13 IT Software, Data, & Contingency Planning Flashcards
(107 cards)
1
Q
What is systems software?
A
Systems software performs the fundamental tasks needed to manage computer resources.
2
Q
What are the 3 most common pieces of systems software?
A
- Operating system - which is the “traffic cop” of any computer system. The operating system negotiates the conversation between the computer’s hardware, the application the user is running, and the data that the application is working with.
- Utility programs - perform basic functions that are not particular to a certain application, such as anti-virus, file management, and network utilities.
- Device driver programs - operate or control a particular type of device that is attached to the computer. Ex - a printer requires a printer driver to function.
3
Q
What is application software?
A
Programs designed to help people perform an activity that can manipulate text, numbers, graphics, or a combination of these elements. Ex - word processors, spreadsheets, graphics, and databases. Applications found on dedicated servers are payroll, human resources, purchasing, accounts payable, general ledger, treasury, etc.
4
Q
What is machine learning?
A
A form of artificial intelligence that enables computers, when exposed to new data, to learn, grow, change, and develop by themselves. The ability to adapt to new data by learning from previous computations and identifying trends in order to produce reliable results.
5
Q
What is a blockchain?
A
A type of digital database (or ledger) that provides proof of who owns what at any moment in time as each transaction has been added to the ledger. The ledger is encrypted, public, and distributed widely for anyone to view. Every transaction makes the ledger grow larger. It is an innovative technology that has the potential to revolutionize accounting.
6
Q
What is cryptocurrency?
A
Cryptocurrency is a digital asset designed to be a medium of exchange using cryptography (encryption) to secure the transactions, control the creation of additional units of the currency, and verify the transfer of funds. Bitcoin is a type of cryptocurrency.
7
Q
What is a consensus mechanism?
A
A key element of a blockchain is a consensus mechanism. It is a cryptographic process that takes control of the ledger from one party (the firm) and allows it to be examined and maintained by multiple independent entities. No centralized organization controls the chain. The official chain is agreed upon by a majority of the participating miners. Ex - blockchains and consensus mechanisms are similar to google Docs. Users in a Google Doc can edit documents at the time, and the most updated versions are always available. All users of the document must agree to any changes made.
8
Q
What is a key in a database?
A
A key contains enough information to uniquely identify each record, there can be no two records with the same key.
9
Q
What is a flat file?
A
The oldest file structure is the flat file, in which all records are stored sequentially, one after the other, as on a reel of magnetic tape. To find a certain record, every record on the tape has to be searched and bypassed until the desired one is found.
10
Q
What are hierarchical databases?
A
Instead of records being strung out one after the other, they form “branches” and “leaves” extending from a “root”. The hierarchical, or tree, database model was a major development in file organization. The tree structure improves speed and storage efficiency for related data. Ex - a parent record consisting of a customer may directly index the child records containg the customer’s orders.
11
Q
What are relational databases?
A
Relational databases are tables, and the columns are attributes.
12
Q
What is structured query language (SQL)?
A
Structured query language is a database management language used to manage data in a relational database. Ease data element is stored as few times as necessary. This reduction in data redundancy is accomplished through a process called normalization.
13
Q
What is cardinality?
A
Cardinality refers to how close a given data element is to being unique. A data element that can only exist once (a unique element) in a given table has high cardinality. A data element that is not unique in a given table but that has a restricted range of possible values is said to have normal cardinality. A data element that has a very small range of values is said to have low cardinality.
14
Q
What is referential integrity?
A
Referential integrity means that for a record to be entered in a given table, there must already be a record in some other table.
15
Q
What are primary keys?
A
The data fields in a table that uniquely identify the records in the table.
16
Q
What are foreign keys?
A
The data fields or groups of data fields that reference a primary key in another table.
17
Q
What are the three relationships referenced between primary and foreign keys?
A
- one-to-one - a foreign key can only link to one primary key, and vice versa.
