Comp3704 Midterm Exam Questions With Multiple Choices And Verified Answers.

Data - correct answer ---- can be any character, number, text, word, or binary representation but is lacking context. ----- that is given context and meaning then becomes information Information - correct answer Any communication or representation of knowledge.Such as facts, data, or opinions In any medium or form including but not limited to: textual, numerical, graphic, cartographic, narrative audiovisual Information System - correct answer Any organized system for the collection, organization, storage and communication of information.. A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Information Technology - correct answer Any equipment or interconnected system or subsystem of equipment that is used in the automatic... Acquisition Storage Management Movement Control Display Switching Interchange Transmission Reception Information Security - correct answer The practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information ROT-13 Cipher - correct answer Move character 13 places in it's alphabetic position. A-Z = 1-26 . first/early form of a cipher and cryptography used by Ceaser Communication Security: Enigma Machine - correct answer Invented at the end of WWI. Used commercially in '20s, and by military/governments before & during WWII. Although it had some cryptographic weaknesses, it failed due to operator mistakes, procedural flaws, and allied capture of key table and hardware Hackers - correct answer Technical experts; skilled, often young, computer programmers, who almost whimsically probe the defenses of a computer system, searching out the limits and the possibilities of the machine. Despite their seemingly subversive role, hackers are a recognized asset in the computer industry, often highly prized. Security threats - correct answer Spam Malware Botnets Social Engineering Mainstream Viruses Hacking Tools The CIA Triad: - correct answer Confidentiality, Integrity and Availability Confidentiality - correct answer The property that sensitive information is not disclosed to unauthorized individuals, entities, or processes Integrity - correct answer The property that sensitive data has not been modified or deleted in an unauthorized and undetected manner Availability - correct answer The property that information is accessible in a timely and reliable manner InfoSec Mechanisms - correct answer Authentication (AuthN) ,Authorization (AuthZ), Non-Repudiation / Accounting Authentication - correct answer Verify (with a certain level of confidence) the identity of a user, process, device, or other entity. and Encompasses identity verification, message origin authentication, and message content authentication. Authorization - correct answer Grant and restrict information and system privileges to a user, program, process, or other entity. Once you have been identified, what actions can you perform? Non-Repudiation - correct answer Protect against an individual falsely denying having performed a particular action. Provides the capability to determine whether a given individual took a particular action such as creating information, sending a message, approving information, and receiving a message. How can the improper storage of passwords be a non-repudiation issue? If more than one person knows the password at any time non-repudiation is nulled This includes system admins storing passwords in the clear This also includes password complexity scanning and cracked passwords Makes evidence against computer crimes less admissible in court Prioritize the CIA properties for these types of information - correct answer Your bank card PIN An electronic money transfer / bill payment Your healthcare records Your laptop Principle of Least Privilege - correct answer Only allow access to information (systems) according to necessity. Minimizes the attack surface. Users should be able to perform only the actions required for their job What are some examples of highly priviledged users? Administrators How about payroll? How about software developers? Should everyone have access to everything? Requires careful analysis of business roles Defense in Depth - correct answer Employ layers of defense to reduce risk of harm to assets. Maximize defenses against threats. E.g. locked cabinet and admin password protects integrity of lab computers. E.g. cyber-intelligence and lots of bandwidth reduces the risk of a DDOS attack harming my company. Basically never say things like "Oh, but we have a firewall so why do we need to do that too?" What are some examples of Defense in Depth during daily life? Your car door has a lock, so why do you need an alarm? Your house has a lock and an alarm, so why do you have a safe? - correct answer Policies - correct answer Is clear and concise Outlines the consequences of not being followed Make them modular Don't reference document/information locations that might change Solicit feedback - correct answer Something of value. Something worth protecting. - correct answer A measure of harm that could affect an asset. Risk is calculated and measurable Threat - correct answer A condition or event that could result in harm to an asset Threat Scenario - correct answer A set of discrete threat events, associated with a specific threat source or multiple threat sources, partially ordered in time. Threat Source / Threat Agent - correct answer An individual, group or external entity that can manifest a threat A situation and method that may accidentally trigger a vulnerability. Not all threats are malicious eg: earthquake Vulnerability - correct answer A weakness that makes the asset susceptible to harm from the threat An absence of a safeguard protecting an asset from a threat source. Control / Countermeasure - correct answer Actions , devices , procedures , or techniques that reduce a vulnerability. A control is put in place counteract or lessen the vulnerability Risk equation - correct answer RISK = Asset * Threat * Vulnerability DREAD - correct answer Damage (how bad) Reproducibility (how often) Exploitability (how easy) Affected Users (how many users are affected) Discoverability (how easy to find) Control Triads - correct answer • Logical • Physical • Procedural • Preventative • Detective • Corrective • Technical • Management • Operational Physical Controls - correct answer controls that restrict unauthorized individuals from gaining access to a company's computer facilities What are some physical controls? - correct answer Locks protect access to sensitive locations Biometric scanners Security guards Guard dogs Faraday Cages block radio signals in highly sensitive areas Discretionary Controls - correct answer Should you put up a "welcome" sign advertising your company's data center? A huge fence with security guards? Logical/Technical Controls - correct answer User identification and authentication mechanisms control fraud vulnerabilities. Firewalls control network vulnerabilities. Antivirus software controls malware vulnerabilities. Cryptography controls information disclosure and tampering vulnerabilities. Procedural Controls - correct answer Dual Authorization Incident response procedures Security awareness training Implementing "Principle of Least Privilege" Preventative Controls - correct answer Locks, Security G