Podcast
Questions and Answers
A threat is a weakness or absence of safeguards.
A threat is a weakness or absence of safeguards.
False
Risk is the probability of a threat crossing or touching a vulnerability.
Risk is the probability of a threat crossing or touching a vulnerability.
True
Exploits are aimed at performing unauthorized operations.
Exploits are aimed at performing unauthorized operations.
False
Passive threats modify information or change the system state.
Passive threats modify information or change the system state.
Signup and view all the answers
Network intrusion risks include information theft and data loss.
Network intrusion risks include information theft and data loss.
Signup and view all the answers
Social Engineering and Phishing are types of network threats.
Social Engineering and Phishing are types of network threats.
Signup and view all the answers
Identity theft involves breaking into a computer to destroy or alter data records.
Identity theft involves breaking into a computer to destroy or alter data records.
Signup and view all the answers
Security aims to totally eliminate risk.
Security aims to totally eliminate risk.
Signup and view all the answers
A Distributed Denial of Service (DDoS) is a type of Brute Force Attack.
A Distributed Denial of Service (DDoS) is a type of Brute Force Attack.
Signup and view all the answers
Spyware can gather personal information from a computer without the user's permission.
Spyware can gather personal information from a computer without the user's permission.
Signup and view all the answers
Tracking Cookies are always considered a form of malware.
Tracking Cookies are always considered a form of malware.
Signup and view all the answers
Adware is a type of spyware used to collect information about a user based on websites visited.
Adware is a type of spyware used to collect information about a user based on websites visited.
Signup and view all the answers
Pop-ups are a type of spyware used to collect information about a user.
Pop-ups are a type of spyware used to collect information about a user.
Signup and view all the answers
Spam is a type of malware that can harm a computer.
Spam is a type of malware that can harm a computer.
Signup and view all the answers
Spammers use secure email servers to forward email.
Spammers use secure email servers to forward email.
Signup and view all the answers
DDoS attacks are designed to saturate and overwhelm network links with useless data.
DDoS attacks are designed to saturate and overwhelm network links with useless data.
Signup and view all the answers
Malware can only destroy data and leak confidential information.
Malware can only destroy data and leak confidential information.
Signup and view all the answers
Removable media is a propagation technique for malware.
Removable media is a propagation technique for malware.
Signup and view all the answers
Malware scanners are used to monitor activity.
Malware scanners are used to monitor activity.
Signup and view all the answers
A Security Policy is only for network security.
A Security Policy is only for network security.
Signup and view all the answers
Anti-spyware software can only detect spyware applications.
Anti-spyware software can only detect spyware applications.
Signup and view all the answers
Patches and updates are the same thing.
Patches and updates are the same thing.
Signup and view all the answers
Anti-virus software can only detect and remove viruses.
Anti-virus software can only detect and remove viruses.
Signup and view all the answers
Firewalls only filter incoming packets based on IP addresses.
Firewalls only filter incoming packets based on IP addresses.
Signup and view all the answers
Firewall products are only available as software.
Firewall products are only available as software.
Signup and view all the answers
Anti-spam software can only be loaded on email servers.
Anti-spam software can only be loaded on email servers.
Signup and view all the answers
Security risks can be completely eliminated with effective risk management.
Security risks can be completely eliminated with effective risk management.
Signup and view all the answers
Best practices for using a firewall include physically securing servers and network equipment.
Best practices for using a firewall include physically securing servers and network equipment.
Signup and view all the answers
Updating antivirus software files is not necessary for security.
Updating antivirus software files is not necessary for security.
Signup and view all the answers
Firewalls can only block incoming packets.
Firewalls can only block incoming packets.
Signup and view all the answers
The SANS Institute lists common security mistakes to educate users on security best practices.
The SANS Institute lists common security mistakes to educate users on security best practices.
Signup and view all the answers
Popup stopper software is only used to block pop-ups.
Popup stopper software is only used to block pop-ups.
Signup and view all the answers
End users should always open e-mail attachments without verifying their source and content.
End users should always open e-mail attachments without verifying their source and content.