- one-to-many - a foreign key can link to many primary keys, but a primary key can only link to one foreign key.
- many-to-many - a foreign key can link to many primary keys, and a primary key can also link to many foreign keys
18
Q
What are non-relational databases?
A
Non-relational databases provide a mechanism for storage and retrieval of data other than the tabular relations used in relational databases. The data structures used by NoSQL databases do not require joining tables, which allow operations to run much faster.
19
Q
What is an object-oriented database?
A
An object-oriented database stores objects along with the executable code that directs the behavior of the object. An object-oriented database is a response to the need to store graphics and multimedia applications used by object-oriented programming languages such as C++ and Java.
20
Q
What are data lakes?
A
Data lakes store all structured, semi-structured, and unstructured data, regardless of format or source into one data repository. The stored data are raw data that have not already bee processed for a particular reason.
21
Q
What are the two types of loading data?
A
Initial load and incremental load
22
Q
What is initial load?
A
Initial load involves processing data from the source database for the first time and may require an extensive amount of time to load into the target database depending on the volume of data.
23
Q
What is incremental load?
A
Incremental load is representative of the process of loading data from the source database to the target database subsequent to the initial load such as new or revised data. Maintenance of load dates is vital to ensure only new or revised data are loaded to the target database after the most recent data extraction from the source database.
24
Q
What is full refresh?
A
Full refresh completely wipes out data of one or multiple sections of the database and loads new data into the database.
25
What is load verification?
Load verification involves examining the data before and after loading to the target database to determine whether the data completely loaded and whether any discrepancies exist.
26
What is a database management system (DBMS)?
A DBMS is an integrated set of software tools superimposed on the data files that helps maintain the integrity of the underlying database.
27
What is a schema?
A particular database's design. A schema consists of the layouts of the tables and the constraints on entering new records. To a great extent, a DBMS automates the process of enforcing the schema.
28
What are the two vital parts of any DBMS (database management system)?
1. A data definition language (DDL) - allows the user to specify how the tables will look and what kinds of data elements they will hold
2. A data manipulation language (DML) - which the DBMS retrieves, adds, deletes, or modifies records and data elements.
Both of these roles are commonly fulfilled in the current generation of database management systems by SQL or one of its many variants.
29
What is the data dictionary?
The data dictionary contains the physical and logical characteristics of every data element in a database. The data dictionary contains the size, format, usage, meaning, and ownership of every data element as well as what persons, programs, reports, and functions use the data element.
30
What is an organizational needs assessment?
A detailed process of study and evaluation of how information systems can be deployed to help an organization meet its goals.
31
What are the steps of an organizational needs assessment?
1. determine whether current systems support organizational goals
2. determine needs unmet by current systems
3. determine the capacity of current systems to accommodate projected growth
4. propose a path for information systems deployment to achieve organizational goals within budgetary constraints
32
What is business process reengineering?
Business process reengineering involves a complete rethinking of and changes to how business functions are performed to provide value to customers, that is, radical innovation instead of mere improvement and a disregard for current jobs, hierarchies, and reporting relationships.
33
What is process automation?
Process automation refers to the automation of business processes and performance of routine tasks by mimicking the actions of humans. It involves incremental changes to how existing tasks are handled, as opposed to business process reengineering, which involves a complete and radical redesign of all tasks.
34
What are the roles and responsibilities of the IT steering committee?
- engaging high-level management in planning information systems and setting IT policies
- facilitating the implementation of information systems
- overseeing the control over the information systems
35
What is a killer application?
A killer application is one that is so useful that it may justify widespread adoption of a new technology
36
What is the systems development life cycle (SDLC)?
The SDLC approach is the traditional methodology applied to the development of large, highly structured application systems. A major advantage of the life-cycle approach is enhanced management control of the development process.
37
What are the 5 stages of the systems development life cycle (SDLC)?
