IST 305 Ch. 8

uses third-party CAs to validate a user's identity.

A digital certificate system

prevent unauthorized communication both into and out of the network.

A firewall allows the organization to

spyware

A keylogger is a type of

war driving

A practice in which eavesdroppers drive by buildings or park outside and try to intercept wireless network traffic is referred to as ________.

click fraud

A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of

Spyware

A type of Malware that locates and saves data from users without them knowing about it.

MIS audit

A(n) ________ __examines the firm's overall security environment as well as the controls governing individual information systems.

identity management

A(n) ________ system is used to identify and authorize different categories of system users and specify which portions of the organization's systems each user can access.

gadget that displays passcodes.

An authentication token is a(n)

setting up a fake medical Web site that asks users for confidential information.

An example of phishing is

worm

An independent computer program that copies itself from one computer to another over a network is called a

risk assessment

Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n)

can be classified as input controls, processing controls, and output controls.

Application controls

Unified Threat Management

Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems.

SSL, TLS, and S-HTTP.

Currently, the protocols used for secure information transfer over the Internet are

computer system is not operational

Downtime refers to periods of time in which a

have the potential to be accessed by large numbers of people and by groups outside of the organization.

Electronic data are more susceptible to destruction, fraud, error, and misuse because information systems concentrate data in computer files that

ambient

Electronic evidence on computer storage media that is not visible to the average user is called ________ data.

bogus wireless network access points that look legitimate to users.

Evil twins are

fault-tolerant computer systems.

For 100% availability, online transaction processing requires

by causing other people's computers to become "zombie" PCs following a master computer.

Hackers create a botnet by

issue patches

How do software vendors correct flaws in their software after it has been distributed?

Trojan Horse

In 2004, ICQ users were enticed by a sales message from a supposed anti-virus vendor. On the vendor's site, a small program called Mitglieder was downloaded to the user's machine. The program enabled outsiders to infiltrate the user's machine. What type of malware is this an example of?

deep packet inspection

In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data.

Symmetric Key Encryption

In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key?

Stateful Inspection

In which technique are network communications are analyzed to see whether packets are part of an ongoing dialogue between a sender and a receiver?

an SQL injection attack

Inputting data into a poorly programmed Web form in order to disrupt a company's systems and networks is called

malware

Malicious software programs referred to as ________ include a variety of threats such as computer viruses, worms, and Trojan horses.

only those viruses already known when the software is written.

Most antivirus software is effective against

general

On the whole, ________ controls apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment.

Certificate Authority

PKI is the use of public key cryptography working with a(n) ________.

redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser.

Pharming involves

spoofing

Phishing is a form of

spoofing

Redirecting a Web link to a different address is a form of

may hinder employee productivity.

Rigorous password systems

MSSPs

Smaller firms may outsource some or many security functions to

communication lines

Sniffing is a security challenge that is most likely to occur in which of the following points of a corporate network?

False

T/F: An acceptable use policy defines the acceptable level of access to information assets for different users.

True

T/F: Biometric authentication is the use of physical characteristics such as retinal images to provide identification.

True

T/F: Both software metrics and software testing are techniques used to improve software quality.

True

T/F: Computer worms spread much more rapidly than computer viruses.

True

T/F: Computers using cable modems to connect to the Internet are more open to penetration than those connecting via dial-up.

True

T/F: DoS attacks are one of the most economically damaging kinds of computer crime.

False

T/F: DoS attacks are used to destroy information and access restricted areas of a company's information system.

True

T/F: In addition to e-mail, instant messages and P2P file-sharing can also pose security threats to computer systems and networks.

True

T/F: NAT conceals the IP addresses of the organization's internal host computers to deter sniffer programs.

True

T/F: One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender.

False

T/F: Packet filtering catches most types of network attacks.

True (one shared and one private)

T/F: Public key encryption uses two keys.

True

T/F: SSL is a protocol used to establish a secure connection between two computers.

True

T/F: The WEP specification calls for an access point and its users to share the same 40-bit encrypted password.

True

T/F: Viruses can be spread through e-mail.

True

T/F: Wireless networks are vulnerable to penetration because radio frequency bands are easy to scan.

True

T/F: Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years.

requires financial institutions to ensure the security of customer data.

The Gramm-Leach-Bliley Act

outlines medical security and privacy rules.

The HIPAA Act of 1997

imposes responsibility on companies and management to safeguard the accuracy of financial information

The Sarbanes-Oxley Act

Recovery-oriented computing

The development and use of methods to make computer systems resume their activities more quickly after mishaps is called

Authorization

The process of giving someone permission to do or have something

social engineering

Tricking employees to reveal their passwords by pretending to be a legitimate member of a company is called

client computer

Unauthorized access is a security challenge that is most likely to occur in which of the following points of a corporate network?

DDoS

Using numerous computers to inundate and overwhelm the network from numerous launch points is called a ________ attack.

SQL injection attacks

Which of the following does not pose a security threat to wireless networks? -broadcasted SSIDs -scannability of radio frequency bands -SQL injection attacks -geographic range of wireless signals

hair color

Which of the following is not a trait used for identification in biometric systems? -retinal image -voice -hair color -face

illegally accessing stored electronic communication

Which of the following is not an example of a computer used as a target of crime?

secure socket filtering

Which of the following is not one of the main firewall screening techniques?

-VoIP is more secure than the switched voice network

Which of the following statements about the Internet security is not true? -The use of P2P networks can expose a corporate computer to outsiders. -A corporate network without access to the Internet is more secure than one provides access. -VoIP is more secure than the switched voice network. -Instant messaging can provide hackers access to an otherwise secure network.

employees

You have been hired as a security consultant for a law firm. Which of the following constitutes the greatest source of security threats to the firm?

data security

________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.

identity theft

________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else.

computer forensics

________ is the scientific collection, examination, authentication, preservation, and analysis of data held on or retrieved from computer storage media in such a way that the information can be used as evidence in a court of law.

"controls"

________ refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards.

"security"

________ refers to policies, procedures, and technical measures used to prevent unauthorized access, alternation, theft, or physical damage to information systems.

authentication

________ refers to the ability to know that a person is who he or she claims to be.

packet filtering

examines selected fields in the headers of data packets flowing back and forth between the trusted network and the Internet, examining individual packets in isolation

DoS attack

hackers flood a network server/web server with many thousands of false communications or requests for services to crash the network

bugs

program code defects

two-factor authentication

validating user identity with two means of identification, one of which is typically a physical token, and the other of which is typically data