Video Content Lesson 11 Flashcards

Question

Computer Security Act

Answer 1

Computer Security Act of 1987 Four Main Ideas 1-Gave the National Institute of Standards and Technology (NIST) responsibility for developing standards and guidelines related to federal computer systems 2-Provides for the promulgation of standards and guidelines 3-Required security plans for all federal systems that contain sensitive data 4-Requires mandatory periodical training for managers, administrators, and users of federal systems that contain sensitive data

Answer 2

National Information Infrastructure Protection Act of 1996 Amendment to Computer Security Act Broadens authority to cover systems used in international commerce Extends protection beyond computer systems to infrastructure elements (electricity, etc) Treats any reckless or malicious code that damages critical national infrastructure as a felony

Answer 3

Government Information Security Reform Act (GISRA) of 2000 Provides a comprehensive framework for establishing effectiveness of controls Calls for increased network security control Provides for government-wide management of information security risks Calls for the development of minimum security controls for federal systems Improves oversight of federal information systems

Answer 4

1-Federal Privacy Act of 1974 Very significant privacy legislation Severely restricts the ability of federal government agencies to disclose personal information without prior written approval by the affected party Contains exceptions for (Census; Law Enforcement; Health and Safety; Court Orders) 2-Electronic Communications Privacy Act (ECPA) of 1986 Makes it a crime to invade a person's electronic privacy Protects from e-mail and voice mail monitoring Prevents service providers from disclosing the contents of e-mail and voice mail messages Prohibits monitoring of cell phone conversations 3-Health Insurance Portability and Accountability Act of 1996 (HIPAA) Set forth strict regulations for organizations that process or store personal medical information HIPAA is quite a complex, but a general overview of its intent will suffice unless you work in the health care field 4-Gramm-Leach-Bliley Act of 1999 Modified restrictions that govern exchange of financial information between financial institutions

Answer 5

USA Patriot Act of 2001 Direct Response to the 9/11 terrorist attacks Broadened the authority of law enforcement and intelligence agencies to conduct electronic monitoring Permission can now be granted per person, instead of the per circuit requirement ISPs can provide detailed information to the government pertaining to user activity penalties can now be up to 20 years in prison

Answer 6

3 basic standards 1-Prudent Man Rule (officers and agents of an organization must perform duties that are consistent with what a prudent man would exercise in a similar situation) 2-Due Care (Steps an organization takes that show it has taken responsible action to protect assets 3-Due Diligence (Continual activities that demonstrate that due care is maintained

Answer 7

``` Overview Incident Categories Scanning Incidents Compromise Incidents Malicious Code Incidents DoS Incidents ```

Answer 8

An Incident is any actual or threatened violation of a security policy An Incident may or may not actually violate a statute or regulation The greatest barrier to proper incident handling is the fact that many incidents are never detected Solid security awareness training is necessary to recognize and properly handle incidents

Answer 9

4 categories 1-Scanning Incident (Any structured survey of a system or data source to find information helpful for a later attack--like casing a joint) 2-Compromise Incidents (Bypassing or otherwise defeating one or more access controls) 3- Malicious Code Incidents (Introduction of malicious code to a system) Denial of Service Incidents (Attack that renders a system unavailable to authorized users)

Answer 10

``` Scanning incidents normally precede more serious attacks (Main purpose is to gain information) Port Scanning (Automated query sent to each port to see if it responds) (If active, the response will generally contain information about the software listening on the port) Dumpster Diving (physically sorting through discarded trash for useful information) ```

Answer 11

1-Network Intrusion (any unauthorized access to a protected network resource) (requires that an attacker compromise one or more controls) (careful activity monitoring can detect such intrusions in many cases) (applications that focus in such activities are call Intrusion-detection systems (IDS) Network OR Host based) 2-Eavesdropping (Any unauthorized surveillance of communication) (can refer to electronic or natural communication) (purpose is to intercept useful information) 3-Illegal Content (the transfer from or to a protected machine, or the storage of illegal content on a protected machine) (any content that is defined by local, state, and federal law, as well as the security policy) 4-Social Engineering (Any attempt, whether successful or unsuccessful, to compromise a system through the aid of an authorized user) (Defining social engineering as an incident is important from an educational perspective) 5-Software Piracy (Installing and/or using any software that is not legally licensed for that specific machine) (The concept is simple, but compliance seems to be hard to understand) 6-Information Warfare (The use of information and systems to deny or destroy an enemy's information and systems) (To be successful means survival) (These actions are designed to gain advantages over our adversaries) 7-IP Spoofing (Replaces the true sender's IP address with some other IP address) (These actions could encourage the target machine into relaxing access controls to sensitive data or resources) 8-Theft (the act of stealing) (the attacker must compromise some access controls to get to the object to steal) (full backup) 9-Fraud (a deception deliberately practiced in order to secure unfair or unlawful gain) (Any use of the system or data to commit fraud constitutes not only an incident but also a crime)

