Chapter 1: Introduction to Security

TRUE/FALSE

	1.	The demand for IT professionals who know how to secure networks and computers is at an all-time low.

ANS:	F	PTS:	1	REF:	3

	2.	Recent employment trends indicate that employees with security certifications are in high demand.

ANS:	T	PTS:	1	REF:	4

	3.	The CompTIA Security+ Certification is aimed at an IT security professional with the recommended background of a minimum of two years experience in IT administration, with a focus on security.

ANS:	T	PTS:	1	REF:	4

	4.	Weakness in software can be more quickly uncovered and exploited with new software tools and techniques.

ANS:	T	PTS:	1	REF:	9

	5.	In a general sense, assurance may be defined as the necessary steps to protect a person or property from harm.

ANS:	F	PTS:	1	REF:	11

MULTIPLE CHOICE

	1.	An information security ____ position focuses on the administration and management of plans, policies, and people.
a.	manager	c.	auditor	
b.	engineer	d.	inspector	

ANS:	A	PTS:	1	REF:	3

	2.	A study by Foote Partners showed that security certifications earn employees ____ percent more pay than their uncertified counterparts.
a.	10 to 14	c.	13 to 14	
b.	12 to 15	d.	14 to 16	

ANS:	A	PTS:	1	REF:	4

	3.	The position of ____ is generally an entry-level position for a person who has the necessary technical skills.
a.	security technician	c.	CISO	
b.	security administrator	d.	security manager	

ANS:	A	PTS:	1	REF:	4

	4.	____ attacks are responsible for half of all malware delivered by Web advertising.
a.	“Canadian Pharmacy”	c.	Melissa	
b.	Fake antivirus	d.	Slammer	

ANS:	B	PTS:	1	REF:	5

	5.	Approximately ____ percent of households in the United States use the Internet for managing their finances.
a.	60	c.	80	
b.	70	d.	90	

ANS:	C	PTS:	1	REF:	5

	6.	In a ____ attack, attackers can attackers use hundreds or thousands of computers in an attack against a single computer or network.
a.	centered	c.	remote	
b.	local	d.	distributed	

ANS:	D	PTS:	1	REF:	10

	7.	The term ____ is frequently used to describe the tasks of securing information that is in a digital format.
a.	network security	c.	physical security	
b.	information security	d.	logical security	

ANS:	B	PTS:	1	REF:	12

	8.	____ ensures that only authorized parties can view information.
a.	Security	c.	Integrity	
b.	Availability	d.	Confidentiality	

ANS:	D	PTS:	1	REF:	12

	9.	____ ensures that information is correct and that no unauthorized person or malicious software has altered that data.
a.	Availability	c.	Integrity	
b.	Confidentiality	d.	Identity	

ANS:	C	PTS:	1	REF:	12

	10.	____ ensures that the individual is who they claim to be (the authentic or genuine person) and not an imposter.
a.	Encryption	c.	Authorization	
b.	Authentication	d.	Accounting	

ANS:	B	PTS:	1	REF:	13

	11.	In information security, a loss can be ____.
a.	theft of information	
b.	a delay in transmitting information that results in a financial penalty	
c.	the loss of good will or a reputation	
d.	all of the above	

ANS:	D	PTS:	1	REF:	16

	12.	In information security, an example of a threat agent can be ____.
a.	a force of nature such as a tornado that could destroy computer equipment	
b.	a virus that attacks a computer network	
c.	an unsecured computer network	
d.	both a and b	

ANS:	D	PTS:	1	REF:	16

	13.	Business ____ theft involves stealing proprietary business information such as research for a new drug or a list of customers that competitors are eager to acquire.
a.	identity	c.	plan	
b.	data	d.	record	

ANS:	B	PTS:	1	REF:	17

	14.	____ involves stealing another person’s personal information, such as a Social Security number, and then using the information to impersonate the victim, generally for financial gain.
a.	Cyberterrorism	c.	Phishing	
b.	Identity theft	d.	Scam	

ANS:	B	PTS:	1	REF:	17

	15.	Under the ____, health care enterprises must guard protected health information and implement policies and procedures to safeguard it, whether it be in paper or electronic format.
a.	HIPAA	c.	HCPA	
b.	HLPDA	d.	USHIPA	

