Principles of information security 4th edition chapter 1 solutions

Once a n back door has infected a computer, it can redistribute itself to all e-mail addresses found on the infected system. A n polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures.

When voltage levels surge experience a momentary increase , the extra voltage can severely damage or destroy equipment. The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. ANS: F, cracker.

Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways. The malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. The application of computing and network resources to try every possible combination of options of a password is called a brute crack attack. One form of e-mail attack that is also a DoS is called a mail spoof, in which an attacker routes large quantities of e-mail to the target.

A n cookie can allow an attacker to collect information on how to access password-protected sites. Which of the following functions does information security perform for an organization? Protecting the data the organization collects and uses. All of the above. ANS: D 2. SSL c. PKC b. PKI d. Viruses c. Spam b. Worms d. Trojan horses ANS: D. Which of the following is an example of a Trojan horse program? Netsky c.

Klez b. MyDoom d. As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus. Web hosting services are usually arranged with an agreement providing minimum service levels known as a n. MSL b. SLA d. Complete loss of power for a moment is known as a.

Access controls regulate this ability. Asset: The organizational resource that is being protected. An asset can be logical, such as a Web site, information, or data; or an asset can be physical, such as a person, computer system, or other tangible object.

Assets, and particularly information assets, are the focus of security efforts; they are what those efforts are attempting to protect. Attacks can be active or passive, intentional or unintentional, and direct or indirect. Someone casually reading sensitive information not intended for his or her use is a passive attack. A hacker attempting to break into an information system is an intentional attack.

A lightning strike that causes a fire in a building is an unintentional attack. A direct attack is a hacker using a personal computer to break into a system. An indirect attack is a hacker compromising a system and using it to attack other systems, for example, as part of a botnet slang for robot network. Direct attacks originate from the threat itself.

Indirect attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat. Ima then applies the script which runs and compromises buybay's security controls and steals customer data. These actions cause buybay to experience a loss. The various levels and types of controls are discussed more fully in the following chapters. Exploit: A technique used to compromise a system.

This term can be a verb or a noun. Threat agents may attempt to exploit a system or other information asset by using it illegally for their personal gain.

Or, an exploit can be a documented process to take advantage of a vulnerability or exposure, usually in software, that is either inherent in the software or is created by the attacker. Exploits make use of existing software tools or custom-made software components. Exposure: A condition or state of being exposed. In information security, exposure exists when a vulnerability known to an attacker is present.

Loss: A single instance of an information asset suffering damage or unintended or unauthorized modification or disclosure. Protection profile or security posture: The entire set of controls and safeguards, including policy, education, training and awareness, and technology, that the Copyright Cengage Learning. Licensed to: CengageBrain User Introduction to Information Security 11 organization implements or fails to implement to protect the asset. The terms are sometimes used interchangeably with the term security program, although the security program often comprises managerial aspects of security, including planning, personnel, and subordinate programs.

Risk: The probability that something unwanted will happen. Organizations must minimize risk to match their risk appetite—the quantity and nature of risk the organization is willing to accept. Subjects and objects: A computer can be either the subject of an attack—an agent entity used to conduct the attack—or the object of an attack—the target entity, as shown in Figure A computer can be both the subject and object of an attack, when, for example, it is compromised by an attack object , and is then used to attack other systems subject.

Threat: A category of objects, persons, or other entities that presents a danger to an asset. Threats are always present and can be purposeful or undirected. For example, hackers purposefully threaten unprotected information systems, while severe storms incidentally threaten buildings and their contents. Threat agent: The specific instance or a component of a threat. For example, all hackers in the world present a collective threat, while Kevin Mitnick, who was convicted for hacking into phone systems, is a specific threat agent.

Likewise, a lightning strike, hailstorm, or tornado is a threat agent that is part of the threat of severe storms. Vulnerability: A weaknesses or fault in a system or protection mechanism that opens it to attack or damage. Some examples of vulnerabilities are a flaw in a software package, an unprotected system port, and an unlocked door.

