Deck 10: E-Commerce Fraud and Security

Question 1

Biometric systems are authentication systems that identify a person by measurement of a biological characteristic,such as fingerprints,iris patterns,facial features,or voice.

Answer 1

True

Question 2

Hackers are able to easily gain access to a network when IS staff do not ensure that all traffic into and out of a network passes through a firewall.

Answer 2

True

Question 3

The attacks and defense of computers can affect individuals,organizations,countries,or the entire Web.

Answer 3

True

Question 4

Spam is rampant because some people respond to it and make it profitable.

Question 5

Administrators need to check the integrity of programs and patches that are installed;and new programs and tools should be installed in a test environment before putting them into a production environment.

Question 6

The Internet was designed for maximum efficiency and security by providing for error checking to ensure that the message was sent and received correctly,user authentication,and access control.

Question 7

Seattle's Northwest Hospital and Medical Center was attacked by malware that was able to enter their network through a Windows flaw.

Question 8

Active tokens are storage devices (e.g. ,magnetic strip)that contain a secret code used in a two-factor authentication system.

Question 9

An EC security strategy requires multiple layers of defense against risks from malware,fraudsters,customers,and employees.

Question 10

There is a clear shift in the nature of the operation of computer criminals from the desire for fame to the desire for financial gain.

Question 11

Shoppers can rely on online fraud protection provided by credit card issuers to protect them from identity theft.

Question 12

According to the CSI 2008 Security Survey,the most expensive security incidents were those involving viruses.

Question 13

An intrusion detection system uses the public Internet to carry information but remains private by using encryption,authentication,and access control to verify the identity of anyone using the network.

Question 14

An IP address uniquely identifies each computer connected to a network or the Internet.

Question 15

Major information security methods used in 2008 included antivirus software,firewalls,VPNs,encryption,and Web filtering.

Question 16

The Internet,or more specifically the Internet and network protocols,was never intended for use by untrusted users or components.

Question 17

Protection of the U.S.computer networks is in the hands of the Department of the Interior (DOI).

Question 18

Risk creates vulnerability,which is the probability that this weakness will be known and used.

Question 19

SSL makes it possible to encrypt credit card numbers and other transmissions between a Web server and a browser,but it is not designed to check the validity of the credit card number.

Question 20

Social engineering is a type of technical attack to circumvent security measures by manipulating people to get them to reveal crucial authentication information.

Question 21

Due care in EC are those actions that a company is reasonably expected to take based on the risks affecting its business and transactions.

Question 22

The success and security of EC depends on the ________ of information and the business Web site.

A)encryption,functionality,and privacy
B)quality,reliability,and speed
C)authentication,authorization,and nonrepudiation
D)confidentiality,integrity,and availability

Question 23

What is a vulnerability?

A)software bug
B)risk of an attack or intrusion
C)spyware
D)weakness in software or network

Question 24

Because the consequences of weak network security can be severe,it is necessary that senior management have a basic understanding of best practices in network risk management.

Question 25

________ is a crimeware technique used to steal the identity of target companies to get the identities of their customers.

A)Spamming
B)Pretexting
C)Social engineering
D)Phishing

Question 26

The most cost-effective approach to EC security is to develop and implement a strategy that:

A)depends on the trust and confidence of customers.
B)proactively meets regulatory,financial,marketing and operational requirements.
C)protects against unauthorized transactions and overrides of accounting controls.
D)requires digital signatures or digital certificates for all transactions.

Question 27

________ systems are highly useful for both law enforcement and for law breaking,for example,by providing a means to obtain passwords or encryption keys and thus bypassing other security measures.

A)Biometric
B)Keystroke logging
C)Access control
D)Intrusion detection

Question 28

The ________ translates or converts domain names to their IP addresses.

A)IPS
B)DOS
C)VPN
D)DNS

Question 29

The protection of information systems against unauthorized access to or modification of information that is stored,processed,or being sent over a network is referred to as:

A)information assurance.
B)data integrity.
C)information integrity.
D)human firewall.

Question 30

The PCI data security standard was developed by the FTC to protect against credit card fraud and identity theft.

Question 31

A botnet is:

A)a collection of a few hundred hijacked Internet computers that have been set up to forward traffic,including spam and viruses,to other computers on the Internet.
B)a piece of software code that inserts itself into a host or operating system to launch DOS attacks.
C)a piece of code in a worm that spreads rapidly and exploits some known vulnerability.
D)a coordinated network of computers that can scan and compromise other computers and launch DOS attacks.

Question 32

Which of the following is not an underlying reason why a comprehensive EC security strategy is needed?

