Secret

Front 1

Data

Back 1

Valuable asset

Front 2

Without data

Back 2

organization losses its record of transactions and its ability to deliver value to its customers

Front 3

threat

Back 3

is an object, person, or other entity that is a constant danger to an asset

Front 4

Employees

Back 4

closest to organization's data; greatest threats to information security

Front 5

spike

Back 5

momentary increase

Front 6

surge

Back 6

prolonged increase

Front 7

sag

Back 7

momentary low voltage

Front 8

brownout

Back 8

prolonged drop

Front 9

fault

Back 9

momentary loss of power

Front 10

blackout

Back 10

prolonged loss

Front 11

Espionage/Trespass

Back 11

Broad category of activities that breach confidentiality

Front 12

Shoulder Surfing

Back 12

espionage; watching other people's phone screen

Front 13

Traditional Hacker Profile

Back 13

aged 13 to 18, limited parental supervision, free time with computer

Front 14

Modern Hacker Profile

Back 14

Aged 12 to 60, technological skill levels, may be internal or external to the organization

Front 15

Expert Hacker

Back 15

develops software scripts and codes exploits, master of many skills, create attack software

Front 16

Script Kiddies

Back 16

hackers of limited skill, use expert written software to exploit a system, do not fully understand the system they hack

Front 17

Cracker

Back 17

cracks or removes protectopn designed to prevent unauthorized duplication

Front 18

Phreaker

Back 18

hacks the public telephone network

Front 19

Information Extortion

Back 19

attacker or formerly trusted insider stealing information from a computer system and demanding compensation for its return or non use

Front 20

Sabotage or Vandalism

Back 20

Individual or group who want to deliberately sabotage the operarions

Front 21

True

Back 21

Electronic theft is a more complex problem to manage and control, organizations may not even know it has occurred. T/F

Front 22

Malware

Back 22

designed to damage, destroy or deny service to the target systems

Front 23

Virus

Back 23

attaches itself to an executable file or application, it cannot stand on its own

Front 24

Worm

Back 24

replicates and propagates itself without having to attach itself to a host

Front 25

Code Red and Nimda

Back 25

Most infamous worms

Front 26

Trojan horses

Back 26

disguises themselves as useful computer programs or applications and can install a backdoor or rootkit on a computer

Front 27

Backdoors/Rootkits

Back 27

give attackers a means of regaining access to the attacked computer

Front 28

TCP 80 or UDP 53

Back 28

trojan programs that use common ports

Front 29

TRUE

Back 29

Many trojan pograms use standard ports to conduct their exploits

Front 30

Spyware

Back 30

sends info from the infected computer to the person who initiated the spyware program

Front 31

Adware

Back 31

determine a users purchasing habits so that web browsers can display ads tailored to that users

Front 32

Intellectual Property

Back 32

ownership of ideas and control over the tangible or virtual representation of those ideas

Front 33

attack

Back 33

deliberate act that exploits vulnerability

Front 34

exploit

Back 34

technique to compromise a system

Front 35

vulnerability

Back 35

identified weakness of a controlled system

Front 36

Malicious Code

Back 36

includes execution of viruses, worms, trojan horses

Front 37

IP scan and attack

Back 37

compromised system scans random or local range of IP addresses

Front 38

Web Browsing

Back 38

it makes all web content files infectious

Front 39

Virus

Back 39

can write with virus code that can cause infection

Front 40

Unprotected Shares

Back 40

using file shares to copy viral component to all reachable locations

Front 41

Mass Mail

Back 41

sending email infections to addresses found in address book

Front 42

Simple Network Management Protocol

Back 42

used to compromise and infect

Front 43

Hoaxes

Back 43

a more devious approach to attacking computer systems is the transmission of a virus hoax, with a real virus attached

Front 44

Back doors

Back 44

using a known or previously known or unknown and newly discovered access mechanism to gain access to a system

Front 45

Password Crack

Back 45

attempting to reverse calculate a password

Front 46

Brute Force

Back 46

application of computing and network resources to try every possible combination of options of a password

Front 47

Dictionary

Back 47

narrows the field by selecting specific accts to attack and uses a list of commonly used password

Front 48

Denial-of-service DOS

Back 48

attacker sends a large number of connection or information requests to a target

Front 49

Distributed Denial of service DDoS

Back 49

coordinated stream of requests is launched against a target from manu locations at the same time

Front 50

Spoofing

Back 50

intruder sends messages to a computer with an IP address indicating the message is coming from a trusted host

Front 51

Man in the middle

Back 51

attacker sniffs packets from the network, modifies them and inserts them back into the network

