CH 2

describe viruses and worms essay

A computer virus consists of segments of code that perform malicious actions. This code behaves very much like a virus pathogen attacking animals and plants, using the cell's own replication machinery to propagate and attack. The code attaches itself to the existing program and takes control of that program's access to the targeted computer. The virus-controlled target program then carries out the virus's plan by replicating itself into additional targeted systems. A worm is a malicious program that replicates itself constantly without requiring another program to provide a safe environment for replication. Worms can continue replicating themselves until they completely fill available resources, such as memory, hard drive space, and network bandwidth.

Describe the capabilities of a sniffer: essay

A sniffer is a program or device that can monitor data traveling over a network. Sniffers can be used both for legitimate network management functions and for stealing information from a network. Unauthorized sniffers can be extremely dangerous to a network's security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker's arsenal. Sniffers often work on TCP/IP networks, where they're sometimes called packet sniffers. Sniffers add risk to the network because many systems and users send information on local network in clear text. A sniffer program shows all the data going by, including passwords, the data inside the files, and screens full of sensitive data from applications.

A long-term interruption (outage) is electrical power availability is known as a(n)_________ A: blackout B: sag C: brownout D: fault

A: blackout

The process of maintaining the confidentiality, integrity, and availability of data managed by a DBMS is known as ________ security. A: database B: data C: information D: residual

A: database

In a __________ attack, the attacker sends a large number of connection or information requests to disrupt a target from a small number of sources. A: denial-of-service B: distributed denial-of-service C: virus D: spam

A: denial-of-service

A short-term interruption in electrical power availability is known as a______ A: fault B: brownout C: blackout D: lag

A: fault

One form of online vandalism is _________ operations, which interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency. A: hacktivist B: phreak C: hackcyber D: cyberhack

A: hacktivist

When information gatherers employ techniques that cross a legal or ethical threshold, they are conducting_________. A: industrial espionage B: competitive intelligence C: opposition research D: hostile investigation

A: industrial espionage

The average amount of time between hardware failures, calculated as the total amount of operation time for a specified number of units divided by the total number of failures, is known as __________ A: mean time between failure(MTBF) B: mean time to diagnose (MTTD) C: mean time to failure (MTTF) D: mean time to repair (MTTR)

A: mean time between failure

Hackers can be generalized into two skilled groups: expert and ______ A: novice B: journeyman C: packet monkey D: professional

A: novice

The redirection of legitimate user Web traffic to illegitimate Web sites with the intent to collect personal information is known as ___________ A: pharming B: phishing C: sniffing D: pharming

A: pharming

A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system's encrypted password file is known as a(n)___________ A: rainbow table B: dictionary C: crib D: crack file

A: rainbow table

"4-1-9" fraud is an example of a ________ attack. A: social engineering B: virus C: worm D: spam

A: social engineering (4-1-9 nigerian penal code)

Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n)_____ A: SSL B: SLA C: MSL D: MIN

B. SLA - service-level agreement

______ is any technology that aids in gathering information about a person or organization without their knowledge. A: a bot B: Spyware C: A Trojan D: A worm

B: Spyware

The________hijacking attack uses IP spoofing to enable an attacker to impersonate another entity on the network. A: WWW B: TCP C: FTP D: HTTP

B: TCP

__________ is the premeditated, politically motivated attacks against information, computer systems, computer programs, and data that result in violence against noncombatant targets by subnational groups or clandestine agents. A: infoterrorism B: cyberterrorism C: hacking D: cracking

B: cyberterrorism

A ______ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time. A: denial-of-service B: distributed denial-of-service C: virus D: spam

B: distributed denial-of-service

Human error or failure often can be prevented with training, ongoing awareness activities, and ___________ A: threats B: education C: hugs D: paperwork

B: education

Microsoft acknowledged that if you type a res://URL (a Microsoft-devised type of URL) longer than _________ characters in Internet Explorer 4.0, the browser will crash. A: 64 B: 128 C:256 D: 512

