Deck 9: Electronic Commerce Security and Fraud Protection

Question 1

According to the CSI Computer Crime and Security Survey, firewalls were the most commonly used defense technologies in 2008.

Answer 1

False

Question 2

According to the CSI Computer Crime Security Survey, the most frequently occurring computer attacks were from viruses in 2008.

Answer 2

True

Question 3

The Internet and its network protocols were never intended for use by untrustworthy people or criminals.

Answer 3

True

Question 4

The motives of hackers have shifted from the desire for fame and notoriety to advancing personal and political agendas.

Question 5

Keystroke logging captures and records user keystrokes.

Question 6

Information security departments with huge workloads and limited budgets optimize their EC security programs for efficiency and tend to work strategically.

Question 7

Cybercrimes are intentional crimes carried out on the Internet.

Question 8

Propagation method and payload are the two components of a virus.

Question 9

Worms cannot spread via instant messages.

Question 10

Honeypots are blogs created solely for marketing purposes.

Question 11

Confidentiality, integrity, and awareness are the three components of the CIA security triad.

Question 12

Access control involves authorization and authentication.

Question 13

Encryption algorithm is the mathematical formula used to encrypt plaintext into ciphertext, and vice versa.

Question 14

Strong EC security makes online shopping more convenient for customers.

Question 15

Preventing vulnerability during the EC design and pre-implementation stage is far more expensive than mitigating problems later.

Question 16

Which of the following is the underlying reason why comprehensive EC security is necessary?

A) The Internet was designed for maximum efficiency without regard for its security or users with malicious intent.
B) The shift toward profit-motivated crimes
C) Security costs and efforts from reacting to crises and paying for damages are greater than if an EC strategy is in place.
D) Many companies fail to implement basic IT security management best practices, business continuity plans, and disaster recovery plans.

Question 17

A botnet is

A) a huge number of hijacked Internet computers that have been set up to forward traffic, including spam and viruses, to other computers on the Internet.
B) a piece of software code that inserts itself into a host or operating system to launch DOS attacks.
C) a piece of code in a worm that spreads rapidly and exploits some known vulnerability.
D) a production system that looks like it does real work, but that acts as a decoy and is watched to study how network intrusions occur.

Question 18

________ is the criminal, fraudulent process of attempting to acquire confidential information by masquerading as a trustworthy entity.

A) Spamming
B) Pretexting
C) Social engineering
D) Phishing

Question 19

The mechanism that determines who can legitimately use a network resource best describes

A) access control.
B) confidentiality.
C) key encryption.
D) digital envelope.

Question 20

Each of the following is a true statement about access control except:

A) Access control determines which persons, programs, or machines can legitimately use a network resource and which resources he, she,or it can use.
B) Access control lists (ACLs) define users' rights, such as what they are allowed to read, view, write, print, copy, delete, execute, modify, or move.
C) All resources need to be considered together to identify the rights of users or categories of users.
D) After a user has been identified, the user must be authenticated.

Question 21

Encryption components include each of the following except

A) encryption algorithm.
B) key value.
C) ciphertext.
D) internal control environment.

Question 22

A scheme for securing e-payments using public key encryption and various technical components best describes

A) message digesting.
B) Data Encryption Standard.
C) public key infrastructure.
D) key space.

Question 23

A method of encryption that uses a pair of matched keys, including a public key to encrypt a message and a private key to decrypt it, describes

A) data encryption standard.
B) public asymmetric key encryption.
C) symmetric private key encryption.
D) paired key encryption.

Question 24

Security functions or characteristics of digital signatures include each of the following except:

A) A digital signature is the electronic equivalent of a personal signature, which can be forged.
B) Digital signatures are based on public keys for authenticating the identity of the sender of a message or document.
C) Digital signatures ensure that the original content of an electronic message or document is unchanged.
D) Digital signatures are portable.

Question 25

The combination of the encrypted original message and the digital signature, using the recipient's public key, best describes

A) digital envelope.
B) message digest.
C) hash.
D) digital signature.

Question 26

Which of the following is not an advantage of virtual private networks (VPN) for data communications?

A) They are less expensive than private leased lines because they use the public Internet to carry information.
B) They ensure the confidentiality and integrity of the data transmitted over the Internet without requiring encryption.
C) They can reduce communication costs dramatically because VPN equipment is cheaper than other remote solutions.
D) Remote users can use broadband connections rather than make long distance calls to access an organization's private network.

Question 27

A special category of software that can monitor activity across a network or on a host computer, watch for suspicious activity, and take automated action based on what it sees best describes

A) honeynet.
B) intrusion detection system.
C) firewall.
D) virtual private network.

Question 28

Which of the following are controls established to protect the system regardless of the application?

A) general controls
B) application controls
C) broad controls
D) systems controls

Question 29

Software applications that have some degree of reactivity, autonomy, and adaptability best describes

A) EC avatars.
B) EC bots.
C) worms.
D) intelligent agents.

Question 30

The work atmosphere that a company sets for its employees describes

A) acceptable use policy.
B) internal control environment.
C) internal politics.
D) standard of due care.

Question 31

A law that makes it a crime to send commercial e-mail messages with false or misleading message headers or misleading subject lines is

A) EEA.
B) DCMA.
C) SSL.
D) CAN-SPAM.

Question 32

According to an InformationWeek survey, the majority of security challenges for corporations include

A) managing the complexity of security.
B) preventing data breaches from outside attackers.
C) enforcing security policies.
D) all of the above.

Question 33

Which of the following is a policy that informs users of their responsibilities when using company networks, wireless devices, and customer data?

A) business impact analysis
B) business plan
C) acceptable use policy
D) EC security program

Question 34

The key reasons why EC criminals cannot be stopped include each of the following except:

A) Sophisticated hackers use browsers to crack into Web sites.
B) Strong EC security makes online shopping inconvenient and demanding on customers.
C) There is lack of cooperation from credit card issuers and foreign ISPs.
D) Online shoppers do not take necessary precautions to avoid becoming a victim.

Question 35

Computer security categories include ________, ________, and ________.

Question 36

A ________ is a plan that keeps the business running after a disaster occurs.

Question 37

________ are computers infected with malware that are under the control of a spammer, hacker, or other criminal.

Question 38

________ are weaknesses in software or other mechanisms that threaten the confidentiality, integrity, or availability of an asset.

Question 39

A ________ is a malicious hacker who may represent a serious problem for a corporation.

Question 40

________ is the protection of information systems against unauthorized access to or modification of information whether in storage, processing, or in transit, and against the denial of service to authorized users, including those measures necessary to detect, document, and counter such threats.

Question 41

A ________ attack is an attack on a Web site in which an attacker uses specialized software to send a flood of data packets to the target computer with the aim of overloading its resources.

Question 42

List the six major objectives of EC defense strategies.

Question 43

Briefly discuss the five encryption components.

Question 44

Briefly describe four major components for protecting internal information flow inside an organization.