Deck 14: Information Security: Barbarians at the Gateway and Just About Everywhere Else

Question 1

A black hat hacker looks for weaknesses in security mechanisms, with a view to help plug the holes that might be exploited by cyber-criminals.

Answer 1

False

Question 2

Organized crime networks now have their own R&D labs and are engaged in sophisticated development efforts to piece together methods to thwart current security measures.

Answer 2

True

Question 3

A protester seeking to make a political point by leveraging technology tools, often through system infiltration, defacement, or damage is called a(n) _____.

A) activist
B) cyber agitator
C) hacktivist
D) ethical hacker
E) cybersquatter

Answer 3

C

Question 4

Almost all security breaches can be traced back to technology lapses; personnel or procedural factors rarely factor in.

Question 5

Hackers might infiltrate computer systems to enlist hardware for subsequent illegal acts.

Question 6

A(n) _____ is someone who uncovers computer weaknesses without exploiting them.

A) hacktivist
B) data harvester
C) corporate spy
D) white hat hacker
E) ethical cyber criminal

Question 7

It should be evident from the TJX example that:

A) security breaches are not as damaging to companies as other crimes are.
B) industry guidelines for information security are not suitable for everyone and should be made optional.
C) information security must be a top organizational priority.
D) skimping on liability insurance to cover for financial losses from security breaches is not advisable.
E) with a little effort and resources, it is possible to make any security system hundred percent foolproof.

Question 8

Which of the followings aspects of international law would enable a cyber-criminal operating across borders to evade prosecution?

A) Lack of technology to identify the origin of a security attack
B) Non-recognition of commission of a security-related crime
C) Unwillingness of developed countries to share technical know-how with lesser-developed countries
D) Non-existent extradition agreements between two countries
E) Technological incompatibility between the two countries

Question 9

Which of the following statements is consistent with ground realities regarding information security?

A) Cyber-crime is not yet considered a serious enough threat to warrant the attention of law-enforcement agencies.
B) Law-enforcement agencies are well-resourced to fight cyber-crimes effectively.
C) Governments usually outmatch private industry in terms of retaining top talent with incentives and generous pay.
D) Law-enforcement agencies employ technically inept employees who are incapable of keeping pace with today's cyber-criminals.
E) Cyber-crime is not rewarding in terms of financial gain.

Question 10

A vast majority of security breaches are not preventable and happen despite the best security practices.

Question 11

Cyber criminals who infiltrate systems and collect data for illegal resale are called cash-out fraudsters.

Question 12

Which of the following is a valid statement on information security?

A) Security breaches cannot be prevented despite the adoption of the best security policies.
B) Technology lapses are solely responsible for almost all security breaches.
C) Information security is everybody's responsibility.
D) Greater expenditure on security products is the only way to contain security breaches.
E) A reactive, rather than proactive, approach is better suited for dealing with security breaches.

Question 13

The term _____ originally referred to a particularly skilled programmer.

A) data harvester
B) cracke
C) hacker
D) black hat
E) hacktivist

Question 14

What are some of the key lessons to be learned from the TJX security breach?

Question 15

Hordes of surreptitiously infiltrated computers, linked and controlled remotely, are known as zombie networks or:

A) honeypots.
B) zombots.
C) botnets.
D) blacklists.
E) megabots.

Question 16

An attack on the US power grid by terrorists or a foreign power is indicative of:

A) DDoS attacks.
B) espionage.
C) cyberwarfare.
D) extortion.
E) phishing.

Question 17

Which of these is most representative of a DDoS attack?

A) Threatening to reveal names and social security information stolen from medical records databases
B) Crashing a popular social networking site to restrict access to information
C) Hijacking a power generation unit capable of serving an entire city
D) Stealing proprietary data on products worth several millions of dollars
E) Launching tough-to-track click-fraud efforts

Question 18

Cyber criminals who infiltrate systems and collect data for illegal resale are called _____.

