chapter 2 information security system

Question 1

Define Information security ?

Answer 1

Information security can be defined as the protection of the information system and its resources (Critical assets)

Question 2

Information security protect the information system and its resources against what?

Answer 2

1-Accidental or Intentional disclosure of confidential data
2-Unlawful modification of data or programs
3-the destruction of data, software or hardware
4- ensuring non-repudiation

Question 3

Information systems security (infosec) refers to what?

Answer 3

Information systems security (infosec) refers to the processes and methodologies involved with keeping information confidential, available, and assuring its integrity

Question 4

What are the primary information assets?

Answer 4

Primary information assets are :
data, information or knowledge, Which has value, is organized and managed

Question 5

The primary information assets enables what?

Answer 5

Enables the organization to operate business processes and decision making

Question 6

where does the primary information assets sets in the information assets pyramid?

Answer 6

it situated at the top of the pyramid

Question 7

what are the supporting (secondary assets)

Answer 7

1- Software
2- hardware
3-people
4-physical infrastructure
5-processes

Question 8

Secondary, supporting information assets are essential for?

Answer 8

are essential for making data and information available

Question 9

the secondary (supporting) assets include (software) explain ?

Answer 9

software or application where data is stored or processed

Question 10

the secondary (supporting) assets include (Hardware) explain ?

Answer 10

Hardware: any other IT or other equipment

Question 11

the secondary (supporting) assets include (people) explain ?

Answer 11

as carriers of knowledge and information, also as a source of risk or failure

Question 12

the secondary (supporting) assets include (physical infrastructure) explain ?

Answer 12

any physical equipment, location on which other assets depend, such as a server room

Question 13

the secondary (supporting) assets include (processes) explain ?

Answer 13

processes such access control processes or incident response processes

Question 14

OSI Security architecture contains 3 things mention them?

Answer 14

1- security attack
2-security mechanism
3-security service

Question 15

what is a security attack?

Answer 15

any action that compromises the security of information owned by an organization. Or an assault (Attack) on system security that develops from an intelligent threat

Question 16

there are two types of generic types of attacks ,mention them?

Answer 16

1-Passive attack
2-active attack

Question 17

what is a security mechanism ?

Answer 17

a process (Or a device incorporating such a process) that is designed to prevent. detect, or recover from a security attack

Question 18

does a single mechanism can support all functions required?

Answer 18

NO, however one particular element underlies many of the security mechanisms in use: cryptographic techniques

Question 19

What is a security service?

Answer 19

is a service that enhances the security of the data and the information transfers of an organization

Question 20

there are 6 main pillars of security (the roman building) mention them?

Answer 20

1- confidentiality
2-Integrity
3-Availability
4-Non-Repudiation
5-Authenticity
6-Access control

Question 21

What do we mean by assets confidentiality ?

Answer 21

Confidentiality ensures that computer-related assets are accessed only by authorized parties that is only those who should have access to something will actually get that access

Question 22

confidentiality sometimes is called ?

Answer 22

Secrecy or privacy

Question 23

What do we mean by data confidentiality ?

Answer 23

Assure that private or confidential information is not made available or disclosed to unauthorized individuals

Question 24

what do we mean by privacy ?

Answer 24

Assure that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed

Question 25

What do we mean by assets integrity?

Answer 25

Integrity means that assets can be modified only by authorized parties or only in authorized ways

Question 26

assets modification includes what?

Answer 26

1- writing 2-changing 3-changing status 4-deleting 5-creating

Question 27

what do we mean by data integrity?

Answer 27

Assures that information and programs are changed only in a specified and authorized manner

Question 28

What do we mean by system integrity?

Answer 28

Assures that a system performs its intended function in an unimpaired manner , free from deliberate or unintended unauthorized manipulation of the system

Question 29

What do we mean by availability?

Answer 29

availability means that assets are accessible to authorized parties at appropriate times,

Question 30

Define confidentiality ?

Answer 30

Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information

Question 31

Define integrity?

Answer 31

Guarding against improper information modification or destruction, including ensuring information non-repudiation and authenticity

Question 32

Define availability?

Answer 32

Ensuring timely and reliable access to and use of information

Question 33

define authenticity?

Answer 33

authenticity means the property of being genuine and being able to be verified and trusted (this means verifying that users are who they say they are and that each input arriving at the system came form a trusted source

Question 34

Define accountability?

Answer 34

the security goal that generated the requirement for action of an entity to be traced uniquely to that entity

Question 35

Authentication is any process which verify that someone is who they claim they are, this usually involves?

Answer 35

username, password, can include any other method of demonstrating identity, such as a smart card , retina scan, voice recognition or fingerprints

Question 36

what do we mean by Data source authentication ?

Answer 36

means that the data is coming from an authorized party