Some well-known vulnerabilities have been examined, documented, and published; others remain latent or undiscovered. The value of information comes from the characteristics it possesses. When a characteristic of information changes, the value of that information either increases, or, more commonly, decreases. This can depend on circumstances; for example, timeliness of information can be a critical factor, because information loses much or all of its value when it is delivered too late.

For instance, end users may perceive a tenth-of-a-second delay in the computation of data to be an unnecessary annoyance. Information security professionals, however, may perceive that tenth of a second as a minor delay that enables an important task, like data encryption.

Each critical characteristic of information—that is, the expanded C. Availability Availability enables authorized users—persons or computer systems—to access information without interference or obstruction and to receive it in the required format. Consider, for example, research libraries that require identification before entrance.

Librarians protect the contents of the library so that they are available only to authorized patrons. Once authorized patrons have access to the contents of the stacks, they expect to find the information they need available in a useable format and familiar language, which in this case typically means bound in a book and written in English. Accuracy Information has accuracy when it is free from mistakes or errors and it has the value that the end user expects.

If information has been intentionally or unintentionally modified, it is no longer accurate. Consider, for example, a checking account. You assume that the information contained in your checking account is an accurate representation of your finances. Incorrect information in your checking account can result from external or internal errors. If a bank teller, for instance, mistakenly adds or subtracts too much from your account, the value of the information is changed.

Or, you may accidentally enter an incorrect amount into your account register. Either way, an inaccurate bank balance could cause you to make mistakes, such as bouncing a check. Authenticity Authenticity of information is the quality or state of being genuine or original, rather than a reproduction or fabrication. Information is authentic when it is in the same state in which it was created, placed, stored, or transferred. Consider for a moment some common assumptions about e-mail.

When you receive e-mail, you assume that a specific individual or group created and transmitted the e-mail—you assume you know the origin of the e-mail. This is not always the case. E-mail spoofing, the act of sending an e-mail message with a modified field, is a problem for many people today, because often the modified field is the address of the originator. Spoofing can also alter data being transmitted across a network, as in the case of user data protocol UDP packet spoofing, which can enable the attacker to get access to data stored on computing systems.

Another variation on spoofing is phishing, when an attacker attempts to obtain personal or financial information using fraudulent means, most often by posing as another individual or organization. Pretending to be someone you are not is sometimes called pretexting when it is undertaken by law enforcement agents or private investigators. When used in a phishing attack, e-mail spoofing lures victims to a Web server that does not represent the organization it purports to, in an attempt to steal their private data such as account numbers and passwords.

The most common variants include posing as a bank or brokerage company, e-commerce organization, or Internet service provider. Even when authorized, pretexting does not always lead to a satisfactory outcome. The resulting firestorm of negative publicity led to Ms. Confidentiality ensures that only those with the rights and privileges to access information are able to do so. When unauthorized individuals or systems can view information, confidentiality is breached.

To protect the confidentiality of information, you can use a number of measures, including the following: Information classification Secure document storage Application of general security policies Education of information custodians and end users Confidentiality, like most of the characteristics of information, is interdependent with other characteristics and is most closely related to the characteristic known as privacy.

Individuals who transact with an organization expect that their personal information will remain confidential, whether the organization is a federal agency, such as the Internal Revenue Service, or a business. Problems arise when companies disclose confidential information. Sometimes this disclosure is intentional, but there are times when disclosure of confidential information happens by mistake—for example, when confidential information is mistakenly e-mailed to someone outside the organization rather than to someone inside the organization.

Several cases of privacy violation are outlined in Offline: Unintentional Disclosures. Other examples of confidentiality breaches are an employee throwing away a document containing critical information without shredding it, or a hacker who successfully breaks into an internal database of a Web-based organization and steals sensitive information about the clients, such as names, addresses, and credit card numbers.