C: 256

________ are compromised systems that are directed remotely (usually by a transmitted command) by the attacker or participate in an attack. A: Drones B: Helpers C: Zombies D: Servants

C: Zombies

A short-term decrease in electrical power availability is known as a(n)___________ A: blackout B: sag C: brownout D: fault

C: brownout

As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus__________ A: false alarms B: polymorphisms C: hoaxes D: urban legends

C: hoaxes

The average amount of time until the next hardware failure is known as ______________ A: mean time between failure(MTBF) B: mean time to diagnose (MTTD) C: mean time to failure (MTTF) D: mean time to repair (MTTR)

C: mean time to failure (MTTF)

Acts of _______ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter. A: bypass B: theft C: trespass D: security

C: trespass

Which of the following functions does information security perform for an organization? A: Protecting the organization's ability to function. B: Enabling the safe operation of applications implemented on the organization's IT systems. C: Protecting the data the organization collects and uses. D: All of the above.

D: All of the above.

Which of the following is an example of a Trojan horse program? A: Netsky B: MyDoom C: Klez D: Happy99.exe

D: Happy99.exe

The _______ data file contains the hashed representation of the user's password. A: SLA B: SNMP C: FBI D: SAM

D: SAM - security account management

________ are malware programs that hide their true nature and reveal their designed behavior only when activated. A: Viruses B: Worms C: Spam D: Trojan horses

D: Trojan horses

In the ________ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the network. A: zombie-in-the-middle B: sniff-in-the-middle C: server-in-the-middle D: man-in-the-middle

D: man-in-the-middle

*Computer* assets are the focus of information security and are the information that has value to the organization, as well as the systems that store, process, and transmit the information. T/F

F

A worm requires that another program is running before it can begin functioning. T/F

F

An advance-fee fraud attack involves the interception of cryptographic elements to determine keys and encryption algorithms. T/F

F

Attacks conducted by scripts are usually unpredictable. T/F

F

Compared to Web site defacement, vandalism within a network is less malicious in intent and more public. T/F

F

DoS attacks cannot be launched against routers. T/F

F

Information security's primary mission is to ensure that systems and their contents retain their confidentiality at any cost. T/F

F

Media are items of fact collected by organization and include raw numbers, facts, and words. T/F

F

Packet *munchkins* use automated exploits to engage in distributed denial-of-service attacks. T/F

F

Suppose an act of theft performed by a hacker was accompanied by defacement actions to delay discovery. The first act is obviously in the category of "theft" but the second act is another category-in this case it is a "force of nature". T/F

F

The term *phreaker* is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. T/F

F

Two watchdog organizations that investigate allegations of software abuse are the Software & Information Industry Association (SIIA) and National Security Agency (NSA). T/F

F

When electronic information is stolen, the crime is readily apparent. T/F

F

When voltage levels *lag* (experience a momentary increase), the extra voltage can severely damage or destroy equipment. T/F

F

The application of computing and network resources to try every possible combination of options of a password is called a *dictionary* attack. T/F

F - brute force

One form of e-mail attack that is also DoS attack is called a mail *spoof*, in which an attacker overwhelms the receiver with excessive quantities of e-mail. T/F

F - email bomb

A device (or a software program on a computer) that can monitor data traveling on a network is known as a *socket* sniffer. T/F

F - just sniffer

"Shoulder *spying*" is used in public or semi-public settings when individuals gather information they are not authorized to have by looking over another individual's shoulder or viewing the information from a distance. T/F

F - shoulder surfing

The *macro* virus infects the key operating system files located in a computer's start-up sector. T/F

F - word document

Once a(n) *back door* has infected a computer, it can redistribute itself to all e-mail addresses found on the infected system. T/F

F - worm

___________________ is unsolicited commercial e-mail. *short answer*

Spam

_______________ is a technique used to gain unauthorized access to computers, wherein the intruder sends messages with a source IP address that has been forged to indicate that the messages are coming from a trusted host. *short answer*

Spoofing

*Hackers* are "persons who access systems and information without authorization and often illegally." T/F

T

*Intellectual* property is defined as "the creation, ownership, and control of ideas as well as the representation of those ideas." T/F

T

A mail bomb is a form of DoS attack.

