Deck 10: Computer Crime and Information Technology Security

Question 1

The difference between "error" and "information manipulation" as business risks associated with information technology is:

A)The person's intent
B)The kind of information involved
C)The potential dollar amount of the loss
D)The classification on Carter's taxonomy

Answer 1

A

Question 2

George received an e-mail that threatened to release his personal financial data unless he paid a fee.That situation is an example of:

A)Extortion
B)Intrusion
C)Information manipulation
D)Error

Answer 2

A

Question 3

The terms target, instrumentality, incidental and associated from Carter's taxonomy are most closely associated with which form of risk from Brown's taxonomy?

A)Human error
B)Liquidity
C)Systems
D)Market

Answer 3

C

Question 4

According to Carter's taxonomy, use of a computer to further a criminal end refers to which of the following categories?

A)Target
B)Instrumentality
C)Incidental
D)Associated

Question 5

Consider the following examples of computer crime as you answer the question:
I)Social Security numbers are stolen from a company's database.ii.A fraudster uses a computer to identify people over the age of 80 with annual incomes of $250,000 or more.iii.A supervisor receives threats from a worker via e-mail; the worker demands promotion as a condition of not exposing the supervisor's illegal acts.iv.An unhappy customer launches a denial-of-service attack.Which two items represent the same category of risk from the list discussed in the chapter?

A)I and II
B)I and III
C)II and IV
D)None of these

Question 6

Business risks and threats to information systems include all of the following except:

A)Error
B)Intrusions
C)Malicious software
D)Instrumentality

Question 7

Consider the following examples of computer crime as you answer the question:
I)Social Security numbers are stolen from a company's database.ii.A fraudster uses a computer to identify people over the age of 80 with annual incomes of $250,000 or more.iii.A supervisor receives threats from a worker via e-mail; the worker demands promotion as a condition of not exposing the supervisor's illegal acts.iv.An unhappy customer launches a denial-of-service attack.Which of the following pairs an item from the list with an appropriate description of a business risk?

A)Extortion, i
B)Service interruption, ii
C)Extortion, iii
D)None of these

Question 8

George received an e-mail that threatened to release his personal financial data unless he paid a fee.Which category of computer crime best describes that situation?

A)Target
B)Instrumentality
C)Incidental
D)Associated

Question 9

According to COBIT's principles, information technology governance and management should meet ___ needs.

A)stakeholder
B)the AICPA Core Competency framework
C)International Accounting Standards Board
D)holistic

Question 10

Consider the following examples of computer crime as you answer the question:
I)Social Security numbers are stolen from a company's database.ii.A fraudster uses a computer to identify people over the age of 80 with annual incomes of $250,000 or more.iii.An employee receives threats from a co-worker via e-mail.iv.An unhappy customer launches a denial-of-service attack.Carter's taxonomy of computer crime comprises four categories.Which of the following statements is most true?

A)The list includes examples of all four categories.
B)The list includes examples of all categories except associated.
C)The list includes examples of all categories except target.
D)The list includes examples of all categories except incidental.

Question 11

Computer crimes that fall under Carter's "target" category are most closely associated with which generic element of an accounting information system?

A)Processing
B)Storage
C)Both processing and storage
D)Neither processing nor storage

Question 12

Which category of computer crime in Carter's taxonomy recognizes that the presence of computers has generated new versions of traditional crimes?

A)Target
B)Instrumentality
C)Incidental
D)Associated

Question 13

An information systems development company routinely creates a password that they do not disclose to their clients.In that way, the development company can bypass any security the client adds on later if the system needs maintenance.The client's information system is therefore at greatest risk for:

A)Error
B)Intrusion
C)Web site defacement
D)Extortion

Question 14

A bank's information system was hacked in an effort to obtain clients' personal financial information.Which category of computer crime best describes that situation?

A)Target
B)Instrumentality
C)Incidental
D)Associated

Question 15

The risk of disclosure of confidential information is most closely related to which category in Carter's taxonomy?

