Information Security and HITECH Quiz

Hashes and Data Integrity

• Hashing is used for file distribution and communication verification, ensuring message integrity.
• A hash is a fixed-length value that represents data, acting like a fingerprint; altering the message changes the hash.

HITECH Act

• Promotes the adoption of health information technology, specifically electronic health records among healthcare providers.

Security Concepts

• Honeypots: Used to detect, monitor, and analyze attacker behavior by deliberately exposing vulnerabilities.
• Host Intrusion Detection System (HIDS): Software application that monitors local computers for suspicious activities.
• Intrusion Detection (IDS): Monitors and reports unauthorized activities in networks or applications.
• Intrusion Prevention Systems (IPS): Takes proactive actions against detected malicious activities.

Incident Response Process

• Involves key steps: Preparation, Detection & Analysis, Identification, Containment, Eradication, Recovery, and Post-incident Activity.

Compliance and Standards

• Industry Compliance: Refers to non-mandated standards designed for specific sectors, such as PCI DSS for payment card data protection.
• HIPAA: Ensures privacy protections for individuals' health information.
• GLBA: Protects bank customers' information through privacy regulations.
• FISMA: Provides a framework for securing government information systems.

Data Security Fundamentals

• Integrity: Ensures data remains unaltered.
• Interception: Unauthorized access to data or systems.
• Interruption: Attacks that disrupt asset availability.
• Anomaly-Based Detection: Identifies deviations from established network traffic baselines.

Risk Management and Analysis

• Vulnerability analysis is critical for identifying weaknesses in security systems.
• Access control lists (ACLs) regulate user permissions to resources.
• Risk assessments follow the identification of threats and vulnerabilities.

Threats and Vulnerabilities

• Phishing: Deceptive attempts to acquire sensitive information through fraudulent communications.
• Physical Threats: Include environmental factors (e.g., extreme temperatures, liquids) and human actions that can compromise assets.

Security Measures and Technologies

• Firewalls: Control network traffic, blocking unauthorized access.
• Anti-Malware Tools: Similar to IDS, they detect threats by recognizing signatures or abnormal activity.
• Hash Function: Produces a unique value for data without using an encryption key.
• Hardware Tokens: Generate one-time passwords as a security measure.

Assessing and Managing Incidents

• The incident response cycle includes preparation, detection, containment, eradication, recovery, and post-incident evaluations.
• Proper permissions and access management are essential to secure sensitive files in web applications.

General Concepts

• Identity: Refers to the claim of who or what a user is.
• Identity Verification: Process of confirming identity via different forms of identification.
• Admissibility of Records: Legal acceptance of records when properly tracked and regulated.

Miscellaneous

• Gamification: Application of game elements to enhance employee engagement in non-gaming settings.
• Penetration Testing: Simulates real-world attacks to evaluate an organization's security posture.