Flashcards
IS test 3
Flashcards do conjunto (77)
- 1risk assessmentdetermines level of risk to the firm if specific activity or process is not properly controlled
- 2security policyranks information risks, identifies acceptable security goals, and identifies mechanisms for achieving these goals
- 3acceptable use policy (AUP)defines acceptable uses of firm's information resources and computing equipment
- 4authorization policiesdetermine differing levels of user access to information assets
- 5disaster recovery planningdevises plans for restoration of disrupted services
- 6backupcopies of critical systems and data, done on a regular basis
- 7hot siteseparate and fully equipped facility where the firm can move immediately after a disaster and resume business
- 8cold siteseparate facility without any computer equipment but is a place employees can move after a disaster
- 9business continuity planningfocuses on restoring business operations after disaster
- 10MIS auditexamines firm's overall security environment as well as controls governing individual information systems
- 11identity management systemssupport the organization's security and authorization policies
-include business processes and technologies for identifying valid users of systems - 12authenticationthe ability to know that a person is who he or she claims to be; a method of confirming users' identities.
- 13authorizationdetermines what actions, rights, or privileges the user has, based on the verified identity
- 14common types of access controlsuser IDs, cognitive passwords, security profile, token/security token, smart card, biometrics, terminal resource security
- 15passwordcombination of numbers, characters, and symbols that's entered to allow access to a system
- 16passphraseseries of characters that is longer than a password but is still easy to memorize
- 17cognitive passwordrequires a user to answer a question to verify their identity; commonly used as a form of secondary access
- 18security profilea unique picture and descriptive phrase chosen by you to verify that you are on a legitimate site
- 19tokena small device to change user passwords automatically
- 20smart carda device about the same size as a credit card, containing a chip formatted with access permission and other data-a reader device interprets the data on the card and allows or denies access
- 21terminal resource securitysoftware feature that erases the screen and signs of user off automatically after a specified length of activity
- 22biometricssystems that read and interpret individual human traits to enhance security measures – are unique to a person and can’t be stolen or lost; may be physical or behavioral
- 23firewall-Combination of hardware and software that controls the flow of incoming and outgoing network traffic
-Combination of hardware and software that controls the flow of incoming and outgoing network traffic - 24intrusion detection systems-Monitor hot spots on corporate networks to detect and deter intruders.
-Examine events as they are happening to discover attacks in progress - 25antivirus and antispyware softwareCheck computers for presence of malware and can often eliminate it as well.
- 26(UTM) unified threat management systemsCombination of security tools including firewalls, intrusion detection systems, VPN’s, web content filtering, and anti-spam SW
- 27encryptionProcess of encoding messages before they enter the network & then decoding at the receiving end
- 28two methods of encryption1.symmetric key encryption
2.public key encryption - 29symmetric key encryptionsender and receiver use single,shared key
- 30public key encryption-uses two, mathematically related keys: public key and private key
-sender encrypts message with recipients' public key
-recipient decrypts with private key - 31two methods/protocols for encryption on networks1. secure sockets layer (SSL)
2. Transport layer security (TLS) - 32TLSenable client and server computers to manage encryption and decryption activities as they communicate with each other during a secure web session; establish a secure connection between two computers
- 33S-HTTP (secure hypertext transfer protocol)is limited to individual messages
- 34digital certificate-Data file or electronic document used to establish the identity of users and electronic assets for protection of online transactions
-Uses a trusted third party, Certificate Authority (CA), to validate a user’s identity - 35fault tolerant computer systemsContain redundant hardware, software, and power supply components that create an environment that provides continuous, uninterrupted service
- 36high-availability computing-Helps recover quickly from crash
-Minimizes, does not eliminate, downtime - 37DPI (deep packet inspection)Sorts out low-priority online material (music and video downloads) while assigning a higher priority to business-critical files and data
- 38cloud computingAccountability and responsibility for privacy and security reside with the Cloud user, although the Cloud provider is actually doing the hosting ...
- 39mobile computing devicemust be secured like other in-house, non-mobile resources against malware, theft, accidental loss, unauthorized access, and hacking attempts
- 40software metricsobjective assessments of a system in the form of quantified measurements, such as: number of transactions processed per min, online response time, etc.