A)Target
B)Instrumentality
C)Both target and instrumentality
D)Neither target nor instrumentality

Question 16

Consider the following examples of computer crime as you answer the question:
I)Social Security numbers are stolen from a company's database.ii.A fraudster uses a computer to identify people over the age of 80 with annual incomes of $250,000 or more.iii.An employee receives threats from a co-worker via e-mail.iv.An unhappy customer launches a denial-of-service attack.Carter's taxonomy of computer crime comprises four categories.Which of the following pairs includes two items from the same category?

A)I and II
B)II and III
C)II and IV
D)I and IV

Question 17

Consider the following examples of computer crime as you answer the question:
I)Social Security numbers are stolen from a company's database.ii.A fraudster uses a computer to identify people over the age of 80 with annual incomes of $250,000 or more.iii.An employee receives threats from a co-worker via e-mail.iv.An unhappy customer launches a denial-of-service attack.Carter's taxonomy of computer crime comprises four categories.Which of the following pairs includes items from different categories?

A)I and IV
B)II and III
C)Both I and IV and II and III
D)Neither I and IV nor II and III

Question 18

Malicious software, such as a logic bomb, is most closely related to which generic element of the accounting information system?

A)Inputs
B)Processing
C)Outputs
D)Storage

Question 19

According to COBIT's principles, information technology governance and management should cover the enterprise:

A)from governance to management.
B)end to end.
C)inside the information systems and accounting departments only.
D)outside the information systems and accounting departments only.

Question 20

Disclosure of confidential information is one risk associated with information technology.Which of the following would be considered confidential information?

A)The stock price of Microsoft
B)The book value of Disney Corporation's fixed assets
C)The social security numbers of GE's board of directors
D)All of these are examples of confidential information.

Question 21

According to COBIT 5, an organization's information technology governance and management should meet stakeholder needs.Which of the following best pairs a stakeholder with an information need?

A)vice president of finance, interest rates on newly acquired debt
B)human resources manager, cost of conducting a new employee search
C)Both vice president of finance, interest rates on newly acquired debt and human resources manager, cost of conducting a new employee search
D)Neither vice president of finance, interest rates on newly acquired debt nor human resources manager, cost of conducting a new employee search

Question 22

According to ISACA, which COBIT enabler provides the vehicle for translating desired behavior into practical guidance for day-to-day management?

A)principles, policies and frameworks
B)culture, ethics and behavior
C)services, infrastructure and applications
D)people, skills and competencies

Question 23

Consider the following short case as you respond to the question: Melissa is an internal auditor for the County of Bufflufia.Her job responsibilities include providing training on information systems security and checking the work of data entry clerks.Melissa is also part of a team that responds to denial-of-service attacks on the county's information system.Her co-worker, Eugene, ensures that all the county's computers have the most up-to-date antivirus software; he also enforces the county's policy of backing up sensitive data, such as employee social security numbers and other payroll information, at least once a day.The back-ups are dated and stored in a locked filing cabinet.Melissa's responsibilities relate to which elements of the CIA triad?

A)Confidentiality and availability
B)Confidentiality and data integrity
C)Availability and data integrity
D)None of these

Question 24

Consider the following short case as you respond to the question: Melissa is an internal auditor for the County of Bufflufia.Her job responsibilities include providing training on information systems security and checking the work of data entry clerks.Melissa is also part of a team that responds to denial-of-service attacks on the county's information system.Her co-worker, Eugene, ensures that all the county's computers have the most up-to-date antivirus software; he also enforces the county's policy of backing up sensitive data, such as employee social security numbers and other payroll information, at least once a day.The back-ups are dated and stored in a locked filing cabinet.Which employee has responsibilities related to technical security controls?

A)Melissa only
B)Eugene only
C)Both Melissa and Eugene
D)Neither Melissa nor Eugene

Question 25

According to COBIT 5, an organization's information technology governance and management should apply a single integrated framework for managing information.Which of the following best pairs an established framework with an element of the framework?

