Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

IAS > isa\ > Flashcards

isa\ Flashcards

1
Q

Items of fact collected by an organization. Data includes
raw numbers, facts, and words. Student quiz scores are a simple
example of data.

A

Data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

The unauthorized taking of personally
identifiable information with the intent of committing fraud and
abuse of a person’s financial and personal reputation,
purchasing goods and services without authorization, and
generally impersonating the victim for illegal or unethical
purposes

A

Identity Theft

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

was the first widely recognized
published document to identify the role of management and
policy issues in computer security.

A

RAND Report R-609

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The model, which was created by John
McCumber in 1991, provides a graphical representation of the
architectural approach widely used in computer and
information security,

A

McCumber Cube- T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

are rules that mandate or prohibit certain behavior and
are enforced by the state.

A

Laws-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In 1973, An Internet pioneer identified
fundamental problems with ARPANET security.

A

Robert M. Metcalfe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

a well-informed sense of assurance that
the Information risk and controls are in balance.

A

Information Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

is a potential weakness in an asset or its
defensive control system(s).

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

measures that an organization takes to ensure every
employee knows what is acceptable and what is not

A

Due care

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Reasonable steps taken by people or
organizations to meet the obligations imposed by laws or
regulations.

A

Due diligence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

In the context of information security, the right of
individuals or groups to protect themselves and their
information from unauthorized access, providing
confidentiality.

A

Privacy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The power to make legal decisions and
judgments; typically, an area within which an entity such as a
court or law enforcement agency is empowered to make legal
decisions

A

Jurisdiction

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

An entity’s legal obligation or responsibility

A

Liability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A legal requirement to make compensation or
payment resulting from a loss or injury

A

Restitution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Attack can be intentional or unintentional act that can damage
or otherwise compromise information and the systems that
support it. Attacks can be active or passive and direct or
indirect

A

Attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The creation, ownership, and
control of original ideas as well as the representation of those
ideas.

A

Intellectual property (IP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

model
of information security evolved from a concept developed by
the computer security industry called the C.I.A. triad.

A

The Committee on National Security Systems (CNSS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

has been the standard for computer security in both
industry and government since the development of the
mainframe.

A

C.I.A. triad

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

means the need to secure the physical
location of computer technology from outside threats.

A

Computer Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

a collection of related data stored in a structured
form and usually managed by a database management system.

A

Database

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

During the Cold War, many more mainframe
computers were brought online to accomplish more
complex and sophisticated tasks.

A

1960’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

These mainframes required a less cumbersome process
of communication than mailing magnetic tapes
between computer centers

A

1960’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

In response to this need, the Department of Defense’s
Advanced Research Projects Agency (ARPA) began
examining the feasibility of a redundant, networked
communications system to support the military’s
exchange of information.

A

1960’s

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

developed the ARPANET
(Advanced Research Projects Agency Network)
project

A

In 1968, Dr. Larry Roberts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

an interruption in service, usually
from a service provider, which causes an adverse event within
an organization

A

Availability Disruption

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Guidelines that dictate certain behavior within the
organization

A

Policy -

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

is a fixed moral attitudes or customs of a
particular group

A

Cultural Mores

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The unauthorized duplication, installation,
or distribution of copyrighted computer software, which is a
violation of intellectual property.

A

Software Piracy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q
  • A document or part of a
    document that specifies the expected level of service from a
    service provider. An SLA usually contains provisions for
    minimum acceptable availability and penalties or remediation
    procedures for downtime.
A

Service Level Agreement (SLA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

The documented product of operational
planning; a plan for the organization’s intended operational
efforts on a day-to-day basis for the next several months.