Front 52

Spam

Back 52

unsolicited commercial email

Front 53

Mail bombing

Back 53

attacker routes large quantities of email to the target

Front 54

Sniffers

Back 54

can monitor data traveling over a network

Front 55

Social Engineering

Back 55

process of using social skills to convince people to reveal access credentials

Front 56

brick attack

Back 56

best configured firewall in the world

Front 57

Buffer Overflow

Back 57

application error occurs when more data is sent to a buffer than it can handle

Front 58

Ping of death attacks

Back 58

type of DoS attack

Front 59

Timing Attack

Back 59

Relatively new, exploring web browsers cache

Front 60

Acts of Human error or failure

Back 60

includes acts done without malicious intent

Front 61

Polymorphism

Back 61

a threat that changes its apparent shape overtime

Front 62

Boot Virus

Back 62

infects the key operating system

Front 63

macro virus

Back 63

embedded in the automatically executing macro code

Front 64

rootkit

Back 64

created after an attack and usually hides itself within the os tools

Front 65

shares

Back 65

using vulnerabilities in the system

Front 66

Larry Roberts

Back 66

Founder of internet

Front 67

Larry Roberts

Back 67

founder of the internet

Front 68

Robert Melcalfe

Back 68

indicate problems of arpanet

Front 69

Rand Report R-609

Back 69

start of the study of computer security

Front 70

Security

Back 70

quality of being secure

Front 71

Physical Security

Back 71

protect the physical items

Front 72

Personal Security

Back 72

protect individual or group of individual

Front 73

Operations Security

Back 73

protect the details of a particular operation

Front 74

Communications Security

Back 74

protect organization's communications

Front 75

Network Security

Back 75

protect networking components

Front 76

Information Security

Back 76

protection of information and its critical elements, including the systems and hardware that use, store and transmit that information

Front 77

C.I.A

Back 77

industry standard for computer security

Front 78

availability

Back 78

access information without interference or obstruction

Front 79

accuracy

Back 79

free from mistake or error

Front 80

authenticity

Back 80

being genuine or original

Front 81

confidentiality

Back 81

preventing disclosure or exposure

Front 82

integrity

Back 82

whole, complete and uncorrupted

Front 83

utility

Back 83

having value

Front 84

possession

Back 84

having ownership or control

Front 85

information system

Back 85

entire set of software, hardware, data, people and procedure

Front 86

subject of an attack

Back 86

conduct the attack

Front 87

object of an attack

Back 87

being attacked

Front 88

TRUE

Back 88

Balancing security and access - security must be balance between protection and availability

Front 89

Bottom Up Approach

Back 89

grass-roots effort

Front 90

Top down approach

Back 90

initiated by upper management

Front 91

methodology

Back 91

formal approach to solving a problem

Front 92

event driven

Back 92

response to some occurence

Front 93

plan driven

Back 93

result of carefully developed implementation strategy

Front 94

SecSDLC

Back 94

coherent program

Front 95

data owner

Back 95

responsibile for the security and use of a particular set of information

Front 96

data custodian

Back 96

storage, maintenance, and protection of information

Front 97

data users

Back 97

end system users

Front 98

security as art

Back 98

interaction between users, policy, and technology controls

Front 99

security as science

Back 99

dealing with technology designed to perform at high levels of performance

Front 100

security as social science

Back 100

behavior of individuals interacting with systems

Front 101

risk identification

Back 101

process of examining and documenting

involves identifying, classifying

Front 102

Risk Management

Back 102

identifying and justifying risk controls

Front 103

Risk assessment

Back 103

evaluates the relative risk

Front 104

likelihood

Back 104

probability that a specific vulnerability

Front 105

residual risk

Back 105

risk that remains

Front 106

Defebd

Back 106

prevent exploitation of the vulnerability

Front 107

transfer

Back 107

shift the risk to other assets

Front 108

Mitigation

Back 108

reduce the impact

Front 109

Accept

Back 109

doing nothing

Front 110

terminate

Back 110

avoid

Front 111

qualitative risk

Back 111

non numerical measures

Front 112

Policies

Back 112

direct how issues should be addresses

Front 113

Policy

Back 113

written to support the mission, vision and strategic plan

Front 114

framework

Back 114

basic skeletal structure

Front 115

firewall

Back 115

selectively discriminates

Front 116

Proxy server

Back 116

behalf of another system

Front 117

crisis management

Back 117

actions taking during and after a disaster

Front 118

hot sites

Back 118

fully configured

physical plant operations