Exam 14: Computer Crime and Information Technology Security

Calvin works as an accountant for RRI Inc., a corporation that manages the financial assets of wealthy clients, such as movie stars and politicians. Calvin has not received a pay increase in three years and has grown unhappy in his position. He has been approached by a tabloid newspaper with an offer for significant monetary compensation in exchange for personal facts about RRI's clients. Because he feels unappreciated and underpaid, Calvin is seriously considering the tabloid's offer, even though it violates RRI's information security policy and the agreements RRI has with its clients. -If Calvin accepts the offer, the crime he commits will most likely involve computers as:

Computer crime taxonomy: Fill in each blank below with a word or phrase based on Carter's taxonomy of computer crime. a. Target: This category is comprised of computer crimes where the criminal targets ______. The objective of these crimes is to impact the ______ of data stored on the computer. b. Instrumentality: Computer as the instrumentality of the crime uses the computer to ______. The computer is used to ______. c. Incidental: This type of computer crime encompasses crimes where the computer is not ______ but is ______. The use of computer ______ and may make the crime more difficult to ______. d. Associated: The simple ______ of computers, and notably the growth of the Internet, has generated ______of ______. In these cases, technological growth essentially creates ______ and new ways of ______.

An unhappy employee introduces a virus that will shut down a company's information system if his name no longer appears in the payroll database. The employee's action is an example of which element of Carter's taxonomy?

Extortion is an example of: (i) a computer-associated crime, (ii) computer as incidental to a crime?

A bank teller steals money from the vault and covers up the theft by making a journal entry in the accounting information system. The teller's actions are an example of which element of Carter's taxonomy?

An attempt to gain access to a network or a system by bypassing security controls is referred to as a(n):

Which type of computer criminal is most closely associated with spamming, phishing, extortion and other profitable branches of computer crime?

As a business risk, extortion can be preceded by: (i) information theft, (ii) error, (iii) malicious software.

According to the COBIT accountability framework, the scope of corporate governance accountability and the scope of information governance accountability differ based on (i) the presence of disclosure, (ii) the stakeholders involved.

According to Carter's taxonomy of computer crime, which of the following best describes the computer as incidental?

The COBIT framework can be used to strengthen internal controls against computer crime by helping information systems professionals: (i) identify risk, (ii) assign responsibility, (iii) designate authority.

Identify the type of computer criminal described in each of the following cases. __________a. Could disrupt power grids, telecommunications and transportation systems __________b. Have been getting into spamming, phishing and extortion __________c. Inexperienced hacker who uses tools written by others to attack systems __________d. Possess advanced skills and have turned to hacking for the money __________e. Someone who invades an information system for malicious purposes __________f. Take advantage of computer intrusion techniques to gather information __________g. The largest threat to a company's information systems

Which type of computer criminal is least sophisticated in terms of computer knowledge?

According to Carter's taxonomy of computer crime, which of the following best describes the computer as a target?

Administrative security controls can be used to prevent problems with (i) confidentiality, (ii) data integrity, (iii) availability.

A customer's bank account should be credited with $10.532 interest. The bank's information system is most exposed to which of the following risks/threats?

Which type of internal control is most closely associated with COBIT's "compliance" information criterion?

Computer crime taxonomy, computer criminals and internal controls For each independent situation below, indicate: (a) the type of computer crime based on Carter's taxonomy, (b) the type of computer criminal and (c) one internal control that would address the crime. Note to instructor: The situations in this problem are different from those in Problem 7.