CH 4

___ percent of organizational breaches exploit weak or stolen user credentials.

76

_______________ controls restrict unauthorized individuals from using information resources.

Access

Which of the following is NOT one of the most dangerous employees to information security?

Accountants

________________ is software that causes pop-up advertisements to appear on your screen.

Adware

Which of the following is NOT an example of alien software?

Blockware

Which country is currently in a dispute with the US over bilateral hacking?

China

_________________ manages the internet connections for North Korea and could stop hacking attempts on the US.

China

Which of the following is NOT a lesson learned from the Sony Picture Entertainment hack on November 24, 2014?

China is the leading hacking group that encourages similar behavior from other countries

If you have an empty building you can move into if your primary location is destroyed, you've implemented a _________ site.

Cold

Security must be balanced with _________ for people to use systems.

Convenience

__________________ is the loss of business from increased customer turnover

Customer churn

_________ is an identity theft technique

Dumpster diving

OpenSSL is __________ software.

Encryption

A copyright lasts 20 years.

False

A patent lasts for the life of the creator plus 70 years.

False

Competitive intelligence is industrial espionage.

False

Janitors are no threat to information security since they have no access to company systems.

False

Tracking down cybercriminals is the most difficult and only real challenge authorities face.

False

__________ is a computer security firm that sells malware detection tools to companies like Target.

FireEye

Which hacker group successfully attacked Sony Picture Entertainment on November 24, 2014?

Guardians of Peace

A smart ID card is something the user _______.

Has

SCADA attacks typically occur on ___________.

Industrial control systems

Google created a code fix for the Heartbleed bug. Which of the following is a TRUE statement?

Industrial control systems are highly vulnerable since they are updated infrequently.

___________ is threatening to steal or actually stealing information from a company and then demanding payment to not use or release that information.

Information extortion

________________________ refers to all the processes and policies designed to protect an organization's information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

Information security

Biometrics is something the user _______.

Is

Which of the following is FALSE?

Mainframes make it easy to communicate freely and seamlessly with everyone.

_________________ was originally accused of the Sony Picture Entertainment hack on November 24, 2014; their involvement ____________ been proved.

North Korea; has not

The Heartbleed bug is an encryption security flaw in the ___________ software package that was an _____________ mistake by the software developer.

OpenSSL; unintended

____________ is the probability that a threat will impact an information resource.

Risk

_______________ is a process whereby the organization takes concrete actions against risks, such as implementing controls and developing a disaster recovery plan.

Risk mitigation

Shodan is used for _________.

SCADA attacks

You start browsing your favorite home improvement company's website and notice someone has changed all the logos to their main competitor's logos. This is an example of ___________.

Sabotage

_____________________ is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords

Social engineering

_____________________________ is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords.

Social engineering

Phishing is an example of __________.

Software attack

According to the "Catching a Hacker" case, ____________ is one of the most sophisticated and destructive malicious software programs ever developed.

SpyEye

_________ is any danger to which a system may be exposed.

Threat

Auditing __________ the computer means inputs, outputs, and processing are checked.

Through

Coca-Cola's formula is an example of a ___________.

Trade secret

Biometrics is an authentication tool.

True

Blacklisting is when everything can run except what is on the list.

True

The goal of risk management is to reduce risk to acceptable levels.

True

Whitelisting is when nothing can run unless it is on the list.

True

Wireless is an untrusted network.

True

Which of the following is NOT an unintentional threat to information systems?

Viruses

_________ is the possibility that the system will be harmed by a threat.

Vulnerability

Shodan's primary purpose is ___________.

a service that searches the internet for devices connected to the internet

Risk _______________ means absorbing any damages that occur.

acceptance

You decide to use the password "1234" on your computer because you figure nobody cares enough about your information to steal it. This is a risk __________ strategy.

acceptance

A ___________ is an attack by a programmer developing a system.

back door

The purpose of SpyEye is to _____________.

collect personal and financial information

A firewall is a _______ control.

communication

A ___________ is a remote attack needing no user action.

denial-of-service attack

Weak passwords are a(n) ___________ threat.

employee

The goal of CAPTCHA is to ___________.

ensure you aren't alien software

The airport's self check-in computers are a(n) __________ threat

hardware

_________ is one common example of SSL.

https

The main problem with multifactor authentication is _____________.

it will invade our privacy

If you hire a cybersecurity company like FireEye to identify security weaknesses in your information systems, you are using a risk _________ strategy.

limitation

By hiring FireEye to improve their security, Target adopted a risk _________ strategy; this strategy was ___________.

limitation; a failure

A ___________ is an attack by a programmer developing a system.

logic bomb

A ___________ is a remote attack requiring user action

phishing attack

The Target data breach started with a ____________

phishing attack

The main purpose for the attack on Sony Picture Entertainment on November 24, 2014 was to __________.

stop the release of the move The Interview

Cybercriminals _________

target known software security weaknesses.

The Shodan case illustrates ___________.

that hackers and security researchers use the same sites to identify vulnerabilities

You have a small business that has had problems with malware on your employees' computers. You decide to hire a third-party company such as GFI Software to implement security controls and then monitor your company's systems. You are adopting a risk ________ strategy.

transference

Social engineering is a(n) ___________ threat on the part of the employee and a(n) _________ threat on the part of the social engineer.

unintentional; deliberate

Wireless is a(n) inherently _________ network.

untrusted