Deck 11: Managing Information Security

Question 1

Hacker tools are becoming increasingly sophisticated and easier to use allowing hackers to outsmart the countermeasures used by companies to protect themselves.

Answer 1

True

Question 2

A common profile of an insider criminal is a poor performance review.

Answer 2

False

Question 3

The trend in computer security is toward policy-based management.

Answer 3

True

Question 4

Identification services can prove that someone was the actual sender of a message.

Question 5

A malicious program can be housed inside an innocent program that appears to be helpful.

Question 6

The overarching goal of information security is to ensure data integrity, availability,
and confidentiality.

Question 7

Virtual Private Networks are hardware or software that controls access between networks.

Question 8

All business executives need to understand threats and countermeasures and continually fund security work to protect their businesses.

Question 9

Mobile computing and telecommuting actually decrease the possibility for cybercrime because the greater number of network openings provides more opportunities for law enforcement.

Question 10

Authentication is a means of providing proof of data transmission or receipt so that the occurrence of a transaction cannot later be refused.

Question 11

The Internet does not have intrinsic security protocols.

Question 12

Tunneling creates a temporary connection between to remote computer which blocks access to anyone trying to intercept messages sent over that link.

Question 13

The most expensive cybercrime are computer viruses.

Question 14

Nonrepudiation is moving toward application-level security, requiring authentication for each application a user wants to access.

Question 15

For digital signatures to work, a trusted third party must issue the keys to individuals and firms.

Question 16

A certificate is a mechanism to verify an identity on a computer system over a computer network.

Question 17

Vein-viewing technology can be used to replace signatures, keys, and passwords.

Question 18

Managing security refers to a comprehensive set of activities that develop, implement, direct, and monitor the organization's security strategy and activities.

Question 19

Computer attacks by insiders can be among the most expensive and most damaging security treats.

Question 20

Biometrics are the most widely used security technology.

Question 21

Which of the following areas are considered important to maintaining a safe computing environment?

A) Egress security
B) Facility security
C) Network security
D) All of the above

Question 22

To protect against hacking, companies install ______ which controls access between networks.

A) Virtual Private Networks
B) Encryption
C) firewalls
D) Intrusion detection
E) None of the above

Question 23

Security is often thought by many to be a(n):

A) business problem.
B) staff problem.
C) IT problem.
D) technological problem.

Question 24

________ remain the source of the largest financial losses.

A) Virus attacks
B) Denial of service attacks
C) Trojan horse attacks
D) Application vulnerabilities

Question 25

An estimation by the Computer Security Institute suggests that losses caused by insider attacks account for between________ percent of the entire organization's losses related to computer crimes.

A) 10 and 20
B) 30 and 50
C) 40 and 60
D) 20 and 80

Question 26

Which of the following hacker tricks involves placing oneself between two communicating parties and either substituting one's own information in place of one of the parties' information or denying one party access to a session?

A) Man-in-the-middle
B) Denial of service
C) Trojan horse
D) Network sniffing

Question 27

To protect against spoofing, firms need a way to:

A) authenticate the identity of an individual.
B) repudiate the identity of an individual.
C) dispute the identity of an individual.
D) All of the above

Question 28

The security technique that prevents parties from denying actions they have taken is known as:

A) Authentication
B) Nonrepudiation
C) Identification
D) Indemnification
E) None of the above

Question 29

Which of the following hacker tricks involves launching software that monitors all traffic looking for passwords or other valuable information?

A) Man-in-the-middle
B) Denial of service
C) Trojan horse
D) Network sniffing

Question 30

The most common public key encryption method is:

A) RSA
B) DES
C) AES
D) SSL

Question 31

The security technique used to protect systems against sniffing is called:

A) Virtual Private Networks
B) Encryption
C) firewalls
D) Intrusion detection
E) None of the above

Question 32

The core challenge of security management is:

A) finding the right balance between shielding the organization's main assets from potential harm.
B) finding the right balance between shielding the organization's main processes from potential harm.
C) enabling staff to do their jobs.
D) All of the above

Question 33

Business continuity is a(n):

A) business issue.
B) IT issue.
C) disaster recovery issue
D) All of the above

Question 34

Which of the following hacker tricks involves flooding a Web site, with so much useless traffic that the site becomes overwhelmed and freezes?

A) Man-in-the-middle
B) Denial of service
C) Trojan horse
D) Network sniffing

Question 35

The security technique that protects information from being seen is known as:

A) Authentication
B) Nonrepudiation
C) Identification
D) Indemnification
E) None of the above

Question 36

A common credit card fraud is called:

A) application fraud.
B) network fraud.
C) impersonation.
D) None of the above

Question 37

The top security concern among all organizations is:

A) computer viruses.
B) identity theft.
C) data theft.
D) password breachs.

Question 38

Which of the following strategies involves creating a culture for enforcing IT security?

A) Creating and communicating an enterprise software security framework.
B) Knowledge management training.
C) Assuring internal security policy and external regulator compliance.
D) Governance in the design and implementation process of system development or maintenance.

Question 39

Memory management, access to I/O devices, file management, and hardware configuration are all examples of:

A) Application security
B) Operating systems security
C) Network security
D) Middleware and Web services security
E) None of the above

Question 40

Defining security policies and then centrally managing and enforcing those policies via security management products and services is known as:

A) intrusion-based management.
B) policy-based management.
C) incident-based management.
D) None of the above

Question 41

List five steps that can be taken to protect from credit card fraud.

Question 42

Describe a VPN and how a VPN can be used for secure organizational communications.

Question 43

List five areas exposed to threats and vulnerabilities where security must be applied.

Question 44

List three requirements noted by Tucker associated with business continuity.

Question 45

Name five types of security threats.

Question 46

Describe the management/business issues around both business continuity and IT disaster recovery.

Question 47

List five fundamental pillars that make up all security countermeasures and techniques.

Question 48

What is a digital certificate?

Question 49

List four common profiles of an "insider" criminal.

Question 50

Describe three steps required for an organization to develop and information-centric security strategy.