Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security Threats > Chapters 1-3 > Flashcards

Chapters 1-3 Flashcards

(73 cards)

Start Studying
1
Q

Define CIA

A

Confidentiality - information cannot be read
Integrity - attackers cannot change or destroy info
Availability - info is always available for authorized people

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Compromise?

A
  • Successful Attacks, breaches or incidents
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are Countermeasures?

A
  • Used to Thwart attacks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the Types of Countermeasures?

A
  • Preventative: cost-effective, prevents attacks
  • Detective: keeps attacks from succeeding
  • Corrective: minimize and restore systems after an attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the Payment Card Industry-Data Security Standards?

A
  • Build and Maintain a Secure Network
  • Protect Cardholder Data
  • Maintain a Vulnerability Management Program
  • Implement Strong Access Control Measures
  • Regularly Monitor and Test Networks
  • Maintain an Information Security Policy
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How are Employees and Ex-employees Dangerous?

A
  • They have knowledge of internal systems
  • Often have permission to access systems
  • Know how to avoid detection
  • Generally trusted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Define Employee Vulnerabilities

A
  • Sabotage
  • Hacking
  • Financial Theft
  • Intellectual Property Theft
  • Extortion (employee is victim)
  • Sexual or Racial Harassment of Other Employees
  • Internet Abuse
  • Carelessness
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Define Potential Attackers Aside from Employees

A
  • Contract Workers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a Virus

A

Malware that attaches itself to legitimate programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a Direct-Propagation Worm?

A

Malware that doesn’t need humans to jump between computers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a nonmobile Malware?

A

Malware that needs humans to propagate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is a RAT

A

Remote Access Trojan - allows a machine to be remotely controlled

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Downloader

A

A smaller trojan that downloads larger trojans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a Reconnaissance Probe?

A

scans to identify network vulnerabilities

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is an Exploit?

A

attacker breaks into a computer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Chain of Attack?

A

An attacker attacks through a chain of victim computers to remain untraceable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Differentiate Expert Attackers and Script Kiddies

A

Expert hackers are technically skilled and persistent while script kiddies have low skill but are more numerous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is Cyberwar

A

Attacks conducted by governments against financial and communication infrastructure

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Cyberterror

A

Attacks conducted by terrorists against IT resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Comprehensive Security

A

A state in which defenders have closed off all possible venues of attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What makes Security Management a Disciplined Process?

A
  • Complex
  • Need Formal Processes
  • Continuous Process
  • Compliance Regulation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the Cycle for Security Management

A

Plan-protect-Respond

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Vision

A

Understanding your role concerning the company

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Strategies for IT Security planning

A
  • Identify Current IT Security Gaps
  • Identify Driving Forces
  • Identify Corporate Resources Needing Protection
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
What is a Remediation Plan
Identifying and addressing threats and vulnerabilities to prevent and limit security breaches
26
What is an Investment Portfolio
investments made for protection methods to mitigate vulnerabilities based on risk
27
What are Compliance Laws and Regulations
Create requirements for corporate security
28
What is the Sarbanes-Oxley Act of 2002
Requires firms to report material deficiencies in financial reporting processes
29
What is the Data Breach Notification Laws
Requires notification of any California citizen whose private information is exposed
30
What is the CSO (CISO)
The Chief Security Officer (Chief Information Security Officer) oversees IT and cyber security
31
Differentiate Effects of IT Location
- Within IT: will be responsible for security - Outside IT: gives independence - Hybrid: planning and auditing outside IT but also firewall operation within IT
32
Define Top Forms of Management Support
- Budget - Support in Conflicts - Setting Personal Examples
33
What is an MSSP
Managed Security Service Providers are Outsourced IT security
34
What is Risk Analysis
Manage risk to be of reasonable threat
35
What is EF
Exposure Factor is the percentage loss in asset value if a compromise occurs
36
What is SLE
Single Loss Expectancy is the expected loss in case of a compromise
37
What is ARO
Annualized Rate of Occurrence is the annual probability of a compromise
38
What is ALE
Annualized Loss Expectancy is the expected loss per year of compromise
39
What are the Problems with Classic Risk Analysis Calculations
- Uneven Multilayer Cash Flows - Total Cost of Incident (TCI): damage usually does not come from asset loss - Impossibility of knowing Annualized Rate of Occurrence - Problems with "Hard-Headed Thinking" - Perspective
40
What is Risk Reduction
Implement countermeasures to reduce harm
41
What is Risk Acceptance?
Accepting loss when protecting against it would be too expensive
42
What is Risk Transference
Transferring loss to a different party (insurance)
43
What is Risk Avoidance
Avoiding risky actions
44
What are the 4 Choices when Encountering a Risk
- Risk Reduction - Risk Acceptance - Risk Transference - Risk Avoidance
45
What is the Technical Security Architecture?
A company's technical countermeasures and how these countermeasures are organized
46
What is legacy Technology?
Previously installed tech that may be too expensive to upgrade immediately fully
47
What is Depth in Defence
Multiple independent countermeasures must be defeated in series
48
What is the Weakest Link
Single countermeasure with multiple interdependent components that must all succeed for the countermeasure to succeed
49
What are Policies
Statements of what is to be done, provides clarity and implementation
50
What is an Acceptable Use Policy?
Summarizes key points of special importance for users
51
Factors to consider when Writing Policies
- IT security cannot act alone in policy-making - There should be policy writing teams for each policy - Team approach gives authority to policies - Different viewpoints prevent mistakes
52
What is Implementation Guidance
Limits discretion of implementers
53
Standards vs Guidelines
Standards are mandatory while guidelines are not but must be considered
54
What are Procedures
Detailed specifications of how something should be done
55
What are Processes
Less detailed specifications of what actions should be taken
56
What are baselines?
Checklists of what should be done without processes or procedures
57
What are the Types of Implementation Guidance
- Best Practices: most appropriate actions in other companies - Recommended Practices: normative guidance
58
Who Should Be Held Accountable
Owner of a resource
59
What are Ethics
Person's system of values that can be guided by company code
60
What are Kickbacks
Given by sellers to secure orders or future orders
61
What is Oversight
Term for a group of tools for policy enforcement
62
What is Electronic Monitoring
Electronically-collected information on behaviour
63
What is Security Metrics
Indicators of compliance that are measured periodically
64
What is Auditing
Sampling information to develop an opinion about the adequacy of controls
65
What is an Anonymous Protected Hotline
An anonymous and protected hotline where employees can call in
66
What is the Fraud Triangle
- Opportunity - Pressure - Rationalization
67
What is a Vulnerability Test?
An attack on own systems to find vulnerabilities
68
Who is COSO
The Committee of Sponsoring Organizations of the Treadway Commission provides guidance on financial controls
69
Who is CobiT
The Control Objectives for Information and Related Technologies offers documents on how to improve IT management practices
70
Who is the main professional accrediting body of IT auditing
CobiT
71
What are the 4 Major CobiT Domains?
1. Planning and Organization 2. Acquisition and Implementation 3. Delivery and Support 4. Monitoring
72
What is the ISO/IEC 27000?
A family of IT security standards with several individual standards
73
Who is the ISO/IEC
The International Organization for Standardization and the International Electrotechnical Organization

Security Threats (4 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions