Mis Exam 2

Front 1

use sophisticated statistical techniques, regression analysis, and decision tree analysis
used to discover hidden patterns and relationships
market-basket analysis

Back 1

data-mining systems

Front 2

create value by collecting and sharing human knowledge about products, products uses, best practices, other critical knowledge
used by employees, managers, customers, suppliers, others who need access to company knowledge

Back 2

knowledge management systems

Front 3

encapsulates knowledge in form of "if/then" rules
can have thousands of rules
can improve diagnostic and decision quality of nonexperts

Back 3

expert systems

Front 4

popular bi tools

Back 4

reporting tools
data-mining tools
knowledge management tools

Front 5

raw data usually unsuitable for sophisticated reporting or data mining
dirty data
values may be missing
inconsistent data
non-integrated data
wrong granularity

Back 5

what problems do operational data pose for bi systems

Front 6

mistakes in spelling or punctuation, incorrect data associated with a field, incomplete or outdated data or even data that is duplicated in the database

Back 6

dirty data

Front 7

curse of dimensionalty
1. problem caused by the exponential increase in volume associated with adding extra dimensions to a (mathematical) space
2. too many rows or data points

Back 7

too much data causes...

Front 8

unintentional human errors and mistakes
malicious human activity
natural events and disasters

Back 8

security threats

Front 9

accidental problems-- deletions, copyovers, operating errors
poorly written programs
poorly designed procedures
physical accidents-- driving forklift through computer room wall

Back 9

unintentional human errors and mistakes

Front 10

intentional destruction of programs, hardware, and data by employees
insider attacks from disgruntled employees
hackers
virus and worm writers
criminals
terrorists

Back 10

malicious human activity

Front 11

fires, floods, hurricanes, earthquakes, tsunamis, avalanches, tornados
initial losses of capability (loss of sales and services, purchase and payment data, software and hardware)

Back 11

natural events and disasters

Front 12

cost of replacing and recovering data, reconstructing facilities, lost customers, law suits/legal costs

Back 12

secondary losses

Front 13

unauthorized data disclosure

Back 13

human error
malicious release

Front 14

posting private information in public place
placing restricted information of searchable web sites
inadvertest disclosure during recovery

Back 14

human error

Front 15

malicious release

Back 15

pretexting
phishing
spoofing
sniffing/drive by sniffing
network tap

Front 16

pretending to be someone else via phone call

Back 16

pretexting

Front 17

pretexting using email

Back 17

phishing

Front 18

disguising as a different IP address or different email sender

Back 18

spoofing

Front 19

searching for unprotected or WEP wireless networks

Back 19

sniffing/drive by sniffing

Front 20

breaking into networks
slicing into cables
using a client network

Back 20

network tap

Front 21

human errors (incorrect entries and information, procedural problems)
incorrect data modifications (systems errors)
hacking
faulty recovery actions

Back 21

incorrect data modifications

Front 22

incorrect systems operations
incorrect data modification
incorrectly sending wrong goods to customer or goods to wrong customer
incorrect billing
programming errors
errors in hardware, software, program, data installation
usurpation

Back 22

faulty service

Front 23

unauthorized program or update replaces legitimate/approved program

Back 23

usurpation

Front 24

denial of service

Back 24

human error
malicious denial of service attacks

Front 25

inadvertently shut down web server, gateway router with computationally intensive application
ie: OLAP application that uses operational DBMS blacks order-entry transaction

Back 25

human error

Front 26

flood web server with millions of requests for web pages
computer worms
natural disasters

Back 26

malicious denial of service attacks

Front 27

accidental (bulldozer cutting fiber optic cable, floor buffer bangs web server, water line breaks damage hardware)
theft (disgruntled employee steals hardware)
terrorist (bombs computer center)
natural disasters (floods, tornadoes, hurricanes, fire, earthquakes)