A) cash-out fraudsters
B) data harvesters
C) corporate spies
D) ethical hackers
E) information hoarders

Question 19

A research scientist with a major pharmaceutical firm in New Jersey is caught passing on sensitive information, worth millions of dollars, regarding the composition and test results of his firm's latest drug to a rival company. What crime is he being held responsible for?

A) Cyber-fraud
B) Corporate espionage
C) Carrying out technology disruptions
D) Extortion
E) Illegal funds transfer

Question 20

The market for stolen data is stagnant and most hackers use stolen data like credit card numbers for personal use.

Question 21

Dumpster diving refers to physically trawling through trash to mine any valuable data or insights that can be stolen or used in a security attack.

Question 22

The typical Web user has 6.5 passwords, each of which is used at four sites, on average.

Question 23

Spear phishing attacks specifically target a given organization or group of users.

Question 24

Which of the following types of infiltration techniques does one open up to by posting sensitive personal information and details about one's workplace on social networking sites?

A) Phishing
B) Social engineering
C) Password theft
D) Virus infections
E) Physical threats

Question 25

_____ refers to a term that either means breaking into a computer system or a particularly clever solution.

Question 26

What security risk could be posed by a botnet large enough to hold a few million zombie computers?

A) Restricting communication between approved entities
B) Crippling a substantially sized network by withholding critical information like passwords
C) Organizing an underworld market dealing in trade of stolen information
D) Stealing critical information like social security numbers, or revenue records
E) Sending spam mail from thousands of difficult-to-shut-down accounts

Question 27

The information systems of several firms have been compromised by contract employees,cleaning staff, and temporary staffers.

Question 28

Even the best implemented encryption programs have not been immune to brute-force attacks by hackers.

Question 29

The virtual shutdown of websites by way of overloading them with seemingly legitimate requests sent simultaneously from thousands of machines is termed as _____ attacks.

Question 30

_____, probably the most notorious known act of cyberwarfare effort to date (one expert called it "the most sophisticated worm ever created"), is suspected to have been launched by either U.S. or Israeli intelligence (or both), and it infiltrated Iranian nuclear facilities and reprogrammed the industrial control software operating hundreds of uranium-enriching centrifuges.

Question 31

Offering financial or valuable incentives to gain information, access, or favors is a proven method used by social engineering experts.

Question 32

In public-key encryption systems, the functions of the public and private keys are interchangeable.

Question 33

Briefly explain the threat posed by botnets.

Question 34

Challenge questions offered by Web sites to automate password distribution and resets are formidable in protecting the privacy of email accounts.

Question 35

Worms require an executable (a running program) to spread, attaching to other executables.

Question 36

Social networking sites such as Facebook and LinkedIn form valuable sources of vital information that can be used to craft a scam by con artists.

Question 37

Which of the following best represents a method a social engineer might use to infiltrate a system?

A) Baiting someone to add, deny, or clarify information that can help an attacker
B) Posting rumors about an individual on a popular social networking site
C) Making prank calls to individuals
D) Stealing an individual's credit card information
E) Flooding an individual's mailbox with junkmail

Question 38

Web sites of reputed companies can also be sources of malware.

Question 39

According to research firm Gartner, the majority of loss-causing security incidents involve the handiwork of international cyber-criminal gangs.

Question 40

URL-shortening services such as bit.ly help expose the intention of phishing posts.

Question 41

Spyware is defined as a type of software that:

A) clogs up network traffic and disables networks.
B) monitors user actions or scans for files surreptitiously.
C) infects other software and decreases the network speeds.
D) serves up unwanted advertisements after being installed without user knowledge.
E) scans for loopholes in other software and releases malware payloads.

Question 42

A screen capture can be defined as a type of software that:

A) records keystrokes.
B) screens the computer for malware.
C) records pixels appearing on a user's screen.
D) captures images appearing on a screen.
E) serves up unwanted advertisements on users' screens.

Question 43

Which of the following measures can a firm undertake to counter the threat of an SQL injection?