Signup and view all the answers
Installing security patches for Microsoft Office and Microsoft Internet Explorer is not important for end users.
Installing security patches for Microsoft Office and Microsoft Internet Explorer is not important for end users.
Signup and view all the answers
Senior executives should assign untrained people to maintain security without providing training or time to learn.
Senior executives should assign untrained people to maintain security without providing training or time to learn.
Signup and view all the answers
Relying primarily on a firewall is a sufficient security measure for senior executives.
Relying primarily on a firewall is a sufficient security measure for senior executives.
Signup and view all the answers
IT people should connect systems to the Internet before hardening them.
IT people should connect systems to the Internet before hardening them.
Signup and view all the answers
Updating systems when security holes are found is not necessary for IT people.
Updating systems when security holes are found is not necessary for IT people.
Signup and view all the answers
Implementing firewalls with rules that stop malicious or dangerous traffic is not important for IT people.
Implementing firewalls with rules that stop malicious or dangerous traffic is not important for IT people.
Signup and view all the answers
Educating users on what to look for and what to do when they see a potential security problem is not necessary.
Educating users on what to look for and what to do when they see a potential security problem is not necessary.
Signup and view all the answers
Study Notes
Information Security Assets
- Assets include personals, hardware, software, physical devices, and documents
- Identifying assets is crucial for creating an information security system
Security Terminologies
- Threat: a person, thing, event, or idea that poses danger to an asset's confidentiality, integrity, availability, or legitimate use
- Vulnerability: a weakness or absence of safeguards
- Risk: a measure of the cost of a realized vulnerability
- Exploits: programs, scripts, or code that perform unauthorized operations
- Impacts: results of an exploited vulnerability (e.g., deleted files, loss of information, loss of company image)
Focus of Security
- Security deals with managing risk to critical assets
- Security is an exercise in loss reduction
- Risk is the probability of a threat crossing or touching a vulnerability
- Risk = Threat x Vulnerability
Threats
- Accidental threats: natural disasters
- Intentional threats: active and passive threats
- Passive threats: do not modify information or system state
- Active threats: alter information or system state
Network Threats
- Risks of network intrusion: information theft, data loss and manipulation, identity theft
- Sources of network intrusion: social engineering, phishing
- Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
- Brute force attacks: guessing passwords using a fast computer
- Spyware and tracking cookies: collecting personal information without permission
- Spam: sending unsolicited emails, overloading ISPs, email servers, and individual systems
Malware Capabilities
- Destruction of data
- Leaking confidential information
- Providing backdoor access
- Countless other opportunities
Propagation Techniques
- Removable media
- E-mail attachments
- Web browsing
- Social networking
- Network vulnerabilities
- Instant messaging applications
- Peer-to-peer networks
Malware Defense Techniques
- Activity monitoring programs
- Malware scanners
- File and resource integrity checking
- Stripping e-mail attachments
- Defense-in-depth
- Patching all systems
Common Security Measures
- Security Policy: a formal statement of rules for accessing technology and information assets
- Updates and Patches: fixing specific problems and adding functionality to software
- Anti-virus Software: preventing infection, detecting, and removing viruses, worms, and Trojan horses
- Anti-Spam: identifying spam and performing an action
- Anti-Spyware: detecting and deleting spyware applications
Firewalls
- What is a Firewall?: a security tool that controls traffic between networks and prevents unauthorized access
- Types of Firewall:
- Packet Filtering
- Application/Web Site Filtering
- Stateful Packet Inspection (SPI)
- Best Practices:
- Define security policies
- Physically secure servers and network equipment
- Set login and file access permissions
- Update OS and applications
- Change permissive default settings
- Run anti-virus and anti-spyware
- Update antivirus software files
- Activate browser tools
Mistakes People Make
- The SANS Institute's lists of mistakes that lead to security breaches
- The Four Worst Security Mistakes End Users Make
- The Six Worst Security Mistakes Senior Executives Make
- The Eight Worst Security Mistakes Information Technology People Make
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
This quiz covers key terms and concepts in information security, including assets, threats, vulnerabilities, and risk.