A)FASB Conceptual Framework of Accounting, qualitative characteristics of internal control
B)FASB Conceptual Framework of Accounting, elements of financial statements
C)Both FASB Conceptual Framework of Accounting, qualitative characteristics of internal control and FASB Conceptual Framework of Accounting, elements of financial statements
D)Neither FASB Conceptual Framework of Accounting, qualitative characteristics of internal control nor FASB Conceptual Framework of Accounting, elements of financial statements

Question 26

According to ISACA, which COBIT enabler focuses on an often underestimated success factor in governance and management activities?

A)principles, policies and frameworks
B)culture, ethics and behavior
C)services, infrastructure and applications
D)people, skills and competencies

Question 27

At HCK Corporation, only employees in the information systems department can install new software on a computer.Which type of security control best describes that practice?

A)Physical
B)Technical
C)Administrative
D)Practice

Question 28

Which COBIT enabler focuses on things like product demand, employee satisfaction and vendor reliability?

A)organizational structures
B)information
C)separating governance from management
D)meeting stakeholder needs

Question 29

According to COBIT 5, an organization's information technology governance and management should separate governance from management.In that context, examples of governance include:

A)developing a comprehensive organizational budget.
B)deciding the dollar amount of an upcoming dividend.
C)Both developing a comprehensive organizational budget and deciding the dollar amount of an upcoming dividend.
D)Neither developing a comprehensive organizational budget nor deciding the dollar amount of an upcoming dividend.

Question 30

A firewall is an example of which type of control?

A)Physical security
B)Technical security
C)Administrative security
D)Enterprise security

Question 31

Consider the following short case as you respond to the question: Melissa is an internal auditor for the County of Bufflufia.Her job responsibilities include providing training on information systems security and checking the work of data entry clerks.Melissa is also part of a team that responds to denial-of-service attacks on the county's information system.Her co-worker, Eugene, ensures that all the county's computers have the most up-to-date antivirus software; he also enforces the county's policy of backing up sensitive data, such as employee social security numbers and other payroll information, at least once a day.The back-ups are dated and stored in a locked filing cabinet.Which of the following statements is most true?

A)Eugene's responsibilities span both physical and technical controls.
B)Melissa's responsibilities are related to at least one element of the CIA triad.
C)Both Eugene's responsibilities span both physical and technical controls and Melissa's responsibilities are related to at least one element of the CIA triad are true.
D)Neither Eugene's responsibilities span both physical and technical controls nor Melissa's responsibilities are related to at least one element of the CIA triad is true.

Question 32

All of the following are elements of the CIA triad except:

A)Clarity
B)Confidentiality
C)Availability
D)Data integrity

Question 33

COBIT comprises ___ principles and ___ enablers.

A)five; seven
B)seven; five
C)five; five
D)seven; seven

Question 34

According to COBIT's principles, information technology governance and management should enable a ___ approach.

A)stakeholder
B)framework
C)behavioral
D)holistic

Question 35

According to COBIT 5, an organization's information technology governance and management should cover the enterprise end-to-end.Which of the following parts of an organization would likely need information on inventory levels?

A)production and operations
B)marketing
C)accounting
D)all of these

Question 36

Consider the following short case as you respond to the question: Melissa is an internal auditor for the County of Bufflufia.Her job responsibilities include providing training on information systems security and checking the work of data entry clerks.Melissa is also part of a team that responds to denial-of-service attacks on the county's information system.Her co-worker, Eugene, ensures that all the county's computers have the most up-to-date antivirus software; he also enforces the county's policy of backing up sensitive data, such as employee social security numbers and other payroll information, at least once a day.The back-ups are dated and stored in a locked filing cabinet.Which employee has responsibilities related to all three elements of the CIA triad?

A)Melissa only
B)Eugene only
C)Both Melissa and Eugene
D)Neither Melissa nor Eugene

Question 37

WER Corporation forces its employees to change their system password every six months.Which type of security control best describes the company's policy?

A)Physical
B)Technical
C)Administrative
D)Hacking

Question 38

According to COBIT's principles, information technology governance and management should:

A)focus on the four purposes of internal control.
B)address systems risk only.
C)apply a single integrated framework.
D)apply an end-to-end framework.

