Question Chapter 2
1. Both IT management and general management are responsible for implementation of information security that protects the organizations ability to function. Enforce policy.
2. No data, no record of transactions and no ability to deliver to its customers. Network and a secure infrastructure services.
3. Both IT and general management
4. More because business technology networks are now connected to the internet and other networks outside the organization. Makes it easier for people to gain access to the organizations networks.
5. Information extortion, an attacker steals information from a computer system and demands compensation for its return or agrees to not disclose it. If the hacker gains unauthorized use to a Military captain’s personal computer and discover obscene photos, he can blackmail the person in exchange for keeping photos undisclosed and equal loss of privacy and security for the captain.
6. Because employee mistakes can lead to the disclosure of classified data, entry of erroneous data, accidental deletion or modification of data and the storage of data in unprotected form and fail to follow procedures to protect data.
7. Avoid accessing confidential information while others are present, limit the # of times you access it, be aware of who is around you, shield paperwork or monitor from view.
8. Expert hackers have turned their attention to writing software. They are extremely talented individuals who usually devote a lot of time and energy to break into other peoples information systems.
9. Skilled hackers have a goal, can make their own backdoor programs and know what they are looking for, whereas unskilled rely on programs that they find on line and don’t know how to cover their tracks.
10. Viruses, worms, Trojan Horses, DOS attacks, logic bombs and back doors. Worms don’t require a host to replicate and uses flaws to spread in a network. Trojans are utilized by viruses as a host disguise for penetrating the system.
11. Polymorphism changes over time which makes it more difficult to detect.
12. Software piracy. Software licensing and SHA and BSA fight violations.
13. Force Of Nature
14. When technology becomes outdated. Proper planning and timely replacement of outdated technology.
15. Yes. Attackers can threaten that value by reducing or removing its availability to the owner or by stealing and then selling copies of the asset thus causing a loss in the economic value of the assets.
16. Cracking, Brute force and Dictionary. Limit the # of password attempts, enforce minimum complexity policy and disallow dictionary words in passwords.
17. Dos attacks are a single server sending a large # of connections in an attempt to overwhelm a target server. DDOS is when many users for many compromised systems simultaneously perform a DOS attack.
18. First gain access to the network to install the sniffer. Gain access by social engineering to get in building to plant the sniffer device.
19. By role playing to be someone else to gain physical access to the assets. Data entry clerk might be swayed by mentioning the CEO will be upset, an Administrative assistant would require more convincing than this.
20. Buffer overflow is when the receiver gets more data than the buffer can handle. The web server may allow an attacker to run executable code on the web server either by manipulating files directly or creating a backdoor for future use.