ANS:	A	PTS:	1	REF:	18

	16.	What is the maximum fine for those who wrongfully disclose individually identifiable health information with the intent to sell it?
a.	$100,000	c.	$500,000	
b.	$250,000	d.	$1,000,000	

ANS:	B	PTS:	1	REF:	18

	17.	The ____ Act requires banks and financial institutions to alert customers of their policies and practices in disclosing customer information.
a.	Gramm-Leach-Bliley	c.	California Database Security Breach	
b.	Sarbanes-Oxley	d.	USA Patriot	

ANS:	A	PTS:	1	REF:	18

	18.	The single most expensive malicious attack was the 2000 ____, which cost an estimated $8.7 billion.
a.	Nimda	c.	Love Bug	
b.	Slammer	d.	Code Red	

ANS:	C	PTS:	1	REF:	19

	19.	____ are a loose-knit network of attackers, identity thieves, and financial fraudsters.
a.	Cybercriminals	c.	Computer spies	
b.	Cyberterrorists	d.	Hackers	

ANS:	A	PTS:	1	REF:	22

	20.	Targeted attacks against financial networks, unauthorized access to information, and the theft of personal information is sometimes known as ____.
a.	spam	c.	cybercrime	
b.	phishing	d.	cyberterrorism	

ANS:	C	PTS:	1	REF:	22

	21.	What is another name for unsolicited e-mail messages?
a.	spam	c.	trash	
b.	spawn	d.	scam	

ANS:	A	PTS:	1	REF:	23

COMPLETION

	1.	_________________________ is focused on protecting the valuable electronic information of organizations and users.

ANS:	Information security

PTS:	1	REF:	3

	2.	Security ____________________ have both technical knowledge and managerial skills and analyze and design security solutions within a specific entity.

ANS:	administrators

PTS:	1	REF:	4

	3.	In a general sense, ____________________ may be defined as the necessary steps to protect a person or property from harm.

ANS:	security

PTS:	1	REF:	11

	4.	____________________  provides tracking of events.

ANS:	Accounting

PTS:	1	REF:	13

	5.	An example of a(n) ____________________ that information security must deal with is a software defect in an operating system that allows an unauthorized user to gain access to a  computer without the user’s knowledge or permission.

ANS:	vulnerability

PTS:	1	REF:	16

MATCHING

Match the following terms to the appropriate definitions.
a.	asset	f.	risk	
b.	cyberterrorism	g.	threat	
c.	procedures	h.	threat agent	
d.	exploit	i.	vulnerability	
e.	computer spy	

	1.	the likelihood that a threat agent will exploit a vulnerability

	2.	intended to cause panic, provoke violence, or result in a financial catastrophe

	3.	a person or thing that has the power to carry out a threat

	4.	a person who has been hired to break into a computer and steal information

	5.	something that has value

	6.	to take advantage of a vulnerability

	7.	an event or action that might defeat security measures in place and result in a loss

	8.	a weakness that allows a threat agent to bypass security

	9.	plans and policies established by an organization to ensure that people correctly use the products

	1.	ANS:	F	PTS:	1	REF:	16

	2.	ANS:	B	PTS:	1	REF:	19

	3.	ANS:	H	PTS:	1	REF:	16

	4.	ANS:	E	PTS:	1	REF:	20

	5.	ANS:	A	PTS:	1	REF:	13

	6.	ANS:	D	PTS:	1	REF:	16

	7.	ANS:	G	PTS:	1	REF:	15

	8.	ANS:	I	PTS:	1	REF:	16

	9.	ANS:	C	PTS:	1	REF:	14

SHORT ANSWER

	1.	List and describe two of the four generally recognized security positions.

ANS:	
Chief Information Security Officer (CISO). This person reports directly to the CIO (large organizations may have more layers of management for reporting). Other titles used are Manager for Security and Security Administrator. They are responsible for the assessment, management, and implementation of security.

Security manager. The security manager reports to the CISO and supervises technicians, administrators, and security staff. Typically, a security manager works on tasks identified by the CISO and resolves issues identified by technicians. This position requires an understanding of configuration and operation but not necessarily technical mastery.

Security administrator. The security administrator has both technical knowledge and managerial skills. A security administrator manages daily operations of security technology, and may analyze and design security solutions within a specific entity as well as identify users’ needs.

Security technician. This is generally an entry-level position for a person who has the necessary technical skills. Technicians provide technical support to configure security hardware, implement security software, and diagnose and troubleshoot problems.

