Information Systems Ch 7
________ refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards.
"Controls"
________ refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems.
"Security"
Which of the following is not an example of a computer used as an instrument of crime?
Breaching the confidentiality of protected computerized data
Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack.
DDoS
________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage.
Data security
You have been hired as a security consultant for a law firm. Which of the following constitutes the greatest source of security threats to the firm?
Employees
Which of the following is not an example of a computer used as a target of crime?
Illegally accessing stored electronic communication
________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors.
Intrusion detection systems
A(n) __________audit examines the firm's overall security environment as well as the controls governing individual information systems.
MIS
Smaller firms may outsource some or many security functions to:
MSSPs.
Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems.
UTM
Which of the following statements about the Internet security is not true?
VoIP is more secure than the switched voice network.
Which of the following specifications replaces WEP with a stronger security standard that features changing encryption keys?
WPA2
Electronic evidence on computer storage media that is not visible to the average user is called ________ data.
ambient
A firewall identifies all of the following characteristics of incoming traffic, except:
biometric authentication
Evil twins are:
bogus wireless network access points that look legitimate to users.
Application controls:
can be classified as input controls, processing controls, and output controls.
Biometric authentication:
can use a person's voice as a unique, measurable trait.
Hackers create a botnet by:
causing other people's computers to become "zombie" PCs following a master computer.
A salesperson clicks repeatedly on the online ads of a competitor's in order to drive the competitor's advertising costs up. This is an example of:
click fraud
Computer forensics tasks include all of the following except:
collecting physical evidence on the computer.
Downtime refers to periods of time in which a:
computer system is not operational.
In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data.
deep-packet inspection
The most common type of electronic evidence is:
A firewall allows the organization to:
enforce a security policy on data exchanged between its network and the Internet
For 100% availability, online transaction processing requires:
fault-tolerant computer systems.
An authentication token is a(n):
gadget that displays passcodes.
Specific security challenges that threaten corporate servers in a client/server environment include:
hacking; vandalism; denial of service attacks.
________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else.
identity theft
The Sarbanes-Oxley Act:
imposes responsibility on companies and management to safeguard the accuracy of financial information.
The Internet poses specific security problems because:
it was designed to be easily accessible.
Electronic data are more susceptible to destruction, fraud, error, and misuse because information systems concentrate data in computer files that:
may be accessible by anyone who has access to the same network.
Rigorous password systems:
may hinder employee productivity.
Most antivirus software is effective against:
only those viruses already known when the software is written.
The HIPAA Act of 1996:
outlines medical security and privacy rules.
The development and use of methods to make computer systems resume their activities more quickly after mishaps is called:
recovery-oriented computing.
Pharming involves:
redirecting users to a fraudulent Web site even when the user has typed in the correct address in the Web browser.
The Gramm-Leach-Bliley Act:
requires financial institutions to ensure the security of customer data.
Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in a(n):
risk assessment
Statements ranking information risks and identifying security goals are included in a(n):
security policy
An example of phishing is:
setting up a fake medical Web site that asks users for confidential information.
Tricking employees to reveal their passwords by pretending to be a legitimate member of a company is called:
social engineering
Phishing is a form of:
spoofing
Redirecting a Web link to a different address is a form of:
spoofing
A keylogger is a type of:
spyware
Specific security challenges that threaten the communications lines in a client/server environment include:
tapping; sniffing; message alteration; radiation.
Specific security challenges that threaten clients in a client/server environment include:
unauthorized access; errors; spyware.
A digital certificate system:
uses third-party CAs to validate a user's identity.
Large amounts of data stored in electronic form are ________ than the same data in manual form.
vulnerable to many more kinds of threats
A practice in which eavesdroppers drive by buildings or park outside and try to intercept wireless network traffic is referred to as:
war driving
An independent computer program that copies itself from one computer to another over a network is called a:
worm
________ identify the access points in a Wi-Fi network.
SSIDs
Currently, the protocols used for secure information transfer over the Internet are:
SSL, TLS, and S-HTTP.
In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key?
Symmetric key encryption
How do software vendors correct flaws in their software after it has been distributed?
They issue patches
In 2004, ICQ users were enticed by a sales message from a supposed anti-virus vendor. On the vendor's site, a small program called Mitglieder was downloaded to the user's machine. The program enabled outsiders to infiltrate the user's machine. What type of malware is this an example of?
Trojan horse