Back 27

loss of infrastructure

Front 28

senior management involvement
safeguards
incident response

Back 28

elements of a security program

Front 29

must establish security policy
manage risk (balancing costs and benefits of security program)

Back 29

senior management involvement

Front 30

protections against security threats

Back 30

safeguards

Front 31

must plan for prior to security incidents

Back 31

incident response

Front 32

identification and authentication
encryption
firewalls
malware protection
design for secure applications

Back 32

primary technical safeguards

Front 33

1. what you know (password, pin)
2. what you have (smart card, ID card)
3. what you are (biometric)

Back 33

authentication methods

Front 34

identification

Back 34

user name

Front 35

authentication

Back 35

password

Front 36

microchip embedded with identifying data
authentication by personal identification number

Back 36

smart card

Front 37

fingerprints, facial scans, retina scans

Back 37

biometric authentication

Front 38

authenticate to network and other servers

Back 38

single sign on for multiple systems

Front 39

1. your computer obtains public key of web site
2. your computer generates key for symmetric encryption
3. your computer encrypts symmetric key using web site's public key
4. web site decodes your message using its private key. obtains key for symmetric encryption
5. all communications between and web site use symmetric encryption

Back 39

encryption

Front 40

computer device that prevents unauthorized network access
may be special purpose computer or program on a general purpose computer

Back 40

firewalls

Front 41

perimeter firewalls sit outside organizational network
internal firewalls are inside network
packet filtering firewalls examine each part of a message before allowing message to pass
may filter both incoming and outgoing messages

Back 41

organizations may have multiple firewalls

Front 42

encodes rules stating which IP addresses are allowed into or prohibited from the network

Back 42

access control list

Front 43

types of malware

Back 43

spyware programs
adware

Front 44

install without users knowledge
reside in background, monitor user actions, keystrokes, computer activity
used for marketing analysis

Back 44

spyware programs

Front 45

similar to spyware without malicious intent
watches users activity, produces pop up ads, changes window, modifies search results
can slow computer performance
remove with anti programs

Back 45

adware

Front 46

install antivirus and anti spyware programs
set anti malware programs to scan frequently (scan hard drive and emaill)
update malware definitions regularly
open email attachments only from known sources (90% of all viruses spread by email attachments)
install updates promptly and only from legitimate sources
browse only reputable internet neighborhoos

Back 46

malware safeguards

Front 47

be sure that your company designs and builds systems with security as a requirement

Back 47

design for secure applications

Front 48

how can data safeguards protect against security threats?

Back 48

data administration
database administration

Front 49

organization wide function
develops data policies
enforces data standards

Back 49

data administration

Front 50

ensures procedures exist for orderly multi-user processing
controls changes to database structure
protects the database

Back 50

database administration

Front 51

define data policies
data rights and responsibilities
rights enforced by user accounts authenticated by passwords
protect sensitive data with encryption (key escrow-- copy of encryption key held by trust party)
backup and recovery procedures
physical security

Back 51

data safeguards

Front 52

human safeguards for employees
hiring and screening employees
dissemination and enforcement
termination

Back 52

safeguards for employees

Front 53

position definitions
define job tasks and responsibility
separate duties and authorities
grant least possible priveleges
document security sensitivity

Back 53

human safeguards for employees

Front 54

extensive interviews and background checks for high sensitivity positions for new hires and employees being promoted

Back 54

hiring and screening employees

Front 55

make employees aware of security policies and procedures
general training for new employees
position specific training for promoted emplyees
enforcement factors (responsibility, accountability, compliance)
management attitude expressed in word and deed

Back 55

dissemination and enforecement

Front 56

establish security policy and procedures
standard human resources policies for "friendly" terminations (remove accounts, passwords on last work day, recover all keys for encrypted data, recover all door keys and pass cards, ID badges)
unfriendly terminations (remove accounts, passwords prior to notifying employee of termination, security officer cleans out person's desk or watches, accompany person off premises)

Back 56

termination

Front 57

temporary personnel and vendors
public users
protect partners and public that receive benefits from system from internal company security problems