T

A number of technical mechanisms-digital watermarks and embedded code, copyright codes, and even the intentional placement of bad sectors on software media-have been used to deter or prevent the theft of software intellectual property. T/F

T

A sniffer program can reveal data transmitted on a network segment, including passwords, the embedded and attached files-such as work-processing documents-and sensitive data transmitted to or from applications. T/F

T

A worm may be able to deposit copies of itself onto all Web servers that the infected system can reach, so that users who subsequently visit those sites become infected. T/F

T

A(n) *polymorphic* threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures. T/F

T

As an organization grows, it must often use more robust technology to replace the security technologies it may have outgrown. T/F

T

Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways. T/F

T

Expert hackers are extremely talented individuals who usually devote lots of time and energy to attempting to break into other people's information systems: T/F

T

Forces of nature, sometimes called acts of God, can present some of the most dangerous threats because they usually occur very little warning and are beyond the control of people. T/F

T

Media as a subset of information assets are the systems and networks that store, process and transmit information. T/F

T

Much human error or failure can be prevented with effective training and ongoing awareness activities. T/F

T

Organizations can use dictionaries to regulate password selection during the reset process and this guard against easy-to-guess passwords. T/F

T

Software code known as a(n) *cookie* can allow an attacker to track a victim's activity on Web sites. T/F

T

The *malicious* code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. T/F

T

The information security function in an organization safeguards its technology assets. T/F

T

With the removal of copyright protection mechanisms, software can be easily distributed and installed. T/F

T

List atleast 6 of the general categories of threats and identify at least one example:

Theft Forces of nature human errors or failure sabotage or vandalism espionage or trespass information extortion

The _____________________________ fraud is a social engineering attack that involves convincing the victim to participate in a seeming money-making venture while getting the victim to pay fees or bribes or to refund uncleared international payments. *short answer*

advance-fee

A(n)______________ is an act against an asset that could result in a loss. *short answer*

attack

A virus or worm can have a payload that installs a(n)__________________ door or trap door components in a system, which allows the attacker to access the system at will with special privileges. *short answer*

back

A(n) _______________ is an application error that occurs when more data is sent to a program that it is designed to handle. *short answer*

buffer overflow

Attempting to reverse-calculate a password is called_____________________ *short answer*

cracking

_______________ occurs when a application running on a Web server inserts commands into a user's browser session and causes information to be sent to a hostile server. *short answer*

cross-site scripting (XSS) cross-site scripting XSS cross site scripting (XSS) cross site scripting

ESD is the acronym for _______________ discharge *short answer*

electrostatic

The expert hacker sometimes is called a(n)__________________ hacker. *short answer*

elite

When information gatherers employ techniques in a commercial setting that cross the threshold of what is legal or ethical, they are conducting industrial______________ *short answer*

espionage

A momentary low voltage is called a(n)_____________________ *short answer*

fault

Some information gathering techniques are quite legal-for example, using a Web browser to perform market research. These legal techniques are called, collectively, competitive ____________________. *short answer*

intelligence

Script _______________ are hackers of limited skill who use expertly written software to attack a system. *short answer*

kiddies

A computer virus consists of segments of code that perform _____________________ actions.. *short answer*

malicious

A(n)_____________ hacks the public telephone network to make free calls or disrupt services. *short answer*

phreaker

Duplication of software-based intellectual property is more commonly known as software ___________________. *short answer*

piracy

In the context of information security, _______________ is the process of using social skills to convince people to reveal access credentials or other valuable information to the attackers. *short answer*

social engineering

A(n) __________ is a potential risk to an information asset. *short answer*

threat

_______________ is the percentage of time a particular service is available. *short answer*

up time

A(n) __________________ is a potential weakness in an asset or its defensive control(s). *short answer*

vulnerability

A(n) ___________________ is a malicious program that replicates itself constantly without requiring another program environment. *short answer*

worm