Principles of Information Security (4th edition) Chapter 1 – Flashcards
69 test answers
Unlock all answers in this set
Unlock answers 69question
Confidentiality
answer
The quality or state of information that prevents disclosure or exposure to unauthorized individuals or systems.
Unlock the answer
question
hash value
answer
A fingerprint of the author's message that is compared with the recipient's locally calculated hash of the same message.
Unlock the answer
question
Integrity
answer
The quality or state of being whole, complete, and uncorrupted.
Unlock the answer
question
Methodology
answer
A formal approach to solving a problem based on a structured sequence of procedures.
Unlock the answer
question
object of an attack
answer
The object or entity being attacked.
Unlock the answer
question
Organizational culture
answer
The specific social and political atmosphere within a given organization that determines the organization's procedures and policies and willingness to adapt to changes.
Unlock the answer
question
personnel security
answer
To protect the individual or group of individuals who are authorized to access the organization and its operations.
Unlock the answer
question
project team
answer
For information security, a group of individuals with experience in the requirements of both technical and nontechnical fields.
Unlock the answer
question
risk appetite
answer
The quantity and nature of risk that organizations are willing to accept.
Unlock the answer
question
security
answer
to be protected from adversaries - from those who would do harm, intentionally or otherwise.
Unlock the answer
question
threat agent
answer
a specific instance or component that represents a danger to an organization's assets. can be accidental or purposeful, for example lightning strikes or hackers.
Unlock the answer
question
utility
answer
the quality or state of having value for an end purpose. information that serves a purpose.
Unlock the answer
question
Attack
answer
An intentional or unintentional act that can cause damage to or otherwise compromise information and/or the systems that support it.
Unlock the answer
question
exposure
answer
a condition or state of being exposed
Unlock the answer
question
e-mail spoofing
answer
The act of sending an e-mail message with a modified field
Unlock the answer
question
Asset
answer
The organizational resource that is being protected. An asset can be logical, such as a Web site or information owned or controlled by the organization; or an asset can be physical, such as a computer system, or other tangible object.
Unlock the answer
question
bottom-up approach
answer
A method of establishing security policies that begins as a grassroots effort in which systems administrators attempt to improve the security of their systems.
Unlock the answer
question
C.I.A. Triangle
answer
The industry standard for computer security since the development of the mainframe. It is based on three characteristics that describe the utility of information: confidentiality, integrity, and availability.
Unlock the answer
question
chief information security officer (CISO)
answer
This position is typically considered the top information security officer in an organization. The CISO is usually not an executive-level position, and frequently the person in this role will report to the chief information officer (CIO).
Unlock the answer
question
Control
answer
Synonymous with safeguard and countermeasure. A security mechanism, policy, or procedure that can counter system attack, reduce risks, and resolve vulnerabilities.
Unlock the answer
question
Data custodians
answer
Individuals who are responsible for the storage, maintenance, and protection of information.
Unlock the answer
question
Data owners
answer
Individuals who determine the level of classification associated with data.
Unlock the answer
question
Data users
answer
Individuals who work with information to perform their daily jobs supporting the mission of the organization.
Unlock the answer
question
end user
answer
Synonymous with data user. An individual who uses computer applications for his daily work.
Unlock the answer
question
enterprise information security policy (EISP)
answer
Also known as a general security policy, IT security policy, or information security policy, this policy is based on and directly supports the mission, vision, and direction of the organization and sets the strategic direction, scope, and tone for all security efforts.
Unlock the answer
question
Exploit
answer
A technique used to compromise a system.
Unlock the answer
question
Exposure
answer
A single instance of a system being open to damage.
Unlock the answer
question
file hashing
answer
Method for ensuring information validity. Involves a file being read by a special algorithm that uses the value of the bits in the file to compute a single large number called a hash value.
Unlock the answer
question
Loss
answer
A single instance of an information asset suffering damage or unintended or unauthorized modification or disclosure.
Unlock the answer
question
McCumber Cube
answer
A graphical representation of the architectural approach widely used in computer and information security.
Unlock the answer
question
Object
answer
A passive entity in an information system that receives or contains information.