1. systems strategy - which requires understanding of the organization's needs
2. project initiation - the process by which systems proposals are assessed
3. in-house development - generally chosen for unique information needs
4. commercial packages - generally chosen for common needs rather than developing a new system from scratch
5. maintenance and support - involves ensuring the system accommodates changing user needs
38
Once the need for a new system has been recognized, what are the 7 steps of the SDLC?
1. need for new system recognized
2. requirements analysis/definition
3. system design
4. build/development
5. testing/quality control
6. acceptance/installation/implementation
7. operations/maintenance
39
What is the first phase and component step of the traditional SDLC?
1. initiation, feasibility, and planning - recognizing the need for a new system, understanding the situation to determine whether it is feasible to create a solution, and formulating a plan.
40
What is the second phase and component step of the traditional SDLC?
2. requirements analysis and definition - a formal proposal is submitted to the IT steering committee, describing the need for the application and the business function(s) that it will affect. Feasibility studies are conducted to determine - what technology the new system will require, what economic resources must be committed to the new system, how the new system will affect current operations. The steering committee gives its go-ahead for the project.
41
What is the third phase and component step of the traditional SDLC?
3. system design - logical design consists of mapping the flow and storage of the data elements that will be used by the new system and the new program modules that will constitute the new system. Data flow diagrams, system interface diagrams, and structured flowcharts are commonly used in this step. Some data elements may already be stored in existing databases. Good logical design ensures that they are not duplicated.
Physical design involves planning the specific interactions of the new program code and data elements with the hardware platform (existing or planned for purchase) on which the new system will operate.
Systems analysts are heavily involved in these two steps.
42
What is the fourth phase and component step of the traditional SDLC?
4. build and development - the actual program code and database structures that will be used in the new system are writte. Hardware is acquired and physical infrastructure is assembled.
43
What is the fifth phase and component step of the traditional SDLC?
5. testing and quality control - testing is performed during system development with the intent of identifying errors or other defects. The job of testing is an iterative process because when one error is corrected, it can illuminate other errors or even create new ones.
Testing determines whether the system
a. meets the requirements that guided its design and development
b. responds correctly to all kinds of inputs
c. performs its functions within an acceptable time
d. achieves the general result its stakeholders desire
44
What are the various methods available to test systems?
- static testing
- dynamic testing
- white-box testing
- black-box testing
- gray-box testing
- sandbox testing
45
What is static testing?
Static testing examines the program's code and its associated documentation through reviews, walkthroughs, or inspections but does not require the program to be executed.
46
What is dynamic testing?
Dynamic testing involves executing programmed code with a given set of test cases.
47
What is white-box testing?
White-box testing tests internal structures or workings of a program, as opposed to the functionality exposed to the end-user.
48
What is black-box testing?
Black-box testing treats the software as a "black box", examining functionality without any knowledge of the source code.
49
What is gray-box testing?
Gray-box testing involves having knowledge of internal data structures and algorithms for purposes of designing tests, while executing those tests at the user, or black-box level.
50
What is sandbox testing?
Sandbox testing involves the use of a virtual testing environment that mimics the actual operating environment. Testing performed in the sandbox will not affect the live server.
51
What are the four levels of tests?
1. unit testing
2. integration testing
3. system testing
4. acceptance testing
52
What is the unit testing level?
Unit testing refers to tests that verify the functionality of a specific section of code and the handling of data passed between various units or subsystems components.
53
What is the integration testing level?
Integration testing is any type of software testing that seeks to verify the interfaces between components against a software design. Integration testing works to expose defects in the interfaces and interaction between integrated components (modules).
54
What is system testing level?
System testing, or end-to-end testing, tests a completely integrated system to verify that the system meets its requirements.
55
What is acceptance level testing?
Acceptance testing is conducted to determine whether the systems meets the organization's needs and is ready for release.
56
What is the sixth phase and component step of the traditional SDLC?