Back 57

human safeguards for nonemployee personnel

Front 58

screen personnel
training and compliance
contract should include specific security provisions
provide accounts and passwords with the least privileges

Back 58

temporary personnel and vendors

Front 59

hardening web site and facility
take extraordinary measures to reduce system's vulnerability

Back 59

public users

Front 60

account management procedures
password management
help desk policies

Back 60

account administration

Front 61

creation of new accounts, modification of existing accounts, removal of terminated accounts
users need to provide early, timely notification of account change needs
users and business manager need to inform IT to remove accounts

Back 61

account management procedures

Front 62

user-signed acknowledgment forms
change passwords frequently

Back 62

password management

Front 63

authentication of users who have lost password
password should not be emailed

Back 63

help desk policies

Front 64

information systems procedure types

Back 64

normal operations
backup
recovery

Front 65

each procedure type should be standardized
procedures exist for users and operations personnel (procedures vary by duties and responsibilities)
systems analysts develop procedures for system recovery

Back 65

information systems safety procedures

Front 66

activity log analyses
security testing
investigation of incidents
learn from incidents
review and update security and safeguard policies

Back 66

security monitoring

Front 67

firewall logs
dbms log in records
web server logs

Back 67

activity log analyses

Front 68

in house and external security professionals

Back 68

security testing

Front 69

how did the problem occur?

Back 69

investigation of incidents

Front 70

indication of potential vulnerability and needed corrective actions

Back 70

learn from incidences

Front 71

best safeguard is choose appropriate location for infrastructure
backup processing centers in geographically removed sites
create backups for critical resources

Back 71

necessary for disaster preparedness

Front 72

substantial loss of infrastructure caused by acts of nature, crime, or terrorism

Back 72

disaster

Front 73

avoid placing where prone to floods, earthquakes, tornadoes, hurricanes, avalanches, car accidents
do not place in unobtrusive buildings, basements, backrooms, physical perimeter
fire-resistant buildings

Back 73

best safeguard is choose appropriate location for infrastructure

Front 74

contract with hot site or cold site provider
a hot site provides all equipment needed to continue operations there
a cold site provides space but you have set up and install equipment

Back 74

create backups

Front 75

how should organizations respond to security incidents

Back 75

have a plan in place
centralize reporting
specific responses (speed, preparation pays, don't make problems worse)
PRACTICE!

Front 76

SELECT

Back 76

Here you list all the columns as well as all calculated values that you want to see in the query result. They need to be separated by commas. You may also use aggregate functions (e.g., SUM, COUNT), but if you have columns in addition to an aggregate function(s), all those columns should be listed in the GROUP BY.

Front 77

FROM

Back 77

Here you list all the tables that you need to use (separated by commas). Do not list any table that you don’t need, because that would slow down the performance. Make sure that you join all the tables in the WHERE clause appropriately.

Front 78

WHERE

Back 78

Here you list all conditions separated by either AND or OR. AND takes precedence over OR, but you can change that using parantheses. Table joins are conditions, so they need to be listed here. Typically, if you are joining x number of tables, you need x-1 joins. Conditions involving dates and other columns also go in here.

Front 79

GROUP BY

Back 79

Only needed if you have columns in addition to an aggregate function(s) in the SELECT, because in that case you need to group rows according to those columns to be able to do the aggregation. The list of columns in the SELECT should match those in GROUP BY.

Front 80

having

Back 80

Only needed if GROUP BY is used and you have a condition that involves an aggregate function (e.g., AVG(price) > 20). It is used to eliminate some of the groups as defined in the GROUP BY.

Front 81

order by

Back 81

Use this if you need to sort columns by a column or a set of columns. Default is ascending; use DESC for descending. If you need to sort by multiple columns, separate those columns with a comma and list them in the right order (e.g., “ORDER BY State, City” would sort the columns first by state and then by city, both in ascending order).