Question 39

According to COBIT 5, an organization's information technology governance and management should apply a single integrated framework for managing information.Which of the following best pairs an established framework with an element of the framework?

A)COSO enterprise risk management, cost of managing risk
B)COSO internal control, risk/control matrix
C)Both COSO enterprise risk management, cost of managing risk and COSO internal control, risk/control matrix
D)Neither COSO enterprise risk management, cost of managing risk nor COSO internal control, risk/control matrix

Question 40

According to COBIT 5, an organization's information technology governance and management should enable a holistic approach.Which of the following frameworks provides the most holistic view of an organization?

A)FASB Conceptual Framework
B)AICPA Core Competencies Framework
C)Brown's risk taxonomy
D)Vroom's expectancy theory

Question 41

Which of the following best pairs a COBIT enabler with an element of the FASB conceptual framework of accounting?

A)processes, the process of producing financial statements
B)information, elements of financial statements
C)culture, international elements of the conceptual framework
D)organizational structures, assumptions/principles/constraints on those structures

Question 42

Following the principles and enablers of COBIT will enable organizations to better:

A)apply the systems development life cycle.
B)address all elements of the C-I-A triad.
C)focus on technical controls, since they are generally more important than physical and administrative controls.
D)ensure that they address all categories of Brown's risk taxonomy.

Question 43

COBIT's enablers include people, skills and competencies.Personal competencies needed by accounting professionals include:

A)legal/regulatory perspective
B)measurement
C)professional demeanor
D)all of these

Question 44

According to ISACA, one of COBIT's enablers is required for keeping the organization running and well governed; that enabler is often the key product of the enterprise itself.It is therefore most closely related to which generic element of the accounting information system?

A)inputs
B)internal control
C)storage
D)outputs

Question 45

COBIT's enablers include "information." According to ISACA, information is very often the key product of the enterprise itself.Which of the following best exemplifies ISACA's explanation?

A)A CPA firm
B)A computer manufacturer
C)A textbook publisher
D)A college bookstore

Question 46

According to ISACA, one of COBIT's enablers is required for successful completion of all activities.Which of the following is most closely related to that enabler?

A)AICPA Core Competency framework
B)COSO internal control framework
C)COSO enterprise risk management framework
D)Capability Maturity Model

Question 47

COBIT's enablers include organizational structures.Based on ISACA's explanation, which of the following are most appropriately paired?

A)sales/collection process, vice president of marketing
B)conversion process, vice president of conversion
C)human resources process, payroll clerk
D)financing process, bank teller

Question 48

According to ISACA, one of COBIT's enablers is an organized set of practices and activities to achieve certain objectives.That enabler is most closely related to:

A)the steps in the accounting cycle
B)Brown's risk taxonomy
C)Carter's taxonomy
D)none of these

Question 49

COBIT's principles include the need to separate governance from management.Based on Carter's taxonomy, which types of computer crime are most likely to occur if governance and management are not separated?

A)target and instrumentality
B)incidental and associated
C)target and associated
D)Cannot be determined from the information given

Question 50

COBIT's enablers include services, infrastructure and applications.Which of the following best pairs one of those with an example based on ISACA's explanation of the enabler?

A)services, payroll department
B)applications, software that calculates payroll amounts
C)Both services, payroll department and applications, software that calculates payroll amounts
D)Neither services, payroll department nor applications, software that calculates payroll amounts

Question 51

COBIT's enablers include organizational processes.Which of the following best pairs a common process with an output of the process?

A)conversion process, cost of production report
B)financing process, depreciation schedule for long-term bonds
C)Both conversion process, cost of production report and financing process, depreciation schedule for long-term bonds
D)Neither conversion process, cost of production report nor financing process, depreciation schedule for long-term bonds

Question 52

COBIT's enablers include principles, policies and frameworks.Which of the following provides the best example of that enabler based on ISACA's explanation?