A

Operational plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

The actions taken by management to
specify the short-term goals and objectives of the organization
in order to obtain specified tactical goals, followed by estimates
and schedules for the allocation of resources necessary to
achieve those goals and objectives

A

Operational planning

32
Q
  • The documented product of tactical planning; a
    plan for the organization’s intended tactical efforts over the next
    few years.
A

Tactical plan

33
Q
  • The actions taken by management to
    specify the intermediate goals and objectives of the
    organization in order to obtain specified strategic goals,
    followed by estimates and schedules for the allocation of
    resources necessary to achieve those goals and objectives.
A

Tactical planning

34
Q

Conduct a thorough risk
assessment to identify potential threats and
vulnerabilities associated with the adoption of the new
cloud-based system. This assessment should consider
factors such as data sensitivity, regulatory compliance
requirements, and the potential impact of security
breaches on the organization’s operations and
reputation.

A

Risk Assessment:

35
Q

Develop a set of
security policies and procedures tailored to the specific
needs of the organization and aligned with industry
best practices. These policies should cover areas such
as data encryption, access controls, authentication
mechanisms, and incident response protocols.

A

Security Policies and Procedures

36
Q

Implement a range of security
controls to mitigate identified risks and vulnerabilities.
This may include deploying firewalls, intrusion
detection systems, endpoint protection solutions, and
encryption technologies to safeguard data both in
transit and at rest

A

Security Controls

37
Q

Provide
comprehensive training and awareness programs to
educate employees about security best practices, their
roles and responsibilities in maintaining security, and
the potential consequences of security breaches. This
will help create a security-conscious culture within the
organization

A

Employee Training and Awareness

38
Q

Establish mechanisms for continuous monitoring of
the security posture of the cloud-based system,
including regular vulnerability assessments,
penetration testing, and log analysis. This will enable
the organization to proactively identify and address
emerging security threats and weaknesses

A

Continuous Monitoring and Improvement:

39
Q

Ensure that
the security plan is in compliance with relevant
regulatory requirements such as GDPR, CCPA, and
industry standards like ISO 27001. Additionally,
consider legal implications related to data sovereignty,
contractual agreements with cloud service providers,
and liability in the event of security incidents

A

Compliance and Legal Considerations:

40
Q

Collaborate closely with
stakeholders to identify security requirements early in
the development process. Conduct threat modeling
exercises to anticipate potential security risks and
define security objectives for the project.

A

Requirements Gathering:

41
Q

Integrate security principles into the
architectural design of the software. Define security
controls, such as authentication mechanisms, access
controls, encryption methods, and secure
communication protocols. Consider security
implications when designing user interfaces and data
flows

A

Design Phase:

42
Q

Implement secure coding
practices and guidelines to mitigate common
vulnerabilities such as injection attacks, cross-site
scripting (XSS), and insecure deserialization. Use
secure development frameworks and libraries to
reduce the risk of introducing security flaws into the
codebase

A

Development Phase:

43
Q

Conduct thorough security testing,
including static code analysis, dynamic application
security testing (DAST), and penetration testing.
Identify and remediate security vulnerabilities,
ensuring that the software meets security requirements
and industry standards.

A

Testing Phase:

44
Q

allows the attacker
to acquire valuable information, such as account
credentials, account numbers, or other critical
data.

A

Cross-Site Scripting (XSS)

45
Q

caused by a developer’s
failure to ensure that command input is validated
before it is used in the program.

A

Command Injection-

45
Q

Implement secure deployment
practices, such as using secure configuration settings,
encrypting sensitive data, and regularly patching and
updating software components. Employ secure
deployment pipelines and automate security checks to
ensure consistent and secure deployments.

A

Deployment Phase:

46
Q

Establish procedures for
monitoring and maintaining the security of the
deployed software. Implement security monitoring
tools to detect and respond to security incidents in realtime. Provide regular security updates and patches to
address newly discovered vulnerabilities

A

Maintenance Phase:

47
Q

an attacker can make the
target system execute instructions or take
advantage of some other unintended consequence
of the failure

A

Buffer Overruns-

47
Q

Document securityrelated decisions, configurations, and procedures
throughout the SDLC. Provide training and awareness
programs for developers, testers, and other
stakeholders to promote a security-conscious culture
and ensure adherence to security policies and best
practices.

