Securing Information Systems (Ch #7)

Front 1

security

Back 1

policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems

Front 2

controls

Back 2

methods, policies, and procedures that ensure asset safety, accuracy and reliability of records, and operational adherence to management standards

Front 3

war driving

Back 3

driving by or parking outside buildings to intercept wireless network traffic

Front 4

malware

Back 4

malicious software programs (i.e., viruses, worms, Trojan horses)

Front 5

computer virus

Back 5

rogue software programs that attach to other software programs; rely on executable action to spread to other computers

Front 6

worms

Back 6

independent computer programs that copy themselves from one computer to another over a network; do not need human action to spread; spreads more rapidly than viruses

Front 7

Trojan horse

Back 7

software program that appears to be benign but does something unexpected

Front 8

SQL injection attacks

Back 8

introduce malicious program code via poorly coded Web application software

Front 9

spyware

Back 9

small program that install themselves on computer to monitor user Web surfing activity and serve up advertising

Front 10

Keylogggers

Back 10

records every keystroke made on a computer to steal information, launch attacks, gain access to protected computer systems

Front 11

hacker

Back 11

individual who intends to gain unauthorized access to a computer system

Front 12

cracker

Back 12

a hacker with criminal intent

Front 13

cybervandalism

Back 13

intentional disruption, defacement or destruction of a Web site or information system

Front 14

spoofing

Back 14

hackers masquerading as someone else usually with a fake e-mail address

Front 15

sniffer

Back 15

a type of eavesdropping program that monitors information traveling over a network

Front 16

denial-of-service (DoS) attack

Back 16

overloading a network Web server with false communications/ requests to crash it

Front 17

distributed denial-of-service (DDoS) attack

Back 17

using numerous computers to overwhelm a network from various launch points

Front 18

botnet

Back 18

thousands of “zombie” PCs infected with malicious software

Front 19

identity theft

Back 19

a crime in which an imposter obtains key personal information to impersonate someone

Front 20

phishing

Back 20

using a fake Web site or sending legitimate-looking email to obtain confidential data

Front 21

Evil twins

Back 21

wireless networks that pretend to offer trustworthy Wi-Fi connections

Front 22

Pharming

Back 22

redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser

Front 23

click fraud

Back 23

an individual or computer program fraudulently clicks on an ad without intention to buy

Front 24

cyberwarfare

Back 24

a state-sponsored computer/network hacking activity designed to cripple/defeat another state or nation

Front 25

social engineering

Back 25

tricking employees into revealing passwords by pretending to be legitimate company members

Front 26

bugs

Back 26

program code defects

Front 27

patches

Back 27

small pieces of software that repair flaws without disturbing proper operation

Front 28

Health Insurance Portability and Accountability Act (HIPAA)

Back 28

outlines medical security and privacy rules and procedures

Front 29

Gramm-Leach-Bliley Act

Back 29

requires financial institutions to ensure the security and confidentiality of customer data

Front 30

Sarbanes-Oxley Act

Back 30

imposes responsibility on companies and management to safeguard the accuracy of financial information

Front 31

computer forensics

Back 31

scientific collection, examination, authentication, preservation, and analysis of data so that it may be used as evidence in a court of law

Front 32

general controls

Back 32

govern the design, security, and use of computer programs and the security of data files

Front 33

application controls

Back 33

procedures that ensure that only authorized data are completely and accurately process by that application; can be classified as input controls, processing controls, and output controls

Front 34

risk assessment

Back 34

determines the level of risk if an activity or process is not properly controlled

Front 35

security policy

Back 35

consists of statements ranking information risks, identifying acceptable security goals, and identifying the mechanisms for achieving goals

Front 36

acceptable use policy (AUP)

Back 36

defines acceptable uses of a firm’s information resources

Front 37

identity management

Back 37

business process and software tools for identifying valid system users and controlling their access to system resources

Front 38

disaster recovery planning

Back 38

devises plans for restoring services after a disruption

Front 39

business continuity planning

Back 39

identifies critical business process and determines action plan for handing mission-critical functions if system go down

Front 40

MIS audit

Back 40

an examination of a firm’s overall security environment and governing controls

Front 41

authentication

Back 41

ability to know that a person is who he or she claims to be

Front 42

token

Back 42

a physical device designed to prove a use’s identify

Front 43

smart card

Back 43

credit card-sized device containing a chip with access permission and other data

Front 44

biometric authentication

Back 44

measures unique physical or behavioral traits to identify user and grant access

Front 45

firewall

Back 45

a combination of hardware/software that controls the flow of incoming/outgoing network traffic

Front 46

intrusion detection system

Back 46

monitors vulnerable points or “hot spots” full-time to detect and deter intruders

Front 47

antivirus software

Back 47

prevents, detects, and removes malware, spyware, and adware

Front 48

unified threat management

Back 48

comprehensive security management products that combine firewalls, VPN, intrusion detection systems, Web content filtering, and antispam software

Front 49

encryption

Back 49

the process of transforming plain text into cipher text

Front 50

Secure Sockets Layer (SSL)

Back 50

an encryption method that enables client and server computers to manage encryption and decryption activities between computers; Transport Layer Security (TLS) is the SSL successor

Front 51

Secure Hypertext Transfer Protocol (S-HTTP)

Back 51

encryption protocol for data flowing over Internet

Front 52

public key encryption

Back 52

secure form of encryption that uses one shared 128 bit key and one private 128 bit key

Front 53

digital certificates

Back 53

data files used to establish user identity and electronic assets for protection of online transactions; uses 3rd party (certificate authority) to validate user identity

Front 54

public key infrastructure (PKI)

Back 54

the use of public key cryptography working with a certification authority

Front 55

fault-tolerant computer systems

Back 55

contain redundant hardware, software, and power supply components to provide continuous, uninterrupted service

Front 56

high-availability computing

Back 56

enables quick recovery from a system crash, but does not completely eliminate downtime

Front 57

downtime

Back 57

periods of time in which system is not operational

Front 58

recovery-oriented computing

Back 58

the development and use of methods to make computer systems resume their activities more quickly after mishaps

Front 59

deep packet inspection (DPI)

Back 59

examines data files and sorts out low-priority online material and assigns higher priority to business-critical files

Front 60

managed security service providers (MSSP)

Back 60

outsourced service providers that monitor network activity and perform vulnerability testing and intrusion detection

Front 61

Service Set identifiers (SSIDs)

Back 61

identifies the access points in a Wi-Fi network