a determination of a security engineering organization’s process maturity across the breadth of security engineering.

Front 9

The building of infrastructure and corporate culture that establishes methods, practices, and procedures is called ______________.

Back 9

Institutionalization

Front 10

A(n) _________ practice should be applied across the life cycle of the enterprise, and should not specify a particular method or tool.

Back 10

base

Front 11

Auditing

Back 11

One of the most fundamental control structures, it verifies that a system is performing the functions that it should. Two Forms: the record of changes of state of a system; a systematic process that examines and verifies a system (system is evaluated to determine if it is functioning correctly.

Front 12

Control structures

Back 12

The main tools used to minimize/prevent the three types of system failures. classified into four categories: auditing, application controls, modeling controls and documentation controls

Front 13

SSE-CMM (System Security Engineering Capability Maturity Model)

Back 13

Model that guides improvement in the practice of security engineering through small incremental steps thereby developing a culture of continuous process improvement. The model is also a means of providing a structured approach for identifying and designing a range of controls.

Front 14

All security breaches, without exception, are the result of a system failure and falls into one of three categories. The three categories are:

Back 14

1. Failure to perform a function that should have been executed.
2. Performance of a function that should not have been executed.
3. Performance of a function that produced an incorrect result.
So in effect its either - Didn't do, Did but shouldn't have or Did it and got the wrong answer.

Front 15

What are the three essential components of risk management?

Back 15

risk assessment
risk mitigation
risk evaluation.

Front 16

Risk assessment considers _______ to be a function of the likelihood of a given threat resulting in certain __________________.

Back 16

risk
vulnerabilities

Front 17

What essential Information Security Principles do the following interview questions address?
What is the potential business impact if the information were disclosed?
What are the effects on the organization if the information is not reliable?
To what extent can the system downtime be tolerated?

Back 17

They address the security principles associated with system characterization, namely operation information that relates to the functional requirements of the system, the stakeholders of the system, and security policies and architectures governing the IT system.

Front 18

An indication of impending danger or harm is called a ________________.

Back 18

threat

Front 19

A weakness that can be accidentally triggered or intentionally exploited is called a ____________.

Back 19

vulnerability

Front 20

In attempts to identify all sorts of threats, it is useful to consider them as being ____________ or _____________.

Back 20

Intentional
Unintentional

Front 21

The three elements in calculating the likelihood that any vulnerability will be exercised include source of the threat, the nature of the vulnerability and the ______________ of the controls.

Back 21

effectiveness

Front 22

The three essential components of risk management are _________________, _______________, and ________________.

(Components of Risk Mgmt)

Back 22

risk assessment
risk mitigation
risk evaluation

Front 23

A critical aspect of risk assessment is to determine the _____________ of the IT system.

Back 23

scope

Front 24

An assessment of the ______________ security environment is also essential. This is often overlooked and emphasis is placed on technical controls.

Back 24

physical

Front 25

The level of risk for a particular threat or vulnerability can be expressed as a function of:
* The ____________of a given threat exercising the vulnerability
* The ____________ of the impact of the threat
* The ____________ of planned or existing security controls

Back 25

likelihood
magnitude
adequacy

Front 26

Vulnerabilities which usually result from inadequate supervision, negligent persons, and natural disasters such as fires and floods are classified as ______________ vulnerabilities.

Back 26

physical

Front 27

Risk ___________ involves the process of prioritizing, evaluating, and implementing appropriate controls.`

Back 27

Mitigation

Front 28

In dealing with risks and identifying controls, what three options may be considered?

Back 28

Do nothing.
Risk prevention
Risk recognition

Front 29

Security of informal systems is no more than ensuring that the __________ of the belief systems stays intact.

Back 29

integrity

Front 30

In terms of managing information system security, it is important that we focus our attention on maintaining the _____________, ______________and ______________of the people.

Back 30

behavior
values
integrity

Front 31

A sign is a result of a mental connection between a(n) _________-_____________ and the content.