A)a risk/control matrix
B)a comprehensive set of financial statements
C)a corporate tax return
D)all of these

Question 53

Carter suggested a four-part taxonomy for classifying computer crime.Which of the following contains elements that would help an accounting professional prevent one or more of the four types?

A)COBIT
B)AICPA Core Competencies framework
C)Both COBIT and AICPA Core Competencies framework
D)Neither COBIT nor AICPA Core Competencies framework

Question 54

Which of the following best pairs a COBIT enabler with a broad category of information technology controls?

A)processes, process controls
B)policies, administrative controls
C)behavior, behavioral controls
D)information, C-I-A triad controls

Question 55

According to COBIT 5, an organization's information technology governance and management should separate governance from management.In that context, examples of management include:

A)developing a comprehensive organizational budget.
B)deciding the dollar amount of an upcoming dividend.
C)Both developing a comprehensive organizational budget and deciding the dollar amount of an upcoming dividend.
D)Neither developing a comprehensive organizational budget nor deciding the dollar amount of an upcoming dividend.

Question 56

COBIT's enablers include people, skills and competencies.According to the AICPA, broad business perspective competencies needed by accounting professionals include:

A)legal and global
B)legal and measurement
C)global and measurement
D)legal, global and measurement

Question 57

COBIT's enablers include culture, ethics and behavior.Establishing an organizational culture that values honesty is least likely to prevent which of the following risks to information systems?

A)error
B)fraud
C)extortion
D)malicious processes

Question 58

Carter suggested a four-part taxonomy for classifying computer crime; COBIT identified a series of enablers to make the best possible use of information and information technology vis-à-vis the needs of organizational stakeholders.Which of the following pairs a COBIT enabler with an element of Carter's taxonomy?

A)Information and target, because the "target" category focuses on system information.
B)Instrumentality and processes, because the "instrumentality" category always involves at least two business processes.
C)Associated and principles/policies/frameworks, because the "associated" category involves comprising organizational policies.
D)All of these are good pairings of COBIT enablers and Carter categories.

Question 59

COBIT's enablers include culture, ethics and behavior.Which element of the COSO internal control framework is most closely related to that enabler?

A)control environment
B)control behaviors
C)behavioral environment
D)all of these

Question 60

COBIT's enablers include people, skills and competencies.Functional competencies needed by accounting professionals include:

A)legal/regulatory perspective
B)measurement
C)professional demeanor
D)all of these

Question 61

The chapter discussed eleven examples of risks and threats to information systems and seven enablers from the COBIT framework.Consider the items below, each of which pairs risk with an enabler; explain how the two are related.The first item is done as an example.
a.Fraud/Processes.Every organization should have a process in place for reporting suspected fraud.
b.Information theft/Information.
c.Malicious software/Services, infrastructure and applications.
d.Disclosure of confidential information/Culture, ethics and behavior.
e.Service interruptions and delays/Organizational structures.
f.Fraud/People, skills and competencies.

Question 62

The chapter discussed the four elements of Carter's taxonomy of computer crime and eleven business risks/threats to information systems.Classify each item below using each of them.

Question 63

In each statement that follows, circle the business risk or threat that most clearly applies based on the list provided in the text.
a.Disclosure of confidential information or intrusion: Employee data are made available on the Internet.
b.DOS attacks or extortion: Prevent computer systems from functioning in accordance with their intended purpose.
c.Error or web site defacement: Digital graffiti.
d.Fraud or error: Losses can vary widely depending on where the problem originated.
e.Information theft or information manipulation: An employee creates fake refunds to benefit a family member.
f.Intrusion or extortion: Main objective is to gain access to a network.
g.Intrusion or service interruption: Classified as accidental, willful neglect or malicious behavior.
h.Malicious software or information theft: Logic bombs, replicating worm, Trojan horse.
i.Service interruption or disclosure of confidential information: Can lead to missed deadlines for receivables or payables.
j.Web site defacement or extortion: Criminal contacts an organization after successfully stealing information.