A) Deploy a commercial software patch or other piece of security software that can protect the firm
B) Outsource the development of its Web site to an outside agency
C) Invalidate user input and train developers to rewrite the entire code
D) Meticulously check for integrity of Web sites and dig out weaknesses
E) Install SQL screening software and update it regularly

Question 44

A domain name service is a collection of software that:

A) allots domain names to different Web sites.
B) assigns IP addresses to different systems.
C) directs the flow of traffic across the Internet.
D) maintains a registry of different IP addresses.
E) maps an Internet address to an IP address.

Question 45

The e-mail password of a senior employee in an organization was compromised by someone looking over as the employee accessed his account. This is most likely a case of:

A) keylogging.
B) shoulder surfing.
C) dumpster diving.
D) screen capture.
E) spyware.

Question 46

Computer systems are often infected with malware by means of exploits that sneak in masquerading as something they are not. These exploits are called:

A) rootkits.
B) trojans.
C) viruses.
D) worms.
E) honeypots.

Question 47

Sifting through trash in an effort to uncover valuable data or insights that can be stolen or used to launch a security attack is known as:

A) trash recovery.
B) junk exploring.
C) dumpster diving.
D) scrap sifting.
E) data sieving.

Question 48

You have received an e-mail that looks suspiciously close to a phishing mail. What is the best course of action to be followed?

A) Click on the link in the mail
B) Click on the link in the mail and provide any information you are asked for
C) Do not click on any links, or download any enclosures
D) Click on the link and download the anti-virus software
E) Forward the mail to your colleagues

Question 49

Which weakness of Web sites to launch attacks does an SQL injection technique exploit?

A) Sloppy programming practices where software developers do not validate user input
B) Lack of in-built anti-virus features
C) Irregular auditing of Web site content
D) Ease of infiltrating the Web site
E) Non-employment of encryption techniques

Question 50

Which of the following actions should users take to protect themselves from security attacks?

A) Frequently upgrade their systems with the latest hardware available in the market
B) Use a universal password for all secure sites to avoid chances of forgetting different passwords
C) Use VPN software to encrypt transmission and hide from eavesdroppers
D) Use unrestricted folder sharing settings to maintain transparency
E) Use passwords that are random and more than 12 characters long to avoid easy guessing

Question 51

Some of the most common guidelines issued by Web sites when designing a secure password include:

A) The password should be at least eight characters long and include at least one number and other nonalphabet character.
B) The password should be short and straightforward.
C) The password should include names of family members or pets, so as to be easily remembered.
D) The password should be random and more than 12 characters long to avoid risk of being guessed by a hacker.
E) The password should be the same as your name so as to trick the hacker.

Question 52

Attacks that are so new that they have not been clearly identified, and so have not made it into security screening systems are called _____.

A) novel attacks
B) first mover attacks
C) non-precedent breaches
D) zero-day exploits
E) brute force attacks

Question 53

Attacks that exhaust all possible password combinations in order to break into an account are called _____ attacks.

A) strong arm
B) permuted
C) brute-force
D) zero-day
E) infinity

Question 54

A bank customer receives a message, ostensibly from the bank's Web site, asking her to provide her login information. Assuming the message is intended to defraud the customer, what type of infiltration technique is being used here?

A) Spyware
B) Malware
C) Social engineering
D) Phishing
E) Virus infections

Question 55

_____ can be either software-based or hardware, such as a recording "dongle" that is plugged in between a keyboard and a PC.

A) Shadow-keyboards
B) Bootloggers
C) Rootkits
D) Keyloggers
E) Adwares

Question 56

Technologies that measure and analyze human body characteristics for identification or authentication are known as _____.

A) overlamination processes
B) biometrics
C) smart tags
D) bio-embedded systems
E) holographs

Question 57

Briefly explain the steps one should take to ensure that their highest priority accounts are not compromised easily by hackers.

Question 58

Viruses are programs that infect other software or files and require:

A) a large file size to spread.
B) the computer to be shutdown to spread.
C) Windows as an operating system to spread.
D) a disk based operating system to spread.
E) an executable program to spread.