Back 31

sign-vehicle

Front 32

Relationship between a sign and a concept is ________________.

Back 32

causal

Front 33

Relationship between a(n) _____________ and a(n) _______________ is grounded in reality.

Back 33

thought
referent

Front 34

The relation between a concept and a sign, besides other influences, is significantly impacted by ___________ and ___________________ factors.

Back 34

social
psychological

Front 35

Underlying the _____________ messages are attitudes that people might have.

Back 35

silent

Front 36

Changes in an organization are usually the starting point for __________________ in an existing security culture.

Back 36

disruptions

Front 37

The management of information system security connotes the management of integrity of _____________.

Back 37

operations

Front 38

There is a(n) ___________ - ____________ relationship between an antagonistic behavior, breakdown in communication, and a possible security breach.

Back 38

cause-effect

Front 39

ISO 17799

Back 39

One of the main IS security standards and it presents a comprehensive set of controls and best practices that all organizations should adopt.

Front 40

Pragmatics

Back 40

the term used to describe the context of activity, the characteristics of the people and the prevalent acts of communication

Front 41

Security of informal systems is no more than ensuring that the _________________ of the belief systems stays intact.

Back 41

integrity

Front 42

In terms of managing information system security, it is important that we focus our attention on maintaining the _______________, _______________, and ________________ of the people.

Back 42

behavior
values
integrity

Front 43

A sign is a result of a mental connection between a(n) ________________ and the content.

Back 43

sign-vehicle

Front 44

Relationship between a(n) _____________ and a(n) ______________ is grounded in reality.

Back 44

thought
referrant

Front 45

The relation between a concept and a sign, besides other influences, is significantly impacted by _____________ and ______________ factors.

Back 45

social
psychological

Front 46

Underlying the ______________ messages are attitudes that people might have.

Back 46

silent

Front 47

Changes in an organization are usually the starting point for ________________ in an existing security culture.

Back 47

disruptions

Front 48

The management of information system security connotes the management of integrity of ____________________.

Back 48

communications

Front 49

There is a(n) ______________ _______________ relationship between an antagonistic behavior, breakdown in communications and a possible security breach.

Back 49

cause-effect

Front 50

Noncompliance with security policy results in inadequate training programs, which in turn questions the _______________ of the operations and the _______________ of the people.

Back 50

integrity
competence

Front 51

Lack of competence in managing security is a serious threat, resulting in security being considered as a(n) __________________.

Back 51

afterthought

Front 52

Corporate Governance

Back 52

refers to the system by which corporations are directed and controlled. The governance structure specifies the distribution of rights and responsibilities among different participants in the corporation and specifies the rules and procedures for making decisions in corporate affairs.

Front 53

Security breach

Back 53

unauthorized access to data and applications. An act from outside an organization that bypasses or contravenes security policies, practices, or procedures.

Front 54

Security Culture

Back 54

the totality of patterns of behavior in an organization that contribute to ensure protection of information resources of all kings in a firm. (guards the integrity of the org)

Front 55

COBRA (COst estimation, Benchmarking, and Risk Assessment)

Back 55

utilizes both expert knowledge (experienced estimators) and quantitative project data in a limited amount)

Front 56

HIPPA - (Health Insurance Portability and Accountability Act)

Back 56

Primary purpose was to improve Medicare and the Socal Security Act as well as the efficiency and effectiveness of the healthcare system through the development of a health information system with established standards and requirements for the elec transmission of health information. mandates a set of rules to assure the confidentiality of any patient related information. What many people failed to realize when this act was instituted, was that it included oral or spoken information as well.

Front 57

Information Security

Back 57

The practice of defending information from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction.

Front 58

SOX - Sarbanes-Oxley Act)

Back 58

The Act provides rules, regulations and standards that businesses must comply with and that result in disclosure, documentation, and storage of corporate documentation. Aimed at strengthening corporate governance of enterprise financial practices