ITEC 85 Flashcards by Yla Gonzales

refers to the protection of information and information systems from unauthorized access

INFORMATION SECURITY

How well did you know this?

Not at all

Perfectly

– refers to broader to a set of practices, policies, and procedures aimed at protecting the confidentiality

INFORMATION ASSURANCE

How well did you know this?

Not at all

Perfectly

to hide a glaze recipe for pottery.

CRYPTOGRAPHY IN ANCIENT TIME

How well did you know this?

Not at all

Perfectly

Firewalls

MEDIEVAL CASTLE

How well did you know this?

Not at all

Perfectly

Codes

WORLD WARR ll AND THE ENIGMA MACHINE

How well did you know this?

Not at all

Perfectly

– it is responsible for creating, managing, and using data

PEOPLE

How well did you know this?

Not at all

Perfectly

is refer to the activities and procedures that are used to collect, store, process, and distribute information

PROCESSES

How well did you know this?

Not at all

Perfectly

is the raw material that is used by the information system

DATA

How well did you know this?

Not at all

Perfectly

refers to the computer programs

SOFTWARE

How well did you know this?

Not at all

Perfectly

refers to the physical components of the information system

HARDWARE

How well did you know this?

Not at all

Perfectly

component of an information system includes the communication infrastructure

NETWORKING

How well did you know this?

Not at all

Perfectly

The birth of modern computing led to the development of computers

BIRTH OF MODERN COMPUTING AND EARLY THREATS

How well did you know this?

Not at all

Perfectly

It is important elements of information security that help protect computer systems

PASSWORD AND ACCESS CONTROLS

How well did you know this?

Not at all

Perfectly

refers to the time when the internet became widely accessible

INTERNET ERA

How well did you know this?

Not at all

Perfectly

It is an effort to enhance information security

TRUSTED COMPUTING INITIATIVE

How well did you know this?

Not at all

Perfectly

It is also known as asymmetric cryptography, is a method used in information security to secure communication

PUBLIC – KEY CRYPTOGRTAPHY

How well did you know this?

Not at all

Perfectly

refers to the increase in criminal activities that are conducted through the use of computers

THE RISE OF CYBECRIME

How well did you know this?

Not at all

Perfectly

refers to the protection of mobile devices

MOBILE SECURITY

How well did you know this?

Not at all

Perfectly

refers to the protection of data

cloud computing environments

CLOUD SECURITY

How well did you know this?

Not at all

Perfectly

refers to the measures and practices implemented to protect the security

INTERNET OF THINGS (IoT) SECURITY

How well did you know this?

Not at all

Perfectly

are sophisticated and targeted cyber-attacks that are carried out by skilled and persistent adversaries.

ADVANCED PERSISTENT THREATS (APTs)

How well did you know this?

Not at all

Perfectly

was an early computer worm that spread rapidly through vulnerable

THE MORRIS WORM

How well did you know this?

Not at all

Perfectly

refers to the measures and practices implemented to protect the security

INTERNET OF THINGS (IoT) SECURITY

How well did you know this?

Not at all

Perfectly

it pertains to laws and regulations that govern the protection and privacy of personal data.

DATE PRIVACY REGULATIONS

How well did you know this?

Not at all

Perfectly

5 BALANCING INFORMATION SECURITY AND ACCES:

* IMPLEMENT ACCESS CONTROL * USE MULTI – FACTOR AUTHENTICATION * EDUCATE USERS * USE ENCRYPTION * MONITOR USER ACTIVITY

5 APPROACHES TO INFORMATION SECURITY IMPLEMENTATION:

* RISK – BASED APPROACH – * COMPLIANCE – BASED APPROACH - * DEFENSE IN DEPTH APPROACH – * HUMAN – CENTRIC APPROACH – * TECHNOLOGY – FOCUSED APPROACH –

involves identifying and assessing risks to the organization’s information assets

* RISK – BASED APPROACH

involves implementing security controls to comply with regulatory requirements

* COMPLIANCE – BASED APPROACH

involves implementing multiple layers of security controls to provide redundancy

* DEFENSE IN DEPTH APPROACH

focuses on the role of people in information security.

* HUMAN – CENTRIC APPROACH

emphasizes the use of technology to protect information assets.

