Deck 17: Information Security: Barbarians at the Gateway and Just About Everywhere Else

Question 1

A protester seeking to make a political point by leveraging technology tools, often through system infiltration, defacement, or damage is called a(n) _____.

A) activist
B) cyber agitator
C) hacktivist
D) ethical hacker
E) cybersquatter

Answer 1

C

Question 2

Hordes of surreptitiously infiltrated computers, linked and controlled remotely, are known as zombie networks or:

A) honeypots.
B) zombots.
C) botnets.
D) blacklists.
E) megabots.

Answer 2

C

Question 3

Describe some of the factors at work that enabled the Target security breach to occur.

Answer 3

Security software notification went off shortly after unauthorized software began collecting data inside Target's network, but Target ignored the warning. While the area where credit card transactions are processed is supposed to be walled off from other areas of the Target network, hackers found holes and eventually nestled their code in a sweet spot for grabbing customer data, disguising the code with the label "BladeLogic" the name of a legitimate data center management product. The firm's security software has an option to automatically delete malware as it's detected but Target's security team had turned that function off.

Question 4

Many U.S. technology firms believe that U.S. government surveillance techniques put them at a disadvantage relative to foreign firms because:

A) some customers have begun seeking alternative products and services untarnished by the perception of having (complicity or unwittingly) provided private information to authorities.
B) the cost to include government surveillance technology inside their products is expensive and lowers profits compared to rivals.
C) the government-required installations of software, such as Stuxnet, that U.S. tech firms must comply with inevitably take up valuable storage space, adding cost to industrial and commercial products.
D) the cost to house government workers on-site is a burden private corporations should not have to shoulder.
E) firms in foreign governments are directly contracted to perform surveillance, and are compensated for their efforts with perks and tax breaks, while U.S. firms receive no such compensation.

Question 5

A research scientist with a major pharmaceutical firm in New Jersey is caught passing on sensitive information, worth millions of dollars, regarding the composition and test results of his firm's latest drug to a rival company. What crime is he being held responsible for?

A) Cyber-fraud
B) Corporate espionage
C) Carrying out technology disruptions
D) Extortion
E) Illegal funds transfer

Question 6

The term _____ originally referred to a particularly skilled programmer.

A) data harvester
B) cracke
C) hacker
D) black hat
E) hacktivist

Question 7

Almost all security breaches can be traced back to technology lapses; personnel or procedural factors rarely factor in.

Question 8

Which of the following is a valid statement on information security?

A) Security breaches cannot be prevented despite the adoption of the best security policies.
B) Technology lapses are solely responsible for almost all security breaches.
C) Information security is everybody's responsibility.
D) Greater expenditure on security products is the only way to contain security breaches.
E) A reactive, rather than proactive, approach is better suited for dealing with security breaches.

Question 9

A black hat hacker looks for weaknesses in security mechanisms, with a view to help plug the holes that might be exploited by cyber-criminals.

Question 10

An attack on the US power grid by terrorists or a foreign power is indicative of:

A) DDoS attacks.
B) espionage.
C) cyberwarfare.
D) extortion.
E) phishing.

Question 11

A vast majority of security breaches are not preventable and happen despite the best security practices.

Question 12

Hackers might infiltrate computer systems to enlist hardware for subsequent illegal acts.

Question 13

What are some of the key managerial takeaways from the Target security breach?

Question 14

Several surprising findings were revealed in the wake of the Target breach, providing a cautionary tale for all executives and security professionals. Which of the following was not thought to have occurred during the Target security breach?

A) Target had security software, but the notification alerts from the software were ignored.
B) Target had properly installed and configured its security software, but hackers got in, anyway.
C) Credit card databases were on entirely separate systems, not connected to other parts of the firm's information system, but wireless networking allowed hackers to access anything reachable from a cell phone connection.
D) Target regularly monitored file names and matched them to file sizes and archival copies to ensure that software was not installed on their systems using the names of legitimate products, but hackers saved files with blank file names so they wouldn't be detected.
E) All of the above

Question 15

Organized crime networks now have their own R&D labs and are engaged in sophisticated development efforts to piece together methods to thwart current security measures.

Question 16

Which of the following statements is consistent with ground realities regarding information security?

