Deck 6: Information Systems Security

Question 1

An information security threat is a potential exploitation of a vulnerability.

Answer 1

True

Question 2

Black hat hackers formally probe systems for legitimate purposes in order to help with security control procedures.

Answer 2

False

Question 3

One of the duties of the CSO is to present reports to the board of directors for approval.

Answer 3

True

Question 4

System faults represent component equipment failures such as disk failures and power outages.

Question 5

All hackers are malicious.

Question 6

Social engineering is a form of manipulation of people in order to trick them into divulging privileged information.

Question 7

The objective of the first phase of the security system life cycle is to design risk control measures such as various security measures and contingency plans.

Question 8

Malware is short for malicious hardware that compromises the security of the victim's computer.

Question 9

The ERM process is part of the information security management system.

Question 10

Information security management system is an internal control process and manages risk.

Question 11

The CSO should report directly to the president of the organization.

Question 12

Passive threats include information systems fraud and computer sabotage.

Question 13

White hat hackers legitimately probe systems for weaknesses in order to help with security control procedures.

Question 14

Computer security and information security mean the same thing.

Question 15

Information security is broader in concept than computer security and deals with all information,not just computerized information.

Question 16

Pretexting and phishing are forms of social engineering.

Question 17

An information security system has the basic elements of any information system: hardware,software,databases,procedures,and reports.

Question 18

Using the qualitative approach to risk assessment,each loss exposure is computed as the product of the cost of an individual loss times the likelihood of its occurrence.

Question 19

ISO27001 includes 132 general security controls,organized under 11 topics and further broken down into over 5000 detailed controls.

Question 20

ISO 27000 family of standards defines standards for building,operating,and maintaining ISMSs.

Question 21

Malware can be hidden in email,downloaded software,disk or Web browser.

Question 22

In the health insurance sector,the Gramm-Leach-Bliley Act,requires federal agencies that oversee the health insurance sector to implement regulatory standards aimed at protecting the security of critical information resources.

Question 23

A trapdoor is a portion of a computer program that,upon detecting an intruder,"traps" the intruder by activating a firewall to prevent unauthorized access to critical data.

Question 24

Using cloud-based services and data storage is referred to as cloud computing.

Question 25

Three major groups of individuals that may attack information systems include information personnel,users,and hackers.

Question 26

A serious business problem today is the theft of data.

Question 27

Intruders who attack information systems for fun and challenge are known as hackers.

Question 28

Logic bombs are dormant pieces of code placed in programs for activation at a later date by a specific event.

Question 29

Business continuity planning and disaster recovery,in general,mean the same thing.

Question 30

Hacker methods include social engineering,direct observation,electronic interception,and exploits.

Question 31

Direct observation includes shoulder surfing and piggybacking.

Question 32

Three major groups of individuals that may attack information systems include information personnel,users,and employees.

Question 33

Criminal Code 301.2(1)makes it a federal crime in the United States to knowingly and with intent fraudulently gain unauthorized access to data stored in financial institution computers.

Question 34

Input manipulation is the least-used method in most cases of computer fraud.

Question 35

Direct observation includes shoulder surfing and dumpster diving.

Question 36

GASB statement #34 requires utility companies to maintain business continuity plans.

Question 37

Virtualization involves running multiple operating systems,or multiple copies of the same operating system,all on the same machine.

Question 38

Implementing security measures and contingency plans help to control computer information threats.

Question 39

In general,vulnerabilities arise from improperly installed or configured software and from unforeseen defects or deficiencies in the software.

Question 40

A worm is any type of Trojan that silently spreads from one computer to another over a network,without the intervention of any individual or server.

Question 41

The most sophisticated type of wire tapping is called ________.

Question 42

Studies have shown that 45% of all disasters are due to human error.

Question 43

Software should not be installed on any computer without prior approval of security.

Question 44

The Treadway Commission has linked ________ ________ to computer crime.

Question 45

In most organizations,accounting,computing,and data processing are all organized under the controller.

Question 46

The least common method used to commit computer fraud is ________ ________.

Question 47

With today's excellent computer security software,it is no longer necessary to physically separate unauthorized individuals from computer resources.

Question 48

The problem with Web server attacks is that the Web server is essentially an extension of the operating system.

Question 49

A defrauder may use ________ to cover up ________.

Question 50

Employees should be laid off or terminated with the greatest care because terminated employees account for a significant portion of all sabotage incidents.

Question 51

The information security management system is an organizational ________ ________ ________ that controls special risks associated with computer-based information systems.

Question 52

Escalation procedures state the conditions under which a disaster should be declared,who should declare it,and whom that person should notify when executing the declaration.

Question 53

No password system is of much value unless the passwords themselves are protected.

Question 54

System-access controls prevent unauthorized individuals from physically accessing computer resources.

Question 55

In a denial of service attack,an intruder is denied access to an organization's Web site after the intruder attempts to break through its firewalls and proxy server countermeasures.

Question 56

An incremental backup backs up all files whose archive bit is set to 0 before termination of the session.

Question 57

A program kept in a locked file is one which can be run but not looked at (i.e.,code)or altered in anyway.

Question 58

Fault tolerance can be applied at any of three levels: input,processing,or output.

Question 59

The ideal password should consist of easy-to-remember names such as banana,kitty,IBM,password,or Friday.

Question 60

The method of risk assessment for computer systems where system vulnerabilities and threats are listed and subjectively ranked is known as the ________ approach.

Question 61

________ authentication systems identify individuals based on their fingerprints,hand sizes,retina patterns,or voice patterns.

Question 62

An alternate site that contains the wiring,equipment,and very up-to-date back-up data and software is a(n)________ site.

Question 63

________ can be digitally signed in the same way that electronic messages are signed to authenticate the identity of the source of the program.

Question 64

A security system where the user enters an identification number and the system responds with a sign (i.e.,code word)is known as a(n)________ system.

Question 65

Instead of using the terms systems analysis,design,implementation,operation,evaluation,and control,ISO 27001 uses the terms ________,________,________,and ________.

Question 66

The three objectives of information security are ________,________,and ________.

Question 67

In computer environments,________ control is especially important as there is often a tendency to either overspend or spend on the wrong things.

Question 68

The best security ________ will not help if the system ________ do not enforce the policies.

Question 69

________ ________ includes unnoticed intruders,wiretrappers,piggybackers,impersonating intruders,and eavesdroppers.

Question 70

In general,________ arise from improperly installed or configured software and from unforeseen defects or deficiencies in the software.

Question 71

Backing up files is not the same thing as ________ them.

Question 72

A weakness in the ________ system is also likely to create a related weakness in ________ server security.

Question 73

________ is a form of social engineering in which one impersonates another typically in a phone call or electronic communication.

Question 74

Information security management system is part of the larger ________ risk management process.

Question 75

Information security management system is an internal control process and manages ________.

Question 76

A(n)________ cell phone is an exact and illegitimate copy of another cell phone,including a copy of the internal SIM in order to intercept text and voice messages.

Question 77

The distribution of ________ should be controlled by a formal,secure delivery system.

Question 78

________ is a form of social engineering which is aimed directly at tricking victims into giving information,money,or other valuable assets to perpetrators.

Question 79

________ ________ involves manipulating victims in order to trick them into divulging privileged information.

Question 80

________ is the best defense against electronic interception.