Midterm 2 Chapter 11

Question 1

Who is responsible fore security?

Answer 1

Managment

Question 2

Management must take responsibility for:

Answer 2

1. Policy development
2. Effective communication of these policies
3. Design of appropriate control policies
4. Monitoring of the system and, if necessary, take corrective actions

Question 3

Can the COSO structure be overlaid on the security model?

Answer 3

Yes

Question 4

Time Based Model of Security

Answer 4

P>D+C
Preventative is greater than the sum of detective plus corrective

Question 5

P

Answer 5

The time it takes an attacker to break through the various controls that protect the company’s information system assets (we want these to be high)

Question 6

D

Answer 6

The time it takes for the company to detect that an attack has occurred (we want these to be low)

Question 7

C

Answer 7

The time it takes to respond to and stop the attack (we want these to be low)

Question 8

What is the problem with symmetric encryption?

Answer 8

I have to give the key to you somehow - if the key is dropped or lost, anyone with access to it can have access to any of the codes

Question 9

What is asymmetric encryption based on?

Answer 9

Prime number factering