ISM 3013 Chapter 12 Review – Flashcards

In information security, which of the following is true of managing risk? - All organizations except financial institutions should invest heavily in security safeguards. - Organizations should implement safeguards that balance the trade-off between risk and cost. - Passwords are classified under the technical safeguards category. - Physical security is classified under the human safeguards category.

In asymmetric encryption, each site has a ________ for encoding messages. - botnet - private key - public key - cookie

The single most important computer security safeguard that can be implemented is to create and use passwords that comprise of names. -True - False

Which of the following usually happens in a malicious denial-of-service attack? - a hacker monitors and intercepts wireless traffic at will - a hacker floods a Web server with millions of bogus service requests - an intruder uses another site's IP address to masquerade as that other site - a phisher pretends to be a legitimate company and requests confidential data

A ________ is a number used to encrypt data. - key - honeypot - cookie - cache

Unauthorized data disclosures are possible due to human error. - True - False

________ are small files that the browser stores on the user's computer when he/she visits Web sites and enables him/her to access Web sites without having to sign in every time. - Cookies - Botnets - Payloads - Public keys

Phishing is a technique for intercepting computer communications. - True - False

A ________ is a person or an organization that seeks to obtain or alter data or other IS assets illegally, without the owner's permission and often without the owner's knowledge. - target - vulnerability - threat - key escrow

Which of the following statements is true about human safeguards for employees? - Security screening in an organization is a one-time process and applies only to new employees. - User accounts should be defined to give users the least possible privilege necessary to perform their jobs. - Companies should provide user accounts and passwords to employees prior to their security training. - System administrators should retain user accounts after an employee has been terminated.