A) Cyber-crime is not yet considered a serious enough threat to warrant the attention of law-enforcement agencies.
B) Law-enforcement agencies are well-resourced to fight cyber-crimes effectively.
C) Governments usually outmatch private industry in terms of retaining top talent with incentives and generous pay.
D) Law-enforcement agencies struggle to hire, train, and retain staff capable of keeping pace with today's cyber-criminals.
E) Cyber-crime is not rewarding in terms of financial gain.

Question 17

Cyber criminals who infiltrate systems and collect data for illegal resale are called _____.

A) cash-out fraudsters
B) data harvesters
C) corporate spies
D) ethical hackers
E) information hoarders

Question 18

Which of these would be an example of a DDoS attack?

A) An extortion attempt where hackers threaten to reveal names and social security information stolen from medical records databases
B) Overloading a popular social networking site with inbound messages in order to shut down access to the site
C) Launching a targeted phishing campaign on a department of defense or other surveilance network.
D) Stealing proprietary data directly from mobile phones using a distributed network of difficult-to-trace online services.
E) Launching tough-to-track click-fraud efforts

Question 19

Which of the followings aspects of international law would enable a cyber-criminal operating across borders to evade prosecution?

A) Lack of technology to identify the origin of a security attack
B) Non-recognition of commission of a security-related crime
C) Unwillingness of developed countries to share technical know-how with lesser-developed countries
D) Non-existent extradition agreements between two countries
E) Technological incompatibility between the two countries

Question 20

A(n) _____ is someone who uncovers computer weaknesses and reveals them to manufacturers or system owners, without exploiting these vulnerabilities.

A) hacktivist
B) data harvester
C) corporate spy
D) white hat hacker
E) ethical cyber criminal

Question 21

The topic of U.S. government surveilance continues to be hotly debated, with strong opinions in favor of surveilance programs, as well as vocal protestations of government overreach. Briefly give the argument for and against U.S. government surveilance practices.

Question 22

The information systems of several firms have been compromised by insiders that can include contract employees, cleaning staff, and temporary staffers.

Question 23

The virtual shutdown of websites by way of overloading them with seemingly legitimate requests sent simultaneously from thousands of machines is termed as _____ attacks.

Question 24

Two-factor authentication is favored for most security situations since it's considered to be fast and conveient for customres.

Question 25

It's bad when a firm's e-mail and password file is stolen; however the impact is minimized because user passwords set up for one system cannot be used on others.

Question 26

What are botnets and how are criminals using this technology?

Question 27

_____, probably the most notorious known act of cyberwarfare effort to date (one expert called it "the most sophisticated worm ever created"), is suspected to have been launched by either U.S. or Israeli intelligence (or both), and it infiltrated Iranian nuclear facilities and reprogrammed the industrial control software operating hundreds of uranium-enriching centrifuges.

Question 28

URL-shortening services such as bit.ly limit the impact of phishing posts since the shortened URL will clearly reveal the destination arrived at when clicked on.

Question 29

Dumpster diving refers to physically trawling through trash to mine any valuable data or insights that can be stolen or used in a security attack.

Question 30

Challenge questions offered by Web sites to automate password distribution and resets are formidable in protecting the privacy of email accounts.

Question 31

Web sites of reputed companies can also be sources of malware.

Question 32

Former CIA employee and NSA contractor, ____________ is seen by many as either a whistle-blowing hero or a traitorous villain. This person gathered sensitive digital documents from U.S., British, and Australian agencies, and leaked them to the press, exposing the extent of government surveillance efforts.

Question 33

One of the reasons one should be careful about clicking on any URL in an e-mail is that hackers can easily embed a redirection in e-mail links, reroutiing a user to an alternate online destination.

Question 34

According to research firm Gartner, the majority of loss-causing security incidents involve the handiwork of international cyber-criminal gangs.

Question 35

Worms require an executable (a running program) to spread, attaching to other executables.

Question 36

Social networking sites such as Facebook and LinkedIn form valuable sources of vital information that can be used to craft a scam by con artists.

Question 37

In public-key encryption systems, the functions of the public and private keys are interchangeable.

Question 38

Because of Moore's Law, widely-used encryption programs currently employed by banks and ecommerce sites are now easily penetrated by brute-force attacks that can be employed by hackers using just a handful of simple desktop computers.