As a consumer, you give up pieces of confidential information in exchange for convenience or value almost daily. When you fill out an online survey, you exchange pieces of your personal history for access to online privileges. The bits and pieces of your information that you disclose are copied, sold, replicated, distributed, and eventually coalesced into profiles and even complete dossiers of yourself and your life. A similar technique is used in a criminal enterprise called salami theft.

A deli worker knows he or she cannot steal an entire salami, but a few slices here or there can be taken home without notice. Eventually the deli worker has stolen a whole salami. In information security, salami theft occurs when an employee steals a few pieces of information at a time, knowing that taking more would be noticed—but eventually the employee gets something complete or useable.

Integrity Information has integrity when it is whole, complete, and uncorrupted. The integrity of information is threatened when the information is exposed to corruption, Copyright Cengage Learning.

Licensed to: CengageBrain User 14 Chapter 1 Offline Unintentional Disclosures In February , the data aggregation and brokerage firm ChoicePoint revealed that it had been duped into releasing personal information about , people to identity thieves during The perpetrators used stolen identities to create obstensibly legitimate business entities, which then subscribed to ChoicePoint to acquire the data fraudulently.

The company reported that the criminals opened many accounts and recorded personal information on individuals, including names, addresses, and identification numbers. They did so without using any network or computer-based attacks; it was simple fraud. The giant pharmaceutical organization Eli Lilly and Co. The American Civil Liberties Union ACLU denounced this breach of privacy, and information technology industry analysts noted that it was likely to influence the public debate on privacy legislation.

The company claimed that the mishap was caused by a programming error that occurred when patients who used a specific drug produced by the company signed up for an e-mail service to access support materials provided by the company.

About patient addresses were exposed in the mass e-mail. Corruption can occur while information is being stored or transmitted. Many computer viruses and worms are designed with the explicit purpose of corrupting data. For this reason, a key method for detecting a virus or worm is to look for changes in file integrity as shown by the size of the file.

Another key method of assuring information integrity is file hashing, in which a file is read by a special algorithm that uses the value of the bits in the file to compute a single large number called a hash value.

The hash value for any combination of bits is unique. If a computer system performs the same hashing algorithm on a file and obtains a different number than the recorded hash value for that file, the file has been compromised and the integrity of the information is lost.

Information integrity is the cornerstone of information systems, because information is of no value or use if users cannot verify its integrity. File corruption is not necessarily the result of external forces, such as hackers. Noise in the transmission media, for instance, can also cause data to lose its integrity. Transmitting data on a circuit with a low voltage level can alter and corrupt the data. Redundancy bits and check bits can compensate for internal and external threats to the integrity of information.

During each transmission, algorithms, hash values, and the error-correcting codes ensure the integrity of the information. Data whose integrity has been compromised is retransmitted. Information has value when it can serve a purpose. Uploaded by Brian. Document Information click to expand document information Description: Principles of information security chapter 1. Original Title Principles of information security chapter 1. Did you find this document useful?

Is this content inappropriate? Report this Document. Description: Principles of information security chapter 1. Flag for inappropriate content.

Download now. Save Save Principles of information security chapter 1 For Later. Principles of Information Security Chapter 1. Original Title: Principles of information security chapter 1. Related titles. Carousel Previous Carousel Next. Gopalakrishna Committee Report Summary Presentation. Jump to Page.

Search inside document. About the Presentations The presentations cover the objectives found in the opening of each chapter. Documents Similar To Principles of information security chapter 1. Ashwin Shankar. Bruno Santos. Diego Lanzani. Vinay Goyal. Donald Harper.

Subhasmita Patel. Atif Saeed. ERS Consultancy. Marcelle Alam. Spit Fire. Luis Sosa. Viet Quang Tran. Itumeleng Kekana. Abdullah Bin Kasem Bhuiyan. Rashmi George. More From Brian. Popular in Fail Safe. Agus Waluyo. John Moubray - Reliability-centred Maintenance 2. Fachransjah Aliunir. Doru Toader. Puviyarasan M. Partha Kar.