A)The Internet was designed for maximum efficiency without regard for its security or users with malicious intent.
B)The shift is toward profit-motivated crimes.
C)Managers treat EC security as a process.
D)Many companies fail to implement basic IT security management best practices,business continuity plans,and disaster recovery plans.

Question 33

Assurance that stored data has not been modified without authorization and a message that was sent is the same message that was received is referred to as:

A)integrity.
B)availability.
C)authentication.
D)nonrepudiation.

Question 34

The incidence of online fraud and identify theft would increase for each of the following reasons except:

A)There is growth in EC sales and the number of shoppers with higher incomes.
B)Information is a valuable form of currency.
C)Hackers are increasingly motived by fame and notoriety.
D)Scammers are outsourcing work to programmers to gain control of computers or wireless networks.

Question 35

________ refers to the e-markets for stolen information.

A)Internet underground economy
B)Denial of service
C)Cybercriminal
D)Virtual private network

Question 36

The assurance that an online customer or trading partner cannot falsely deny their purchase or transaction is referred to as:

A)integrity.
B)availability.
C)authentication.
D)nonrepudiation.

Question 37

Acceptable use policies (AUP)inform users of their responsibilities when a cyberattack or network intrusion has occurred.

Question 38

A CompTIA study revealed that more than half of all information security breaches that were related to human error had happened often because staff did not follow security procedures.

Question 39

According to the CSI 2008 Security Survey,the most expensive computer security incidents were those involving ________.

A)financial fraud
B)viruses and worms
C)unintentional human errors
D)targeted attacks

Question 40

The process of determining what the authenticated entity is allowed to access and what operations it is allowed to perform is known as:

A)integrity.
B)availability.
C)authentication.
D)nonrepudiation.

Question 41

________ refers to techniques to steal the identity of a target company to get the identities of its customers.

Question 42

Public key infrastructure (PKI)is an authentication method that:

A)has become the cornerstone for secure e-payments and intranet applications.
B)is based on the Data Encryption Standard,which is the standard symmetric encryption algorithm supported by U.S.government agencies.
C)encrypts and decrypts large amounts of data effectively.
D)uses encryption keys ranging from 64 bits to 128 bits.

Question 43

________ is a nontechnical attack that uses a ruse to trick users into revealing information or performing an action that compromises a computer or network.

Question 44

Which of the following statements about hardware and software security defenses is false?

A)Hardware and software security defenses protect against irresponsible business practices or corrupt management.
B)There is no single hardware or software solution appropriate for all companies.
C)If firewalls and antivirus software are not upgraded and monitored constantly,they will not remain useful.
D)After the EC security program and policies are defined and risk assessment completed,then the software and hardware needed to support and enforce them can be put in place.

Question 45

A host-based intrusion detection system (IDS):

A)uses rules to analyze suspicious activity at the perimeter of a network or at key locations in the network.
B)resides on the server that is being monitored where it can detect whether critical or security-related files have been tampered with or whether a user has attempted to access files that he or she is not authorized to use.
C)can perform certain actions when an attack occurs,such as terminating network connections based on security policies.
D)consists of information system resources-firewalls,routers,Web servers,database servers,and files that look like production systems,but do no real work.

Question 46

All of the following are characteristics of access control except:

A)Access control determines which persons,programs,or machines can legitimately use a network resource and which resources he,she,or it can use.
B)Access control lists (ACLs)define users' rights,such as what they are allowed to read,view,write,print,copy,delete,execute,modify,or move.
C)All resources need to be considered together to identify the rights of users or categories of users.
D)After a user has been identified,the user must be authenticated.

Question 47

The ________ was invented by Netscape to use standard certificates for authentication and data encryption to ensure privacy or confidentiality.

A)certificate authority
B)public key infrastructure
C)secure socket layer
D)digital envelope

Question 48

________ are weaknesses in software or other mechanisms that a hacker can use directly to gain access to a system or network.

Question 49

Why should EC companies comply with ethical privacy practices?

A)Customers need to trust that the online marketplace and its businesses will not violate the right to privacy.
B)Unethical privacy practices can have both immediate and long-term negative business consequences.
C)Violators expose themselves to harsh penalties from various government agencies and victimized customers,as well as bloggers and consumer interest groups.
D)All of the above

Question 50

Firewalls that filter requests from the Internet to a private network based on the IP address of the computer sending or receiving those requests are called:

A)application-level proxies.
B)bastion gateways.
C)packet-filtering routers.
D)IP blockers.

Question 51

Security functions or characteristics of digital signatures include all of the following except:

A)A digital signature is the electronic equivalent of a personal signature,which can be forged.
B)Digital signatures are based on public keys for authenticating the identity of the sender of a message or document.
C)Digital signatures ensure that the original content of an electronic message or document is unchanged.
D)Digital signatures are portable.