Question 39

Spear phishing attacks specifically target a given organization or group of users.

Question 40

_____ refers to a term that either means breaking into a computer system or a particularly clever solution.

Question 41

Attacks that are so new that they have not been clearly identified, and so have not made it into security screening systems are called _____.

A) novel attacks
B) first mover attacks
C) non-precedent breaches
D) zero-day exploits
E) brute force attacks

Question 42

The e-mail password of a senior employee in an organization was compromised by someone observing this user as the employee accessed his account. This is most likely a case of:

A) keylogging.
B) shoulder surfing.
C) dumpster diving.
D) screen capture.
E) spyware.

Question 43

The phrase __________________ refers to security schemes that automatically send one-time use representations of a credit card that can be received and processed by banking and transaction firms at the time of payment. They are in use in ApplePay and Android Wallet.

Question 44

Technologies that measure and analyze human body characteristics for identification or authentication are known as _____.

A) overlamination processes
B) biometrics
C) smart tags
D) bio-embedded systems
E) holographs

Question 45

Attacks that exhaust all possible password combinations in order to break into an account are called _____ attacks.

A) strong arm
B) permuted
C) brute-force
D) zero-day
E) infinity

Question 46

_____ can be either software-based or deployed via hardware, such as a recording "dongle" that is plugged in between a keyboard and a PC.

A) Shadow-keyboards
B) Bootloggers
C) KitRoots
D) Keyloggers
E) Adwares

Question 47

Which of the following statements holds true for the term spoof?

A) It refers to a con executed using technology, typically targeted at acquiring sensitive information or tricking someone into installing malicious software.
B) It refers to e-mail transmissions and packets that have been altered to seem as if they came from another source.
C) It refers to scrambling data using a code or formula, known as a cipher, such that it is hidden from those who do not have the unlocking key.
D) It refers to a seemingly tempting, but bogus target meant to draw hacking attempts.
E) It refers to highly restrictive programs that permit communication only with approved entities and/or in an approved manner.

Question 48

One of the major problems with the Heartbleed bug in OpenSSL software is that:

A) the software was embedded in many hardware products that could not be easily patched with automatic software updates.
B) any password typed into a CAPTCHA could be monitored by a Van Eck device.
C) social engineers could exploit the bug through SQL injection.
D) all social media profile data was exposed, giving hackers access to the potential answers many firms ask as part of password security questions.
E) it eliminated the ability to expose a URL's desitination by hoving the cursor over an address.

Question 49

Describe briefly a few of the physical threats posed by hackers to information security with examples for each.

Question 50

Sifting through trash in an effort to uncover valuable data or insights that can be stolen or used to launch a security attack is known as:

A) trash recovery.
B) junk exploring.
C) dumpster diving.
D) scrap sifting.
E) data sieving.

Question 51

Some of the most common guidelines issued by Web sites when designing a secure password include:

A) The password should be at least eight characters long and include at least one number and other nonalphabet character.
B) The password should be short and straightforward.
C) The password should include names of family members or pets, so as to be easily remembered.
D) Choose a hard-to-guess password, then re-use this hardened password across websites. This minimize instances of calling systems professionals for a password reset, hence eliminating an additional potential vulnerability.
E) The password should be the same as your name so as to trick the hacker.

Question 52

Which of the following statements holds true for the term encryption?

A) It refers to a con executed using technology, typically targeted at acquiring sensitive information or tricking someone into installing malicious software.
B) It refers to e-mail transmissions and packets that have been altered to seem as if they came from another source.
C) It refers to scrambling data using a code or formula, known as a cipher, such that it is hidden from those who do not have the unlocking key.
D) It refers to a seemingly tempting, but bogus target meant to draw hacking attempts.
E) It refers to highly restrictive programs that permit communication only with approved entities and/or in an approved manner.

Question 53

The phrase ______________ refers to security where identity is proven by presenting more than one item for proof of credentials. Multiple factors often include a password and some other identifier such as a unique code sent via e-mail or mobile phone text, a biometric reading (e.g. fingerprint or iris scan), a swipe or tap card, or other form if identification

Question 54

Computer systems are often infected with malware by means of exploits that sneak in masquerading as something they are not. These exploits are called:

A) rootkits.
B) trojans.
C) viruses.
D) worms.
E) honeypots.