* TECHNOLOGY – FOCUSED APPROACH

SECURITY IN THE SDLC:

* PLANNING * ANALYSIS * DESIGN * IMPLEMENTAION * TESTING * DEPLOYMENT * MAINTENANCE

KEY TERMS AND CRITICAL CONCEPTS OF INFORMATION SECURITY:

1. CONFIDENTIALITY 2. INTEGRITY 3. AVAILBILTY 4. AUTHENTICATION 5. AUTHORIZATION 6. RISK MANAGEMENT 7. THREATS 8. VULNERABILITIES 9. DEFENSE IN DEPTH 10. INCIDENT RESPONSE

THE 2 NEEDS FOR SECURITY

THREATH (NOUN) ATTACK (VERB)

possible security risk that might exploit the vulnerability of a system or asset.

THREATH (NOUN)

intentional unauthorized action on system.

ATTACK (VERB)

TWO TYPES OF ATTACKS:

* ACTIVE ATTACKS * PASSIVE ATTACKS

an attempt to change system resources

* ACTIVE ATTACKS

an active attack is an attempt to change system resources

* PASSIVE ATTACKS

EXAMPLES OF THREATS AND ATTACK

* CYBERATTACKS * PHYSICAL ATTACKS * RERROISM * THREAT OF VIOLENCE * NATURAL DISASTER * FINANCIAL FRAUD

EXAMPLES OF THREATS AND ATTACKS IN INFORMATION SECURITY

EXAMPLES OF THREATS AND ATTACKS IN INFORMATION SECURITY * MALWARE * PHISING * DENIAL – OF – SERVICE (DOS) * PASSWORD ATTACKS * INSIDER THREATS * PHYSICAL ATTACKS

DIFFERENT TYPES OF THREATS AND ATTACKS IN INFORMATION SECURITY

* ESPIONAGE OR TRESPASS – * FORCES OF NATURE – * HUMAN ERRO OR FAILURE – * INFORMATION EXTORTION – * SOFTWARE ATTACKS – * TECHNOLOGICAL OBSALANCE * THEFT – INTELLECTUAL PROPERTY (IP) –

refer to illegal or unauthorized access to confidential information Ex. - Corporate Espionage - Cyber Espionage - Trespassing - Physical Espionage - Economic Espionage

* ESPIONAGE OR TRESPASS

refer to natural disaster such as floods, earthquakes, and hurricanes that can cause damage to computer systems Ex. - Weather Events - Earthquakes - Volcanic Eruptions - Wildfires - Tsunamis - Power Outages - Lightning Strikes

* FORCES OF NATURE

refers to mistakes made by individuals

* HUMAN ERRO OR FAILURE

It is a type of cybercrime in which the attacker threatens to publish.

* INFORMATION EXTORTION

refers to intentional damage

* SABOTAGE OR VANDALISM

refer to cyberattacks that exploit vulnerabilities in software applications.

* SOFTWARE ATTACKS

refers to the state where technology becomes outdated

* TECHNOLOGICAL OBSALANCE

it is the act of taking someone else’s property without their consent

* THEFT

refers to creations of the mind.

INTELLECTUAL PROPERTY (IP)

7 COMMON TERMS USED IN INTELLECTUAL PROPERTY

COMMON TERMS USED IN INTELLECTUAL PROPERTY * PATENT * TRADEMARK * COPYRIGHT * TRADE SECRET * INFRINGEMENT * LICENSING * FAIR USE

enacted by governments to regulate behavior

LAWS

are rules that are established by regulatory agencies to enforce

REGULATIONS

refer to a set of moral principles and values that guide individual behavior

ETHICS

is a set of principles

CODE OF ETHICS

are associations of individuals

PROFESSIONAL ORGANIZATION

* INTERNATIONAL

* INTERNATIONAL - International Association of Computer Science and Information Technology (IACSIT) - Information System Security Association (ISSA) - International Association of Privacy Professionals (IAPP) - Cloud Security Alliance (CSA)

* LOCAL

* LOCAL - Information Security Officers Group Philippines (ISOGP) - Philippine Computer Emergency Response Team (PH-CERT) - Philippine Society of Information Technology Educators (PSITE) - Philippine Society of Information Security Professional (PSISP)

LAWS THAT AFFECTS THE PRATICE OF INFORMATION SECURITY

* DATA PRIVACY ACT OF 2012 (DPA) * CYBERCRIME PREVENTION AST OF 2012 * E-COMMERCE ACT OF 2000 * ANTI-PHOTO AND VIDEO VOYEURISM ACT OF 2009 * NATIOANL PRIVACY COMMISSION (NPC)