Acceptance, Installation, and implementation - User acceptance testing is the final step before placing the system in live operation. IT must demonstrate to the users that submitted the original request that the system performs the desired functionality. Once the users are satisfied with the new system, they acknowledge formal acceptance and implementation begins. Training and documentation are critical.
57
What are the 4 strategies that can be used for converting to a new system?
1. parallel conversion
2. direct changeover
3. pilot conversion
4. phased conversion
58
What is parallel conversion?
With parallel conversion, the old and new systems both are run at full capacity for a given period. This strategy is the safest since the old system is still producing output (in case there are major problems with the new system), but it is also the most expensive and time-consuming.
59
What is direct changeover conversion?
With direct changeover (direct cutover) conversion, the old system is shut down and the new one takes over processing at once. This is the least expensive and time-consuming strategy, but it is also the riskiest because the new system cannot be reverted to the original.
60
What is pilot conversion?
Under pilot conversion, one branch, department, or division at a time is fully converted to the new system. Experience gained from each installation is used to benefit the next one. One disadvantage of this strategy is the extension of the conversion time.
61
What is phased conversion?
Under the phased conversion strategy, one function of the new system at a time is placed in operation. The advantage of this strategy is allowing the users to learn one part of the system at a time.
62
What is the seventh phase and component step of the traditional SDLC?
Operations and maintenance - after a system becomes operational, the system should be monitored to ensure ongoing performance and continuous improvement. Systems follow-up or post-audit evaluation is a subsequent review of the efficiency and effectiveness of the system after it has operated for a substantial time (ex - 1 year). Post-audit evaluation can also help evaluate the decisions made by the steering committee by comparing the expectations with the actual results.
63
The process of managing changes over the life of an application is called?
Systems maintenance
64
What is program change controls?
The relevant controls for managing changes to an application during systems maintenance are called program change controls.
65
What is prototyping?
Prototyping is an alternative approach to application development. Prototyping involves creating a working model of the system requested, demonstrating it for the user, obtaining feedback, and making changes to the underlying code. This process repeats through several iterations until the user is satisfied with the system's functionality.
66
What is computer-aided software engineering (CASE)?
Computer-aided software engineering (CASE) applies the computer to software design and development. CASE facilitates the creation, organization, and maintenance of documentation and permits some automation of the coding process. It provides capacity to:
- maintain on the computer all of the system documentation - ex - data flow diagrams, data dictionaries, and pseudocode (structured English);
- develop executable input and output screens
- generate program code in at least skeletal form
67
What is end-user computing (EUC)?
End-user computing (EUC) involves user-created or user-acquired systems that are maintained and operated outside of traditional information systems controls.
68
What are some risks of EUC?
- environmental control risks are more likely, they include copyright violations that occur when unauthorized copies of software are made or when the software is installed on multiple computers
- unauthorized access to application programs and related data is another concern. EUC lacks physical access controls, application-level controls, and other controls found in mainframe or networked environments.
- EUC may not have adequate backup, recovery, and contingency planning. The result may be an inability to recreate the system or its data.
69
What is business resiliency (aka contingency planning)?
The goal of information security and data availability, which is the responsibility of the IT function.
70
What is disaster recovery?
Disaster recovery is the process of resuming normal information processing operations after the occurrence of a major interruption.
71
What is business continuity?
Business continuity is the continuation of a business by other means during the period in which computer processing is unavailable or less than normal.
72
What is business continuity management (BCM)?
BCM prepares the organization for IT failures through planning.
73
Plans must be made for two major types of contingencies, what are the two types?
1. those in which the data center is physically available. The organization's physical facilities are sound, but immediate action is required to continue normal processing.
2. those in which it is not. An occurrence of this type requires an alternate processing facility.
74
What are some examples of contingencies in which the data center is physically available?
- power failure
- random intrusions, such as viruses
- deliberate intrusions, such as hacking incidents
75
What are some examples of contingencies in which the data center is not physically available?
- disasters, such as floods, fires, hurricanes, or earthquakes
76
What is backup and rotation?
Periodic backup and offsite rotation of computer files is the most basic part of any disaster recovery or business continuity plan. An organization's data are more valuable than its hardware. Hardware can be replaced for a price, but each organization's data are unique and indispensable to operations. If they are destroyed, they cannot be replaced.
77
What is a mirror backup?
A mirror backup is a full copy of the data and programs of the primary computer such that they can run on another system and immediately take up the place of the affected system. This is commonly used by organizations such as e-commerce companies and banks, whose downtime is costly.
78
What is a full backup?
A full backup duplicates all data files and application programs. While this is the most effective and secure alternative, it is also the most costly and time-consuming.
79
What is an incremental backup?
An incremental backup duplicates only the data that have changed since the previous backup. For example, if a full backup was performed on January 1, an incremental backup on January 2 would only contain the data that changed between January 1 and January 2. Similarly, an incremental backup on January 3 would only contain the data changed between January 2 and January 3.
80
What is a differential backup?
A differential backup duplicates only the data that have changed since the previous full backup. For example, if a full backup was performed on January 1, a differential backup on January 2 would only contain the data that changed between January 1 and January 2. However, a differential backup on January 3 would contain the data that changed between January 1 and January 3. Due to the larger sizes of backup files, a differential backup is generally slower than an incremental backup. However, due to its fragmented nature, an incremental backup takes longer than a differential backup to restore.
81
What is critical for a backup location?
The offsite location must be temperature and humidity controlled and guarded against physical intrusion. Just as important, it must be far enough away from the site of main operations not to be affected by the same natural disaster. Adequate backup is useless if the files are not accessible or have been destroyed.
82
What are the risk assessment steps in business resiliency?
1. identify and prioritize the organization's critical applications - not all systems are equally important, the firm must decide which vital applications it cannot do business without and in what order they should be brought back into operation
2. determine the minimum recovery time frames and minimum hardware requirements - how long will it take to reinstall each critical application, and what platform is required. If the interruption has been caused by an attach such as a virus or hacker, how long will it take to isolate the problem and eliminate it from the system.
3. develop a recovery plan
83
What is a disaster recovery plan (DRP)?
Disaster recovery is the process of regaining access to data, communications, work areas, and other business processes. A DRP is established and tested and must be developed in connection with the business continuity plan. It should describe IT recovery strategies, including details about procedures, vendors, and systems.
84
What are examples of items addressed in a disaster recovery plan (DRP)?
- data center
- applications and data needed
- servers and other hardware
- communications
- network connections
- IT infrastructure (log-on services and software distribution)
- remote access services
- process controls systems
- file rooms
- document management systems
85
What are considerations for choosing a DRP strategy?
- the DRP should be based on the business impact analysis
- the recovery abilities of critical service providers must be assessed
- the recovery of IT components often must be combined to recover a system
- service providers (internal and external) must furnish recovery information - such as responsibilities, limitations, recovery activities, recovery time and point objectives, and cost
- strategies for components may be developed independently - the objective is the best, most cost-effective solution that allows user access and permits components to work together, regardless of where systems are recovered
- security and compliance standards
86
What is an alternate processing facility?
A physical location maintained by the organization or an outside contractor for the purpose of providing processing facilities for customers in case of a disaster.
87
What is a recovery center?
A recovery center is an off-site location where backup files (retrieved from the secure storage location) are taken to put back into service.
88
What are the three types of recovery centers?
- hot sites
- warm sites
- cold sites
Organization's determine which facility is best by calculating the tradeoff between the cost of the contract and the cost of downtime.
89
What is a hot site?