Question 52

Which is not an advantage of virtual private networks (VPN)for data communications?

A)They are less expensive than private leased lines because they use the public Internet to carry information.
B)They ensure the confidentiality and integrity of the data transmitted over the Internet without requiring encryption.
C)They can reduce communication costs dramatically because VPN equipment is cheaper than other remote solutions.
D)Remote users can use broadband connections rather than make long distance calls to access an organization's private network.

Question 53

Fingerprint scanners,facial recognition systems,and voice recognition all are examples of ________ that recognize a person by some physical trait.

A)biometric systems
B)human firewalls
C)intrusion detection systems
D)access control lists

Question 54

Which of the following is not a disadvantage of firewalls that act as packet filters?

A)Packet-filtering routers often are the first layer of network defense.
B)An administrator might miss some important rules,which would leave a hole in the firewall.
C)Because the content of a packet is irrelevant to a packet filter,once a packet is let through the firewall,the inside network is open to data-driven attacks.
D)An administrator might incorrectly specify a rule creating a vulnerability.

Question 55

An EC security strategy and program begins with:

A)the commitment and involvement of executive management.
B)layers of hardware and software defenses.
C)information security policies and training.
D)secure design of EC applications.

Question 56

Digital signatures or digital certificates:

A)are used to validate the sender and time stamp of the transaction so it cannot be later claimed that the transaction was unauthorized or invalid.
B)have been compromised by phishers and spammers.
C)provide complete confidence that the transactions are secure.
D)Both A and B

Question 57

The key reasons why EC criminals cannot be stopped include each of the following except:

A)Sophisticated hackers use browsers to crack into Web sites.
B)Strong EC security makes online shopping inconvenient and demanding on customers.
C)There is a lack of cooperation from credit card issuers and foreign ISPs.
D)Online shoppers do not take necessary precautions to avoid becoming a victim.

Question 58

Malicious code,also known as malware,is classified by how it ________.

Question 59

Any business activity that uses deceitful practices or devices to deprive another of property or other rights is known as ________.

Question 60

Authentication can be based on the public key infrastructure (PKI)which is based on:

A)message digest.
B)plaintext.
C)encryption.
D)key space.

Question 61

Policies that inform users of their responsibilities when using company networks,wireless devices,customer data,and so forth are known as ________.

Question 62

________ is the protection of information systems against unauthorized access to or modification of information whether in storage,processing,or in transit.

Question 63

A(n)________ is a huge number (e.g. ,hundreds of thousands)of hijacked Internet computers that have been set up to forward traffic,including spam and viruses,to other computers on the Internet.

Question 64

________ is the assurance of data privacy.

Question 65

________ are information system resources,such as firewalls,routers,Web servers,database servers and files,that only look like production systems to attack hackers and study their attempts to attack a network.

Question 66

________ is an exercise that determines the impact of losing the support of an EC resource to an organization,estimates how that loss may escalate over time,identifies the minimum resources needed to recover from the loss,and prioritizes the steps in the recovery of the processes and supporting systems.

Question 67

________ in EC are those actions that a company is reasonably expected to take based on the risks affecting its EC business and online transactions.

Question 68

________ is the process of transforming or scrambling data in such a way that it is difficult,expensive,or time-consuming for an unauthorized person to unscramble it.

Question 69

________ is the process of determining what the authenticated entity is allowed to access and what operations it is allowed to perform.

Question 70

________ are barriers between a trusted network or PC and the untrustworthy Internet.

Question 71

________ is assurance that online customers or trading partners cannot falsely deny their purchase or transaction.

Question 72

A(n)________ is a program that appears to have a useful function but contains a hidden function that presents a security risk.

Question 73

________ consist of all the policies,procedures,documents,standards,hardware,software,training,and personnel that work together to protect information,the ability to conduct business,and other assets.

Question 74

________ attacks are those in which a perpetrator uses some form of deception to trick people into revealing information or performing actions that harm the security of a network.

Question 75

A(n)________ attack is an attack in which a server gets so many requests for service or access that it crashes and cannot respond.

Question 76

________ is a process to verify the real identity of an entity,which could be an individual,computer,computer program,or EC Web site.

Question 77

The purpose of the ________ is to improve customers' trust in e-commerce,especially when it comes to online payments,and to increase the Web security of online merchants.

Question 78

________ is the assurance that data is accurate or that a message has not been altered.

Question 79

A virtual private network (VPN)uses the public Internet to carry information but remains private by using ________.

Question 80

A mathematical computation that is applied to a message,using a private key,to encrypt the message is called a(n)________.