Unlock the answer
question
operations security
answer
A process used by an organization to deny an adversary information (generally not confidential information) about its intentions and capabilities by identifying, controlling, and protecting the organization"s planning processes or operations. OPSEC does not replace other security disciplines—it supplements them.
Unlock the answer
question
Phishing
answer
An attempt to obtain personal or financial information using fraudulent means, usually by posing as a legitimate entity.
Unlock the answer
question
physical security
answer
An aspect of information security that addresses the design, implementation, and maintenance of countermeasures that protect the physical resources of an organization.
Unlock the answer
question
Possession
answer
The quality or state of having ownership or control of some object or item.
Unlock the answer
question
Risk
answer
The probability that something can happen.
Unlock the answer
question
risk assessment specialist
answer
An individual who understands financial risk assessment techniques, the value of organizational assets, and security methods.
Unlock the answer
question
security policy developer
answer
An individual who understands the organizational culture, existing policies, and requirements for developing and implementing security policies.
Unlock the answer
question
security posture
answer
Synonymous with protection profile. The implementation of an organization"s security policies, procedures, and programs.
Unlock the answer
question
security professional
answer
A specialist in the technical and nontechnical aspects of security information.
Unlock the answer
question
Subject
answer
An active entity that interacts with an information system and causes information to move through the system for a specific purpose. Examples include individuals, technical components, and computer processes.
Unlock the answer
question
subject of an attack
answer
An agent entity that is used as an active tool to conduct an attack.
Unlock the answer
question
systems administrator
answer
An individual responsible for administering information systems.
Unlock the answer
question
systems development life cycle (SDLC)
answer
A methodology for the design and implementation of an information system
Unlock the answer
question
team leader
answer
For information security, a project manager who understands project management, personnel management, and technical requirements.
Unlock the answer
question
Threat
answer
An object, person, or other entity that represents a constant danger to an asset.
Unlock the answer
question
top-down approach
answer
A methodology of establishing security policies that is initiated by upper management.
Unlock the answer
question
Utility
answer
The quality or state of having value for an end purpose. Information has ____ if it serves a purpose.
Unlock the answer
question
Vulnerability
answer
Weakness in a controlled system, where controls are not present or are no longer effective.
Unlock the answer
question
waterfall model
answer
A methodology of the system development life cycle in which each phase of the process begins with the information gained in the previous phase.
Unlock the answer
question
Information Security (IS)
answer
To protect the confidentiality, integrity and availability of information assets, whether in storage, processing, or transmission. It is achieved via the application of policy, education, training and awareness, and technology.
Unlock the answer
question
Committee on National Security Systems
answer
CNSS
Unlock the answer
question
control, safeguard, or countermeasure
answer
security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve the security within an organization
Unlock the answer
question
salami theft
answer
aggregation of information used with criminal theft
Unlock the answer
question
Communications security
answer
the protection of communications media, technology, and content
Unlock the answer
question
Availability
answer
Enables authorized users -- persons or computer systems -- to access information without interference or obstruction and to receive it in the requested format
Unlock the answer
question
Accuracy
answer
when information is free from mistakes or errors and has the value that the end user expects
Unlock the answer
question
Authenticity
answer
The quality or state or being genuine or original, rather than a reproduction or fabrication
Unlock the answer
question
physical security, personnel security, operations security, communications security, network security, information security
answer
the six layers of security an organization should have in place to protect its operations
Unlock the answer
question
network security
answer
the protection of networking components, connections, and contents
Unlock the answer
question
Information security (CNSS definition)
answer
The protection of information and its critical elements, including the system and hardware that use, store, and transmit that information
Unlock the answer
question
Access
answer
a subject or object's ability to use, manipulate, modify, or affect another subject or object
Unlock the answer
question
protection profile or security posture
answer
the entire set of controls and safeguards, including policy, education, training and awareness, that the organization implements (or fails to implement) to protect the asset
Unlock the answer
question
subject of an attack
answer
an agent entity used to conduct the attack
Unlock the answer
question
pretexting
answer
phishing undertaken by law enforcement
Unlock the answer