- 41walkthroughreview of specification or design documents by a group of qualified people
- 42debuggingprocess by which errors are discovered and eliminated
- 43WEPinitial security standard for 802.11- use is optional- users often fail to use its security features.
- 44MalwareSW written with malicious intent to cause annoyance or damage to a computer system or network
- 45virusesrogue software program that attaches itself to other software programs or data files in order to be executed
- 46worms-independent programs that copy themselves from one computer to others over a network
-do not have to be attached to a host program - 47Trojan horse-software program that appears to be benign but then does something other than expected
-contains code intended to disrupt a computer network, or website
-malicious code hides inside a popular program or a program that appears useful - 48SQL injection attackstake advantage of vulnerabilities in poorly coded web application SW to introduce malicious program code into a company's systems and networks
- 49spywaresw that secretly gathers information about users while they browse the web; can come hidden in free downloads and tracks online movements, mines the info stored on a computer, or uses the computer's
- 50keyloggersmonitor and record keystrokes and mouse clicks
- 51spoofing-misrepresenting oneself by using fake e-mail addresses or masquerading as someone else
-may involve forging return address of email so it appears to be from someone else. - 52sniffer-type of eavesdropping program that monitors information traveling over a network
-SW used to capture and record network traffic - 53DoS (denial of service attacks)floods a network server or web server with thousands of false service requests to crash the network
- 54DDoS (distributed denial of service attack)hundreds of thousands of computers work together to bombard a website with thousands of requests for information in a short period
- 55botnetsnetworks of "zombie" PC's infiltrated by bot malware
- 56phishinga high tech scam in which an email requests the update or confirmation of sensitive personal information by masquerading as a legitimate request/website
- 57pharminga type of phishing technique that redirects users to a bogus web page, even when an individual types correct web page address into his or her browser
- 58evil twinsa type of phishing technique where wireless networks that pretend to offer trustworthy wi-fi connections to the internet
- 59insiderslegitimate users who purposely or accidentally misuse their access to info or resources and cause some kind of business-affecting event
- 60hackerspeople very knowledgeable about computers who use their skill to gain unauthorized access to a computer system
- 61patchessmall pieces of software to be released by a SW vendor to repair flaws
- 62gramm-leach-biley actrequires financial institutions to ensure the security and confidentiality of customer data
- 63sarbanes-oxley actimposes responsibility on companies and their management to safeguard the accuracy and integrity of financial information that is used internally and released externally
- 64computer forensicsscientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law
- 65general controlsgovern, design, security, and use of computer programs and security of data files in general throughout organization's information technoogy infrastructure
- 66application controlsspecific controls unique to each computerized application, such as payroll or order processing
include:-input controls
-processing controls
-output controls - 67Securitypolicies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems
- 68Controlsmethods, policies, and organizational procedures that ensure safety of organization's assets; accuracy and reliability of its accounting records;and operational adherence to mgt standards
- 69Computer crime/fraud"any violations of criminal law that involve a knowledge of computer technology for their perpetration, investigation, or prosecution"
- 70Identity Theft-a crime in which an imposter obtains key pieces of personal information to impersonate someone else
-the forging of someone's identity for the purpose of fraud - 71Click fraudoccurs when an individual or computer program fraudulently clicks on an online ad without any intention of learning more about the advertiser or making a purchase
- 72Why systems are vulnerable-hardware problems
-software problems
-disasters
-user error or unauthorized access
-use of networks and computers outside of firm's control - 73hardware problemsbreakdowns, configuration errors, damage from improper use of crime, theft of devices
- 74Software problemsprogramming errors, installation errors, unauthorized chnages
- 75disasterspower failures, flood, fires, others...
- 76War drivingeavesdroppers drive by buildings and try to intercept network traffic
- 77Rogue access pointaccess point on a different channel in a close physical location to force a users radio network interface controller to associate with the rogue access point instead of the official one
Informações
- Descrição
- FlashCards sobre IS test 3, criado por ashleo92 em 11-04-2013.
- Criado por
- ashleo92 · abr 2013
- Atualizado
- 13 mai 2016
- Visualizações
- 103
- Avaliação