Exam 4: Information Security and Controls

Your company's headquarters was just hit head-on by a hurricane, and the building has lost power. The company sends you to their hot site to minimize downtime from the disaster. Which of the following statements is true?

_____ is the process in which an organization assesses the value of each asset being protected, estimates the probability that it will be compromised, and compares the probable costs of an attack with the costs of protecting the asset.

Authentication and authorization are synonyms.

Identify and discuss the factors that are contributing to the increasing vulnerability of organizational information assets.

_____ controls are concerned with user identification, and they restrict unauthorized individuals from using information resources.

Organizations utilize layers of controls because they face so many diverse threats to information security.

Biometrics are an example of:

_____ involves building an inappropriate trust relationship with employees for the purpose of gaining sensitive information or unauthorized access privileges.

Contrast the four types of authentication.

____________ is an intellectual work, such as a business plan, that is a company secret and is not based on public information.

Employees in which functional areas of the organization pose particularly grave threats to information security?

Bob is using public key encryption to send a message to Ted. Bob encrypts the message with Ted's _____ key, and Ted decrypts the message using his _____ key.

Which of the following is a characteristic of backups?

Define the principle of least privilege, and consider how an organization's senior executives might view the application of this principle.

A _____ attack uses deception to fraudulently acquire sensitive personal information by masquerading as an official e-mail.

Dumpster diving is always illegal because it involves trespassing on private property.

When companies attempt to counter _____ by requiring users to accurately select characters in turn from a series of boxes, attackers respond by using _____.

In the "Catching a Hacker" case study. The purpose of SpyEye is to _____________.

Not logging off the company network when gone from the office for any extended period of time is an example of which type of human mistake?

According to the "Catching a Hacker" case, ____________ is one of the most sophisticated and destructive malicious software programs ever developed.