Question 55

Briefly explain the steps one should take to ensure that their highest priority accounts are not compromised easily by hackers.

Question 56

A bank customer receives a message, ostensibly from the bank's Web site, asking her to provide her login information. Assuming the message is intended to defraud the customer, what type of infiltration technique is being used here?

A) Spyware
B) Malware
C) Social engineering
D) Phishing
E) Virus infections

Question 57

Which of the following are considered sources of information that can potentially be used by social engineers?

A) LinkedIn
B) Corproate directories
C) Social media posts
D) Contests or surveys
E) All of the above

Question 58

The use of public wireless connections can increase a user's vulnerability to monitoring and compromise. ____________ software can be used to encrypt transmissions over public networks, making it more difficult for a user's PC to be penetrated.

A) DDos
B) Rootkit
C) Keylogging
D) CAPTCHa
E) VPN

Question 59

Which of the following types of infiltration techniques does one open up to by posting sensitive personal information and details about one's workplace on social networking sites?

A) Phishing
B) Social engineering
C) Password theft
D) Virus infections
E) Physical threats

Question 60

Viruses are programs that infect other software or files and require:

A) a large file size to spread.
B) the computer to be shutdown to spread.
C) Windows as an operating system to spread.
D) a disk based operating system to spread.
E) an executable program to spread.

Question 61

Updates that plug existing holes in a software are called:

A) patches.
B) compliance.
C) maculations.
D) keys.
E) dongles.

Question 62

The term ISO 27000 refers to a series of standards representing the set of best practices for implementing, maintaining and improving organizational security.

Question 63

Fingerprint readers, retina scanners, voice and face recognition technologies are all part of _____.

Question 64

_____________ refers to malware that encrypts a user's files (perhaps threatening to delete them), with demands that a user pay to regain control of their data and/or device.

Question 65

One of the reasons organizations delay patches to plug holes in their security applications is:

A) the rising cost of labor.
B) lack of information on effectiveness of patches.
C) the fear that the new technology contains a change that will cause problems down the road.
D) redundancy of patches within a short span of time.
E) bureaucratic inefficiency.

Question 66

_____ refers to a trusted third party that provides authentication services in public key encryption schemes.

Question 67

Hardware failure is the least likely of threats to one's data.

Question 68

Multiple administrators jointly controlling key systems are an unnecessary burden that adds to the complexity of managing security in an organization.

Question 69

Information security policies would be ineffective without _____ and _____.

A) audit; enforcement
B) accountability; flexibility
C) compliance; subjectivity
D) protocols; the backing of ISO
E) rigidity; adaptability

Question 70

Conforming to industry-standard guidelines and frameworks for organizational security ensures continued immunity from attacks on an organization's information.

Question 71

When using a public wireless network, using VPN software is not advisable as it can reveal your communications to any network eavesdroppers.

Question 72

Online backup services are considered a poor choice for end-users, since this only increases the liklihood that an individual's data will be hacked.

Question 73

_____ refers to confidence scams executed through technology.

Question 74

_____ are scrambled character images used to thwart things like automated account setup or ticket buying.

Question 75

Regularly updated software lowers a system's vulnerable attack surface.

Question 76

A team working on organizational security should include representatives from general counsel, audit, public relations, and human resources, in addition to those from specialized security and broader technology and infrastructure functions.

Question 77

Public wireless networks are often vulnerable to monitoring and attack. The use of _______ software can limit threats by encrypting network transmissions over a network.

Question 78

Con games that trick employees into revealing information or performing other tasks that compromise a firm are known as _____ in security circles.

Question 79

In security circles the phrase "compliance" refers to:

A) legal or professionally binding steps that an organization must take.
B) security audit practices used by the tech divisions of Big Four accounting firms.
C) a firm's installing software to fulfill government surveillance requirements.
D) the U.S. government legislation requiring organizations to share security breaches with law enforcement and industry trade organizations.
E) only deploying open source software that is downloaded from approved GitHub locations.

Question 80

The _____ technique zeros in on a sloppy programming practice where software developers don't validate user input.