Question 59

Which of the following statements holds true for the term encryption?

A) It refers to a con executed using technology, typically targeted at acquiring sensitive information or tricking someone into installing malicious software.
B) It refers to e-mail transmissions and packets that have been altered to seem as if they came from another source.
C) It refers to scrambling data using a code or formula, known as a cipher, such that it is hidden from those who do not have the unlocking key.
D) It refers to a seemingly tempting, but bogus target meant to draw hacking attempts.
E) It refers to highly restrictive programs that permit communication only with approved entities and / or in an approved manner.

Question 60

Which of the following statements holds true for the term spoof?

A) It refers to a con executed using technology, typically targeted at acquiring sensitive information or tricking someone into installing malicious software.
B) It refers to e-mail transmissions and packets that have been altered to seem as if they came from another source.
C) It refers to scrambling data using a code or formula, known as a cipher, such that it is hidden from those who do not have the unlocking key.
D) It refers to a seemingly tempting, but bogus target meant to draw hacking attempts.
E) It refers to highly restrictive programs that permit communication only with approved entities and / or in an approved manner.

Question 61

Implementation of information security in an organization should essentially start with:

A) upgrading to the latest hardware and software available in the market.
B) researching and complying with the latest industry guidelines.
C) investing in the best infrastructure.
D) inventory-style auditing and risk assessment of threats.
E) employing a security consultant.

Question 62

Fingerprint readers, retina scanners, voice and face recognition technologies are all part of _____.

Question 63

The ISO 27000 series of evolving standards represent the set of best practices for developing and improving organizational security.

Question 64

Information security policies would be ineffective without _____ and _____.

A) audit; enforcement
B) accountability; flexibility
C) compliance; objectivity
D) regulation; transparency
E) consistency; adaptability

Question 65

An example of an exploit of unpatched vulnerability is:

A) DDoS attacks.
B) screen capture.
C) brute-force attacks.
D) spear phishing.
E) DNS cache poisoning.

Question 66

One of the reasons organizations delay patches to plug holes in their security applications is:

A) the rising cost of labor.
B) lack of information on effectiveness of patches.
C) the fear that the new technology contains a change that will cause problems down the road.
D) redundancy of patches within a short span of time.
E) bureaucratic inefficiency.

Question 67

_____ refers to a trusted third party that provides authentication services in public key encryption schemes.

Question 68

_____ refers to confidence scams executed through technology.

Question 69

Lobbying for legislation that imposes severe penalties on crooks can help lower adversary costs.

Question 70

_____ are scrambled character images used to thwart things like automated account setup or ticket buying.

Question 71

A security group's R&D function would be involved in:

A) the day-to-day monitoring of existing systems.
B) understanding emerging threats and reviewing, selecting, and implementing updated security techniques.
C) working on broader governance issues.
D) educating the organization on the need to improve information security.
E) hunting for and exposing organizational security weakness before hackers find them.

Question 72

Updates that plug existing holes in a software are called:

A) patches.
B) adware.
C) maculations.
D) keys.
E) cracks.

Question 73

Con games that trick employees into revealing information or performing other tasks that compromise a firm are known as _____ in security circles.

Question 74

Hardware failure is the least likely of threats to one's data.

Question 75

Describe briefly a few of the physical threats posed by hackers to information security with examples for each.

Question 76

Regularly updated software lowers a system's vulnerable attack surface.

Question 77

Multiple administrators jointly controlling key systems are an unnecessary burden that adds to the complexity of managing security in an organization.

Question 78

When using a public wireless network, using VPN software is not advisable as it can reveal your communications to any network eavesdroppers.

Question 79

Conforming to industry-standard guidelines and frameworks for organizational security ensures continued immunity from attacks on an organization's information.

Question 80

A team working on organizational security should include representatives from general counsel, audit, public relations, and human resources, in addition to those from specialized security and broader technology and infrastructure functions.