Karteikarten
ACCESS CONTROLS
Karten in diesem Stapel (15)
- 1Effective Operating Controls- Protect against the tamering of users
- prevent users from tampering with the programs of other users
- safeguard users applications from accidental corruption
- safeguard its own program from accidental corruption
- protect itself from power failures and disasters - 2ACCESS APPLICATION CONTROLS- Applies to Specific Systems
- Supports management or independent controls
- can be procedural or automated
- 3PASSWORD CRACKING METHODSRandom trials – haphazard, low chance but easier
Dictionary attacks – try scrambling the common names and all dictionary words
Brute force – try scrambling all possible combinations of characters, most time consuming
Systematic deduction – try name followed by month, etc. - 4PASSWORD STRENGTH- An 8-letter password is 676 times stronger than a 6-letter password.
- A 6-character alphanumeric password is 6 times stronger than a 6-letter password
- A completely random 8-character alphanumeric is virtually uncrackable with a modern PC, takes about 1 year
- 5OPERATING SYSTEM SECURITY- Use a standard checklist for configuration
- Locks down workstation access by employees to prevent unauthorized installation of software
- Use scanning software to detect vulnerabilities before implementation and periodically
- Use automated patching tools to install security fixes.
- 6FIREWALL- Firewall should not be remotely administerable in order to reduce the risk of hacking.
- Firewall logs should be reviewed frequently to avoid the log getting full and firewall collapsing.
- 7VIRUS PROTECTION- All critical servers are protected
- All internet email is scanned
- Automated identification of workstations that do not have up-to-date signature files
- Organizations should block common virus file types to be proactive
- 8INTRUSION DETECTION SOFTWAREScreens traffic that passes a firewall to build pattern.
Alerts security administrator of questionable or unacceptable pattern.
- 9INTRUSION PREVENTION- Screens traffic that passes a firewall to build pattern.
Rejects highly questionable or unacceptable traffic.
- 10DIGITAL SIGNATUREA digital code attached to an electronically transmitted message that is used to verify the origin and contents of a message
- 11DIGITAL CERTIFICATEData files used to establish the identity of users and electronic assets for protection of online transactions.
- 12ENCRYPTION LIMITATIONS1. If key is lost data cannot be decrypted
2. rogue parties can delete encrypted file without knowing
3. encrypted email attachments usually deleted by anti-virus
- 13HOW TO TEST CONTROLS1. Review procedures and policies.
2. test system configuration, user access and user profiles.
3. test anti-virus, firewall, intrusion detection/prevention systems - 14ENCRYPTION STRENGTH1. depends on length of key
2. secrecy of key
3. rigour of algorithm
- 15EBUSINESS ENCRYPTION- Uses both symmetric keys and asymmetric keys
- Enforced by the merchant
- Merchant sends its certificate and public key to the browser
Informationen
- Beschreibung
- Karteikarten am ACCESS CONTROLS, erstellt von umar.mehmood am 18/04/2015.
- Erstellt von
- umar.mehmood
- Aufrufe
- 1
- Tags
- Bewertung