Question 64

For each IT control listed below, indicate the group which most clearly applies: (a) physical security control, (b) technical security control or (c) administrative security control.1.Audible alarm when a computer detects a virus-infected e-mail attachment
2.Conflict of interest policy
3.Different passwords for each ERP module
4.Filing cabinets requiring keys
5.Fire suppression systems
6.Keystroke monitoring software
7.Locking compartments in desks
8.Log-ins requiring fingerprint identification
9.Mandatory password rotation
10.Periodic internal audits

Question 65

The COBIT framework comprises five principles and seven enablers.In your own words, explain the relationship between each principle and enabler paired below; the first one is done as an example.
a.Meeting stakeholder needs/People, skills and competencies.People inside and outside the organization are stakeholders.
b.Covering the enterprise end-to-end/Processes.
c.Applying a single integrated framework/Principles, policies and frameworks.
d.Enabling a holistic approach/Information.
e.Separating governance from management/Culture, ethics and behavior.
f.Meeting stakeholder needs/Processes.

Question 66

List the elements of Carter's taxonomy of computer crime.

Question 67

Which element of Carter's taxonomy of computer crime is associated with each item below?
a.Computer is not required for the crime but is related to the criminal act
b.Computer is used to commit the crime
c.Computer use may make a crime more difficult to trace
d.Growth of the Internet creates new ways of reaching victims
e.Objective is to impact the confidentiality, availability and/or integrity of data
f.Presence of computers has generated new versions of fairly traditional crimes
g.Targets the system or its data
h.Technological growth creates new crime targets
i.Use of the computer simplifies criminal actions
j.Uses the computer to further a criminal end

Question 68

Fill in the blanks below according to the principles and enablers of the COBIT framework.
a.___, policies and frameworks.
b.Applying a ___.
c.Covering the enterprise ___.
d.Culture, ___ and behavior.
e.Enabling a ___ approach.
f.Meeting ___ needs.
g.Organizational ___.
h.People, ___ and ___.
i.Separating ___ from ___.
j.Services, infrastructure and ___.

Question 69

Ethan is an information technology security consultant.He has been asked to speak to a local professional organization about ways to strengthen internal controls against computer crime, and wants to relate his comments to the COBIT framework.Prepare a short summary of the key points Ethan should make in his presentation; ensure that each one has a clear relationship to the COBIT framework.

Question 70

Information technology controls can be classified as physical, technical or administrative.Consider each independent situation below; suggest one control from the indicated classification that would address (prevent/detect/correct) the risk.a) A bank's customer database is hacked.Administrative: _____________________________________________
b) A careless employee spills coffee on a network server.Physical: _____________________________________________
c) A corporation's sales data are manipulated by a member of the sales staff.Technical: _____________________________________________
d) A former employee introduces a logic bomb to a company's payroll system.Administrative: _____________________________________________
e) A political candidate's web site is defaced.Technical: _____________________________________________
f) A senior citizen sends money to a fake religious organization based on a fraudulent e-mail.Administrative: _____________________________________________
g) A waitress steals a customer's credit card number.Physical: _____________________________________________
h) An employee uses work time to shop online using the company's computer.Administrative: _____________________________________________
i) Corporate spies steal research and development information.Technical: _____________________________________________
j) Fake compromising photos of a corporate CEO are posted to a social networking site.Technical: _____________________________________________

Question 71

The CoBIT framework can be used to strengthen internal controls against computer crime in various ways.Indicate whether each statement below is (a) always true, (b) sometimes true or (c) never true.1.As a form of internal control, each step of the systems development life cycle focuses on one of CoBIT's enablers.2.CoBIT can be used in conjunction with the COSO internal control framework to identify appropriate control activities.3.CoBIT's principles provide detailed standards for evaluating information inputs and outputs that can help strengthen internal control.4.As defined in CoBIT, organizational stakeholders include management and employees.5.The COSO enterprise risk management framework requires the use of CoBIT to identify risks.

Question 72

A private university maintains sensitive information about its donors in both a paper file and an electronic database.Using the three-part control taxonomy discussed in the chapter, identify and describe two controls in each category that should be implemented to prevent/detect/correct the risk that such information might be compromised.