Information Security Final Exam

Front 1

The ability to use, manipulate, modify, or affect an object

Back 1

Access

Front 2

The resource that is being protected. Can be logical such as a website, or physical such as a computer

Back 2

Asset

Front 3

An act that takes advantage of a vulnerability to compromise a controlled system

Back 3

Attack

Front 4

Security mechanism, policy, or procedure that can counter a system attack, reduce risks, and resolve vulnerabilities

Back 4

Control (safeguard or countermeasure)

Front 5

A technique used to compromise a system

Back 5

Exploit

Front 6

A single instance of a system being open to damage

Back 6

Exposure

Front 7

A passive entity in an information system that receives or contains information

Back 7

Object

Front 8

The probability that something can happen

Back 8

Risk

Front 9

The basis for the design, selection, and implementation of all security program elements including policy implementation, ongoing policy management, risk management programs, education and training programs, technological controls, and maintenance of the security program

Back 9

Security Blueprint

Front 10

The implementation of an organizations security policies, procedures, and programs

Back 10

Security Posture (Security Profile)

Front 11

An active entity that interacts with an information system and causes information to move through the system for a specific purpose. examples include: individuals, technical components, and computer processes

Back 11

Subject

Front 12

An object, person, or other entity that represents a constant danger to an asset

Back 12

Threat

Front 13

A specific instancew or component that represents a danger to an organizations asset. threats can be accidental or purposeful, for example lightning strikes or hackers

Back 13

Threat Agent

Front 14

Weakness in a controlled system, where controls are not present or are no longer effective

Back 14

Vulnerability

Front 15

Security measures such as a badge reader that admits or prohibits people from entering sensitive areas

Back 15

Access Control

Front 16

The process of attracting attention to a system by placing tantalizing bits of information in key locations

Back 16

Enticement

Front 17

Security systems that use two or more authentication mechanisms

Back 17

Strong authentication

Front 18

A data-gathering process that discovers the assets that can be accessed from a network. Usually performed in advance of a planned attack. This is a systematic examination of the entire set of internet addresses of the organization

Back 18

Fingerprinting

Front 19

Decoy systems designed to lure potential attackers away from critical systems

Back 19

Honey Pot

Front 20

A type of attack on information assets in which the instigator attempts to gain entry into a system or disrupt the normal operations of a system with, almost always, the intent to do malicious harm

Back 20

Intrusion

Front 21

Devices that detect unauthorized activity within the inner network or on individual machines

Back 21

Intrusion detection systems (IDS)

Front 22

A network tool that collects copies of packets from the network and analyzes them

Back 22

Packet sniffer

Front 23

A honeypot that has been protected so that it cannot easily be compromised

Back 23

Padded Cell

Front 24

A private word or combination of characters that only the user knows

Back 24

Password

Front 25

The tool used to identify (or fingerprint) computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information

Back 25

Port Scanner

Front 26

The act of luring an individual into committing a crime to get a conviction

Back 26

Entrapment

Front 27

The process of making and using codes to secure the transmission of information

Back 27

Cryptography

Front 28

Decrypting without knowing the keys

Back 28

Cryptoanalysis

Front 29

The information used in conjunction with an algorithm to create the ciphertext from the plaintext or derive the plaintext from the ciphertext. This can be a series of bits used by a computer program, or it can be a passphrase used by humans

Back 29

Key

Front 30

Mathematical algorithms that generate a message summary or message digest that allows a hash algorithm to confirm that the content of a specific message has not been altered

Back 30

Hash Function

Front 31

A method of communicating on a network using a single key to both encrypt and decrypt a message

Back 31

Symmetric encryption

Front 32

A method of communicating on a network using one key to encrypt and another to decrypt a message

Back 32

Asymmetric encryption

Front 33

An integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely

Back 33

Public Key Infrastructure(PKI)

Front 34

Encrypted messages that can be mathematically proven authentic

Back 34

Digital Signatures

Front 35

Public-key container files that allow computer programs to validate the key and identify to whom it belongs

Back 35

Digital certificates

Front 36

A method of hiding the existence of a secret message

Back 36

Steganography

Front 37

Access-control devices that use a biometric detection device as a release mechanism

Back 37

Biometric lock

Front 38

Synonymous with application firewall and application-level firewall. A device that selectively discriminates against information flowing into or out of the organization. In the context of physical security, a firewall is a wall that limits the spread of damage should a fire break out in an office

Back 38

Firewall

Front 39

Offsite computing that uses internet connections, dial-up connections, connections over leased point-to-point links between offices, and other connection mechanisms

Back 39

Telecommuting

Front 40

An aspect of information security that addresses the design, implementation, and maintenance of countermeasures that protect the physical resources of an organization

Back 40

Physical security

Front 41

The spark that occurs when two materials are rubbed or touched and electrons are exchanged, resulting in one object becoming more positively charged and the other more negatively charged

Back 41

Static Electricity

Front 42

A small physical enclosure that is used in secure facilities that has an entry point and a different exit point

Back 42

Mantrap

Front 43

The protection of information and the systems and hardware that use, store, and transmit that information

Back 43

Information Security

Front 44

What are the phases of the Security Systems Development Life Cycle

Back 44

Investigation
Analysis
Logical Design
Physical Design
Implementation
Maintenance
Change

Front 45

What are some issues facing software developers?

Back 45

Command Injection
Cross-Site Scripting
Failure to Handle Errors
Failure to Protect Network Traffic
Failure to Store and Protect Data Securely
Failure to use cryptographically strong numbers
format string problems
sql injection

Front 46

What is the difference between Laws and Ethics

Back 46

Laws are rules that mandate or prohibit certain behavior. Ethics are socially acceptable behaviors

Front 47

Computer Fraud and Abuse Act of 1986
National Information Infrastructure Protection Act of 1996
USA PATRIOT Act of 2001
Computer Security Act of 1987

Back 47

Computer Security LAws

Front 48

The process of identifying vulnerabilities in an organization's information systems and taking carefully reasoned steps to ensure the confidentiality, integrity, and availability of all components in the organization's information system

Back 48

Risk Management

Front 49

The formal process of examining and documenting the security posture of an organizations information technology and the risks it faces

Back 49

Risk Identification

Front 50

The process of applying controls to reduce the risks to an organization's data and information systems

Back 50

Risk Control