A hot site is a fully operational processing facility that is immediately available. It usually involves the use of a mirror backup. The organization generally contracts with a service provider. For a fee, the service provider agrees to have a hardware platform and communications lines substantially identical to the organization's ready for use 24 hours a day, 365 days a year. This solution is the least risky and the most expensive. Any contract for a hot site must include a provision for periodic testing. The service provider agrees to a window of time in which the organization can declare a fake disaster, load its backup files onto the equipment at the hot site, and determine how long it takes to resume normal processing.
90
What is a cold site?
A cold site is a shell facility with sufficient electrical power, environmental controls, and communications lines to permit the organization to install its own newly acquired equipment. On an ongoing basis this solution is much less expensive. However, the time to procure replacement equipment can be weeks or months. Also, emergency procurement from equipment vendors can be very expensive.
91
What is a warm site?
A warm site is a compromise between a cold and hot site, combining features of both. Resources are available at the site but may need to be configured to support the production system. Some data may need to be restored. Typical recovery time may range from several days to a week.
92
What is a fault-tolerant computer system (fail-soft system)?
Fault-tolerant computer systems have additional hardware and software as well as a backup power supply. A fault-tolerant computer has additional processing capability and disk storage. This technology is used for mission-critical applications that cannot afford to suffer downtime.
93
What is a redundant array of inexpensive (or independent) disks (RAID)?
RAID is a group of multiple hard drives with special software that allows for data delivery along multiple paths. If one drive fails, the other disks can compensate for the loss . This is the technology that permits fault tolerance.
94
What is high-availability computing?
High-availability computing is another technology for restoration of processing and is used for less critical applications because it provides for a short recovery time rather than the elimination of recovery time.
95
What is the objective of business continuity management (BCM)?
To restore critical processes and to minimize financial and other effects of a disaster or business disruption.
96
What are the three components of an emergency management program?
- emergency response
- crisis management
- business continuity management
97
What is emergency response?
Emergency response, the goal of which is lifesaving, safety and initial efforts to limit the effects of a disaster to asset damage. Its time frame is measured in hours if not minutes.
98
What is crisis management?
Crisis management, the focus of which is managing communications and senior management activities. Its time frame is measured in days if not hours.
99
What are the elements of business continuity management (BCM)?
- management support
- risk assessment and mitigation
- business impact analysis
- business recovery and continuity strategy
- awareness, exercises and maintenance
100
What is the management support element of BCM?
Management must assign adequate resources to prepare, maintain, and practice a business continuity plan.
101
What is the risk assessment and mitigation element of BCM?
The entity must define credible risk events (threats), assess their effects, and develop risk mitigation strategies.
102
What is the business impact analysis element of BCM?
This analysis identifies business process necessary to functioning in a disaster and determines how soon they should be recovered. The organization identifies critical processes, defines the recovery time objective and the recovery point objective for processes and resources, and identifies other parties (vendors and other divisions of the organization) and physical resources (critical equipment and records) needed for recovery.
103
What is the recovery time objective?
A recovery time objective is the duration of time and service level within which a process must be restored.
104
What is the recovery point objective?
A recovery point objective is the amount of data the organization can afford to lose.
105
What is the business recovery and continuity strategy element of BCM?
Business recovery is the existence of a comprehensive and current disaster recovery plan, which addresses the actual steps, people, and resources required to recover a critical business process.
106
In the business recovery and continuity strategy element of BCM, what are the things the organization plans for?
- alternative staffing - staff remaining at the site, staff at another site, or staff of another organization
- alternative sourcing - use of nonstandard products and services, use of diverse suppliers, outsourcing to organizations that provide standard services, or reciprocal agreements with competitors
- alternative work spaces - another organization facility, remote access with proper security, or a commercial recovery site
- the return to normal operations - entry of manually processed data, resolution of regulatory and financial exceptions, return of borrowed equipment and replenishment of products and supplies
107
What is the awareness, exercises and maintenance element of BCM?
Education and awareness (including training exercises) are vital to the BCM and execution of the business continuity plan. The BCM capabilities and documentation must be maintained to ensure that they remain effective and aligned with business priorities.
