Midterm 2 Chapter 12

Question 1

Generally Accepted Privacy Principles

Answer 1

1. Management
2. Notice
3. Choice and consent
4. Collection
5. Use, retention, and disposal
6. Access
7. Disclosure to third parties
8. Security
9. Quality
10. Monitoring and enforcement

Question 2

What is the difference between privacy and confidentiality?

Answer 2

Privacy: personal information the company collects from suppliers, customers, and employees
Confidentiality: intellectual property that is crucial to the company’s success

Question 3

What actions must be taken to protect both confidentiality and privacy?

Answer 3

1. Identify/classify the information to be protected
2. Encryption
3. Control access to the information
4. Train employees to properly handle the information

Question 4

What is the strictest and most far-reaching privacy regulation?

Answer 4

European Union’s General Data Privacy Regulation (GDRP)

Question 5

What does the GDPR do?

Answer 5

1. Proactive approach to privacy “Privacy by Design”
2. Requires organizations to notify regulators with 72 hours of discovering a breach
3. Rights: access to data about you, correction of errors, deletion of personal data, and revocation of consent to sell/share information

Question 6

Identity Theft

Answer 6

The unauthorized use of someone’s personal information for the perpetrator’s benefit

Question 7

Encryption

Answer 7

The process of transforming normal content, plaintext, into unreadable gibberish, ciphertext

Question 8

Decryption

Answer 8

Transforming ciphertext into plaintext

Question 9

Generally, how does decryption work?

Answer 9

The computer first divides the ciphertext into 512-bit blocks and then applies the decryption key to each block

Question 10

What factors determine the strength of any encryption system?

Answer 10

1. Key length
2. Encryption algorithm
3. Policies for managing the cryptographic keys

Question 11

Policies for managing the cryptographic keys

Answer 11

1. Don’t store keys in a browser or any other file that other users of the system can readily access
2. Use a strong/long passphrase to protect the keys
3. Keys should only be issued to employees who handle sensitive data
4. Keys should be promptly evoked when an employee leaves or a key has been compromised

Question 12

How many keys does symmetric encryption have?

Answer 12

One key