Answer 12

Any introduction or propagation of malicious code Malicious code can be many different types (viruses, worms, Trojan horses, Logic Bombs, Trap doors) Be proactive, put in front-end scanning

Answer 13

Any deliberate attempt to deny access to a system by authorized users Includes distributed denial of service DDoS

Answer 14

Knowledge Response Contain Damage Reporting

Answer 15

Know when an incident has occurred (the most common reason that an incident is never properly handled is that it is never detected) (Good security awareness training and active monitoring are the two best countermeasures to undetected incidents) (Security policy will dictate what actions are incidents and how to respond to each one)

Answer 16

The very first step in handling an incident, after it has been identified, is the initial response 1-Contain the damage 2-Assess the damage and report the incident to the appropriate authorities 3-Investigate the origin of the incident 4-Postmortem analysis (Once the incident is over, take a look and analyze all the findings and implement controls to prevent a reoccurrence of the incident 5-Document every step

Answer 17

1-disconnect the compromised machine(s) from the network (stop all communication with other machines) 2-To power off or not to power off? 3-Reestablish controls or implement new temporary controls 4-Goal is to stop any damage from making the situation worse 5-Take a system backup

Answer 18

Security policy will dictate the proper reporting procedure Report any incident that involves a violation of any law or regulation to the appropriate authorities Should a reported at the discretion of the Security Manager Ensure that each incident is responded to properly and notify all affected parties as soon as possible Any reports should be standardized to make later analysis easier Any incident should contain (the nature of the incident; How it originated, and from whom; the date and time of the incident; the location of the incident; what tools were used to launch the incident; known damage)

Answer 19

``` Overview Evidence Handling Evidence Types Evidence Admissibility Search and Seizure ```

Answer 20

Incident Investigation The act of conducting a detailed inquiry or examination The purpose is to understand the incident's origin and the vulnerabilities that allowed it to occur Evidence An investigation will produce various forms of evidence to present as results any hardware, software, or data that can be used to verify the origin and details of an incident Evidence is used to figure out what happened, where it came from, and who started it Computer Forensics The process of examining a computer system to find electronic evidence of a specific activity

Answer 21

If an incident may result in legal action (only allow trained personnel to collect and handle evidence; best to let law einforcement officers handle the evidence; improper handing of evidence could render it useless) Maintain the chain of custody (must remain unbroken for evidence to be viable in court)

Answer 22

1-Best evidence (original copy of document) 2-Secondary evidence (relevant information that has been drawn from a publication other than the original document) 3-Direct evidence (evidence that stand on its own (witness) 4-Conclusive Evidence (evidence that cannot be contradicted) 5-Circumstantial evidence (any fact that can be used to infer another fact) 6-Corroborative evidence (Evidence that support, or corroborates a finding 7-Opinion Evidence (testimony of an expert witness who due to expert status is allowed to state an opinion) 8-Hearsay evidence (evidence that was relayed from a third party)

Answer 23

In order of evidence to be allow in a court of law it must be 1-Relevant (it must pertain to the case) 2-Permissible (it must comply with laws governing collection and maintenance) 3-Reliable (there can be no questions as to its authenticity) 4-Preserved (It was be in the precise state as it was collected) 2, 3, and 4 are included in the proper use of Chain of Command

Answer 24

It may be necessary to seize hardware or data 1-Voluntary surrender (the subject freely gives investigators what they need) 2-Subpoena (A court order that compels a custodian to produce requested hardware or data 3-Search Warrant (a court order that allows law enforcement to seize hardware or data without prior notification of the subject) Employee Agreement (an up-front agreement to voluntarily surrender if requested)

Video Content Lesson 11 Flashcards

(48 cards)