PTS:	1	REF:	4

	2.	Why is the speed of attacks making the challenge of keeping computers secure more difficult?

ANS:	
With modern tools at their disposal, attackers can quickly scan systems to find weaknesses and launch attacks with unprecedented speed. Many tools can even initiate new attacks without any human participation, thus increasing the speed at which systems are attacked.

PTS:	1	REF:	8

	3.	Discuss why delays in patching are making information security more difficult.

ANS:	
Hardware and software vendors are overwhelmed trying to keep pace with updating their products against attacks. One antivirus software vendor receives over 200,000 submissions of potential malware each month. At this rate, the antivirus vendors would have to update and distribute their updates every 10 minutes to keep users protected. The delay in vendors patching their own products adds to the difficulties in defending against attacks.

PTS:	1	REF:	9

	4.	List and describe three of the characteristics of information that must be protected by information security?

ANS:	
Three of the characteristics of information that must be protected by information security are:
1. Confidentiality—Confidentiality ensures that only authorized parties can view the information.
2. Integrity—Integrity ensures that the information is correct and no unauthorized person
or malicious software has altered that data.
3. Availability—Availability ensures that data is accessible to authorized users.

PTS:	1	REF:	12

	5.	Information security is achieved through a combination of what three entities? Provide at least one example of each entity.

ANS:	
1.  Products (physical security):  The physical security around the data. May be as basic as door locks or as complicated as intrusion-detection systems and firewalls.
2.  People (personnel security):  Those who implement and properly use security products to protect data.
3.  Procedures (organizational security): Plans and policies established by an organization to ensure that people correctly use the products.

PTS:	1	REF:	14

	6.	List three of the federal and state laws that have been enacted to protect the privacy of electronic data.

ANS:	
1.  The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
2.  The Sarbanes-Oxley Act of 2002 (Sarbox)
3.  The Gramm-Leach-Bliley Act (GLBA)
4.  The California Database Security Breach Act (2003)

PTS:	1	REF:	18

	7.	What is a hacker?

ANS:	
In the past, the term hacker was commonly used to refer to a person who uses advanced computer skills to attack computers. White hat hackers said that their goal was only to expose security flaws and not steal or corrupt data. Although breaking into another computer system is illegal, they considered it acceptable as long as they did not commit theft, vandalism, or breach any confidentiality while trying to improve security by seeking out vulnerabilities. In contrast, the term black hat hackers was used to refer to attackers whose motive was malicious and destructive.

However, today the term hacker has been replaced with the more generic term attacker, without any attempt to distinguish between the motives. Although “hacker” is often used by the mainstream media to refer to an attacker, this term is no longer commonly used by the security community.

PTS:	1	REF:	20

	8.	Describe script kiddies.

ANS:	
Script kiddies are individuals who want to break into computers to create damage yet lack the advanced knowledge of computers and networks needed to do so. Instead, script kiddies do their work by downloading automated attack software (scripts) from Web sites and using it to perform malicious acts.

Today, these scripts have been replaced by attack software with menu systems. This makes creating attacks even easier for these unskilled users.

PTS:	1	REF:	20

	9.	Briefly describe computer spies.

ANS:	
A computer spy is a person who has been hired to break into a computer and steal information. Spies do not randomly search for unsecured computers to attack as script kiddies and other attackers do; rather, spies are hired to attack a specific computer or system that contains sensitive information. Their goal is to break into that computer and take the information without drawing any attention to their actions. Spies generally possess excellent computer skills to attack and then cover their tracks.

PTS:	1	REF:	20

	10.	Describe the security principle of simplicity.

ANS:	
Because attacks can come from a variety of sources and in many ways, information security is by its very nature complex. The more complex something becomes, the more difficult it is to understand. A security guard who does not understand how motion detectors interact with infrared trip lights may not know what to do when one system alarm shows an intruder but the other does not. In addition, complex systems allow many opportunities for something to go wrong. In short, complex systems can be a thief’s ally.

The same is true with information security. Complex security systems can be hard to understand, troubleshoot, and feel secure about. As much as possible, a secure system should be simple for those on the inside to understand and use. Complex security schemes are often compromised to make them easier for trusted users to work with—yet this can also make it easier for the attackers. In short, keeping a system simple from the inside but complex on the outside can sometimes be difficult but reaps a major benefit.

PTS:	1	REF:	27