Mis- Chapter 12

Front 1

Adware

Back 1

programs installed on the user’s computer without the user’s knowledge or permission that reside in the background and, unknown to the user, observe the user’s actions and keystrokes, modify computer activity, and report the user’s activities to sponsoring organizations. Most adware is benign in that it does not perform malicious acts or steal data. It does, however, watch user activity and produce pop-up ads.

Front 2

Authentication

Back 2

the process whereby an information system approves (authenticates) a user by checking the user’s password.

Front 3

Cold site

Back 3

a remote processing center that provides office space, but no computer equipment, for use by a company that needs to continue operations after a natural disaster.

Front 4

Email spoofing

Back 4

a synonym for phishing. A technique for obtaining unauthorized data that uses pretexting via email. The phisher pretends to be a legitimate company and sends email requests for confidential data, such as account numbers, Social Security numbers, account passwords, and so forth. Phishers direct traffic to their sites under the guise of a legitimate business.

Front 5

Hacking

Back 5

occurs when a person gains unauthorized access to a computer system. Although some people hack for the sheer joy of doing it, other hackers invade systems for the malicious purpose of stealing or modifying data.

Front 6

Hardening

Back 6

the process of taking extraordinary measures to reduce a system’s vulnerability. Hardened sites use special versions of the opening system, and they lockdown or eliminate operating systems features and functions that are not required by the application. Hardening is a technical safeguard.

Front 7

Hot site

Back 7

a remote processing center, run by a commercial disaster-recovery service, that provides equipment a company would need to continue operations after a natural disaster.

Front 8

Identification

Back 8

the process whereby an information system identifies a user by requiring the user to sign on with a user name and password.

Front 9

Malware

Back 9

viruses, worms, Trojan horses, spyware, and adware.

Front 10

Malware definitions

Back 10

patterns that exist in malware code. Anti-malware vendors update these definitions continuously and incorporate them into their products in order to better fight against malware.

Front 11

Phishing

Back 11

a technique for obtaining unauthorized data that uses pretexting via email. The PHISHER pretend to be a legitimate company and sends an email requesting confidential data, such as account numbers, Social Security numbers, account passwords, and so forth.

Front 12

Pretexting

Back 12

a technique for gathering unauthorized information in which someone pretends to be someone else. A common scam involves a telephone caller who pretends to be from a credit card company and claims to be checking the validity of credit card numbers. Phishing is also a form of pretexting.

Front 13

Social Engineering

Back 13

example: calling a person, pretending to be from IT department and socially getting a person’s information

Front 14

Spyware

Back 14

programs installed on the user’s computer without the user’s knowledge or permission that reside in the background and, unknown to the user, observe the user’s actions and keystrokes, modify computer activity, and report the user’s activities to sponsoring organizations. Malicious spyware captures keystrokes to obtain user names, passwords, account numbers, and other sensitive information. Other spyware is used for marketing analyses, observing what users do, Web sites visited, products examine and purchased, and so forth.

Front 15

Usurpation

Back 15

occurs when unauthorized programs invade a computer system and replace legitimate programs. Such unauthorized programs typically shut down the legitimate system and substitute their own processing.

Front 16

What are the sources and types of security threats?

Back 16

Three sources of security threats are human error and mistakes, malicious human activity, and natural events and disasters.
• Unauthorized data disclousure
• Incorrect data modification
• Faulty service
• Denial of service
• Loss of infrastructure

Front 17

How can technical safeguards protect against security threats?

Back 17

• Identification and Authentication
• Encryption and Firewalls
• Malware Protection
• Design for secure applications

Front 18

How can data safeguards protect against security threats?

Back 18

Data administration refers to an organization-wide function that is in charge of developing data policies and enforcing data standards.
Database administration refers to a function that permits to a particular database.

Front 19

How can human safeguards protect against security threats?

Back 19

• Position definitions: give a person the least amount of power they need!! (one person writes checks, other approves expenses, read-only documents)
• Hiring and screening: employee knowledge!
• Dissemination and enforcements: teach employees, give them security training! Management take security seriously so employees do too!
• Termination: set rules, security policies that if broken, employees are fired!
• Hardening: taking extraordinary measures to make sure there is tight security on a system!
• Account management: manage accounts, make sure not too many, or unnecessary ones!
• Password Management: standards for suitable passwords!
• Help-Desk Policies: employees try to get passwords from help desk, help desk keep security by sending password to e-mail, or requesting personal info before giving out valuable information.
• Systems Procedures: have normal operation, backup, and recovery procedures in case of security breach or emergency, and to ensure security!
• Security Monit

Front 20

How should organizations respond to security incidents?

Back 20

• Have plan in place
• Centralized reporting
• Specific responses
o Speed
o Preparation plays
o Don’t make problem worse
• Practice

Front 21

How does the CIA triad relate to information security?

Back 21

Confidentiality – preventing disclosure of information to unauthorized individuals or systems,
Integrity – data cannot be modified without authorization,
Availability – the information must be available when it is needed.