Help
Options
Didn't know it?
click below
click below
Knew it?
click below
click below
Don't Know
Remaining cards (0)
Know
retry
shuffle
restart
0:00
Embed Code - If you would like this activity on your web page, copy the script below and paste it into your web page.
Normal Size Small Size show me how
Normal Size Small Size show me how
IAAS 245 Test 1
Study for Disaster Recovery Test 1
| Question | Answer |
|---|---|
| 3 Goals of Computer Security | Confidentiality, Integrity, Availability |
| Confidentiality | Controls are USER IDs and PASSWORDS. - Means PRIVACY. |
| Integrity | Only authorized users - Prevents unauthorized users from modification - Maintain internal & external consistency of data and programs |
| Availability | Denial of Server (DoS) - Loss of information system capabilities because of natural disasters - Equipment failures during normal use |
| Threat | A category of objects, persons or other entities that pose a potential risk of loss to an asset |
| Asset | An organizational resource that is being protected |
| List 3 Assets | Computer, Data, People |
| Vulnerability | A weakness or fault in the protection mechanisms that are intended to protect information and information assets from attack or damage |
| Exploit - Verb | Act of breaking into a system. - EXAMPLE: The hackers exploited the zero day vulnerability in Windows 7. |
| Exploit - Noun | Weakness/Poor Code - EXAMPLE: There is a zero day exploit in Windows 7. |
| Control | Represents security mechanisms, policies or procedures that can successfully counter attack, reduce risk, resolve vulnerabilities |
| Lists Examples of Control | Firewall, IDS, Usernames/Passwords, Encyption, Physical Security |
| Intellectual Property | Defines the ownership of ideas and control over the tangible or virtual representation of those ideas. - Examples: copyright, trademarks, patents |
| Software Piracy | Most common IP breach is the unlawful use or duplication of software-based intellectual property |
| Hackers | People who use and create computer software to gain access to information illegally. |
| Cyberterrorists | Hacks systems to conduct terrorist’s activities through network or Internet pathways. |
| Denial of Service (DoS) | Seeks to deny legitimate users access to services by either tying up server’s available resources or causing it to shut down |
| Virus | Segments of code that perform malicious actions. |
| Worm | Malicious programs that replication themselves constantly without requiring another program to provide a safe environment for replication. |
| Polymorphism | A threat that changes its appearance shape overtime, making it undetectable by techniques that look for preconfigured signatures. |
| Social Engineering Attack | Getting the computer user to perform an action that enables the infection. - Most Used Method = *PHONE* |
| Virus Attacks | The source of the most financial loss |
| Risk Identification | The process of examining and documenting the security posture of an organization’s IT and the risks it faces - **INFORMATION TECHNOLOGY |
| Risk Control | The process of applying controls to reduce the risks to an organizations data and information systems - **DATA & INFORMATION SYSTEMS |
| Risk Management | Identifying vulnerabilities in an organization’s information systems and taking carefully reasoned steps to ensure the confidentiality, integrity and availability of all the components in the organization’s information system - **VULNERABILITIES |
| Risk Assessment | Assigns a risk rating or score to each information asset - **RATING or SCORE |
| Likelihood | The probability that a specific vulnerability within an organization will be successfully attacked |
| Residual Risk | The risk that remains to the information asset even after the existing control has been applied |
| List the 4 Control Strategies | Avoidance, Transference, Mitigation, Acceptance |
| Avoidance | Prevent exploitation of the vulnerability - Preferred approach - Safeguards |
| Transference | Shift the risk to other assets - Buy insurance - Outsource |
| Mitigation | Reduce the impact - Incident response plan - Disaster recovery plan |
| Acceptance | DO NOTHING |
Created by:
uhohh
Popular American Government sets