A

Documentation and Training:

47
Q

One of the marks of
effective software is the ability to catch and
resolve exceptions—unusual situations that
require special processing. If the program
doesn’t manage exceptions correctly, the
software may not perform as expected

A

Catching Exceptions

48
Q

Traffic on
a wired network is also vulnerable to interception
in some situations.

A

Failure to Protect Network Traffic

48
Q

Failure to properly implement sufficiently strong
access controls makes the data vulnerable.

A

Failure to Store and Protect Data Securely

49
Q

can cause a variety of
unexpected system behaviors.

A

Failure to Handle Errors

50
Q

An attacker may
embed characters that are meaningful as
formatting directives (such as %x, %d, %p, etc.)
into malicious input.

A

Format String Problems-

51
Q

If an attacker changes the
expected location of a file by intercepting and
modifying a program code call, the attacker can
force a program to use files other than the ones it
is supposed to use

A

Improper File Access

52
Q

Those who understand the
workings of such a “random” number generator
can predict particular values at particular times

A

Failure to Use Cryptographically Strong
Random Numbers

53
Q

While most programmers
assume that using SSL guarantees security, they
often mishandle this technology.

A

Improper Use of SSL

54
Q
  • One of the most common
    methods of obtaining inside and classified
    information is directly or indirectly from one
    person, usually an employee
A

Information Leakage

55
Q

An
integer bug can result when a programmer does
not validate the inputs to a calculation to verify
that the integers are of the expected size

A

Integer Bugs (Overflows/Underflows)-

56
Q

Developers use a
process known as change control to ensure that
the working system delivered to users represents
the intent of the developers

A

Neglecting Change Control-

57
Q

Employees prefer doing things
the easy way. When faced with an “official way”
of performing a task and an “unofficial way”—
which is easier—they prefer the latter.

A

Poor Usability-

58
Q

a failure of a program that
occurs when an unexpected ordering of events in its execution results in a conflict over access to
the same system resource.

A

Race Conditions

59
Q

occurs when developers fail to
properly validate user input before using it to
query a relational database

A

SQL Injection-

60
Q

Other
attacks attempt to compromise the DNS servers
further up the DNS distribution mode—those of
ISPs or backbone connectivity providers.

A

Trusting Network Address Resolution-

61
Q

an
unauthorized person might receive a key that was
copied onto a USB device and shipped

A

Unauthenticated Key Exchange-

62
Q

can cause problems that allow an attacker to send malicious code to the user’s computer by inserting the script into an otherwise normal Web site.

A

Web Client-Related Vulnerability (XSS)-

62
Q

Cross-site request forgery (XSRF or CSRF) attacks cause users to attack servers they access legitimately, on behalf of an outside attacker.

A

Web Server-Related Vulnerabilities (XSS, XSRF, and Response Splitting)-

63
Q

an
attacker can harvest the information from a magic
URL as it travels across the network, or use
scripts on the client to modify information in
hidden form fields.

A

Use of Magic URLs and Hidden Forms-

64
Q

Failure to require sufficient password strength and to control incorrect password entry is a serious security issue.

A

Use of Weak Password-Based Systems-

65
Q

one of the first attempts to protect federal computer systems by establishing minimum acceptable security practices

A

Computer Security Act of 1987-

66
Q

which provides law enforcement agencies with broader latitude to combat terrorism related activities.

A

USA PATRIOT Act of 2001-

67
Q

is the cornerstone of many computer-related federal laws and enforcement efforts.

A

Computer Fraud and Abuse Act of 1986 (CFA Act or CFAA)-

68
Q

mandates that all federal agencies establish informationsecurityprogramstoprotecttheirinformation assets.

A

Federal Information Security Management Act (FISMA)-

69
Q

known as the National Bureau of Standards prior to 1988—is responsible for developing these security standards and guidelines in cooperation with the National Security Agency.

A

National Institute of Standards and Technology (NIST)-

70
Q
A

IAS (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions