Deck 12: Ethical, privacy, and Security Issues

Question 1

Most security experts recommend giving out specific information about a compromise in public forums,such as news reports,conferences,professional meetings,and online discussion groups.

Answer 1

False

Question 2

A virus is a piece of programming code,usually disguised as something innocuous that causes some unexpected and usually undesirable event.

Answer 2

True

Question 3

Nearly everyone would agree that it is acceptable to tell a lie to protect someone's feelings or to keep a friend from getting into trouble.

Answer 3

False

Question 4

The ethics officer tries to establish an environment that encourages ethical decision making.

Question 5

Making ethical decisions in the area of information technology is really no different than in other areas,although the specific issues may be different.

Question 6

More than 90 percent of major U.S.firms find it necessary to record and review employee communications and activities on the job,including e-mail,Web surfing,and phone usage.

Question 7

The security of any system or network is always about technology.

Question 8

Most firewalls are configured to allow e-mail and benign-looking attachments to reach their intended recipient.

Question 9

In a nonprofit corporation,the board reports to shareholders,customers,employees,suppliers,and the community.

Question 10

The board of directors is responsible for the careful and responsible management of an organization.

Question 11

The presence of a corporate ethics officer has become increasingly common.

Question 12

The IPS sits directly in front of the firewall and examines all the traffic passing through it.

Question 13

Viruses differ from worms in that they can propagate over a network without human intervention,sending copies of themselves to other computers by e-mail or Internet Relay Chat (IRC).

Question 14

Doing what is ethical is always easy in any situation.

Question 15

An organization should be prepared for the worst-a successful attack that defeats all or some of a system's defenses and damages data and information systems.

Question 16

Significant improvements in security can require years and do not come easy.

Question 17

The overwhelming majority of successful computer attacks are made possible by taking advantage of little-known vulnerabilities.

Question 18

Although private-sector employees can seek legal protection against an invasive employer under various state statutes,the degree of protection varies widely by state.

Question 19

Employees are increasingly evaluated on their demonstration of qualities and characteristics that are highlighted in the corporate code of ethics.

Question 20

Often a corporation will down play ethics policies following a major scandal within the organization.

Question 21

Discussing security attacks through public trials and the associated publicity not only has enormous potential costs in public relations,but no real monetary costs.

Question 22

A(n)____ defines an organization's security requirements as well as the controls and sanctions needed to meet those requirements.

A) information policy
B) security policy
C) computer policy
D) acceptable use policy

Question 23

The ____ Amendment of the Constitution protects citizens from unreasonable searches by the government and is often used to protect the privacy of government employees.

A) First
B) Fourth
C) Seventh
D) Tenth

Question 24

The concept of ____ recognizes that managers must use their judgment to ensure that the cost of control does not exceed the system's benefits or the risks involved.

A) reasonable assurance
B) reasonable acts
C) common acts
D) common assurance

Question 25

Ethical behavior conforms to ____.

A) legal guidelines
B) family rules
C) generally accepted social norms
D) company norms

Question 26

The ____ is a senior-level manager who provides vision and direction in the area of business conduct.

A) corporate ethics officer
B) chief executive officer
C) chief privacy officer
D) chief ethics officer

Question 27

A ____ stands guard between your organization's internal network and the Internet,and limits network access based on the organization's access policy.

A) router
B) choke device
C) concentrator
D) firewall

Question 28

In a for-profit corporation,the ____ primary objective is to oversee the organization's business activities and management for the benefit of all stakeholders,including shareholders,customers,employees,suppliers,and the community.

A) chief executive officer's
B) board of directors'
C) chief financial officer's
D) chief privacy officer's

Question 29

The code of ____ defines five widely accepted core principles concerning fair information practices of privacy protection.

A) Fairness Practices
B) Information Practices
C) Fairness of Information Practices
D) Fair Information Practices

Question 30

An essential part of follow-up is to determine how the organization's security was compromised so that it does not happen again.

Question 31

Antivirus software scans for a specific sequence of bytes,known as a(n)____.

A) virus part
B) virus signature
C) database
D) executable signature

Question 32

Expert crackers can conceal their identity and tracking them down can take a long time as well as a tremendous amount of corporate resources.

Question 33

It is crucial that antivirus software be updated continually with the latest virus detection information,called ____.

A) pattern databases
B) virus definitions
C) virus signatures
D) database patterns

Question 34

A ____ is an organization's review of potential threats to its computers and networks along with an analysis of the probability that these will occur and prevent the organization from meeting key business objectives.

A) risk tool
B) penetration test
C) network assessment
D) risk assessment

Question 35

Even if a company decides that the negative publicity risk from a security breach is worth it and goes after the perpetrator,documents containing proprietary information that must be provided to the court could cause even greater security threats in the future.

Question 36

All parties working on the problem need to be kept informed and up-to-date,even if it means using systems connected to the compromised system.

Question 37

____ refers to criminal activity in which a computer or a computer network is used as a tool to commit a crime or is the target of criminal activity.

A) Ecrime
B) Virtual crime
C) Cybercrime
D) Network crime

Question 38

A(n)____ works by using the Internet to relay communications,but maintains privacy through security procedures and tunneling protocols,which encrypt data at the sending end and decrypt it at the receiving end.

A) virtual network
B) encrypted public network
C) virtual private network
D) virtual public network

Question 39

Organizations need to define carefully employee ____ and to separate key responsibilities properly,so that a single person is not responsible for accomplishing a task that has high security implications.

A) privileges
B) authorizations
C) roles
D) authentications

Question 40

____ work to prevent an attack by blocking viruses,malformed packets,and other threats from getting into the company network.

A) Intrusion prevention systems
B) Firewalls
C) Concentrators
D) Routers

Question 41

The experience from an incident should be used to update and revise the ____ plan.

A) network plan
B) security incident response
C) security alert plan
D) network response plan

Question 42

A(n)____________________ test entails assigning individuals to try to break through the measures and identify vulnerabilities that still need to be addressed.

Question 43

___________________ software should be installed on each user's personal computer to scan a computer's memory and disk drives regularly for viruses.

Question 44

Creating a ____ of each compromised system on write-only media for later study,and as evidence,can be very useful.

A) forensic disk image
B) network trace
C) response plan
D) network image

Question 45

The ___________________ should provide guidance to help an organization recognize and deal with ethical issues,provide mechanisms for reporting unethical conduct,and foster a culture of honesty and accountability.

Question 46

____ captures valuable evidence for a future prosecution and provides data to help during the incident eradication and follow-up phases.

A) The response plan
B) Documentation
C) A system build plan
D) Network trace

Question 47

The _________________________ role includes "integrating their organization's ethics and values initiatives,compliance activities,and business conduct practices into the decision-making processes at all levels of the organization."

Question 48

Organizations should implement ____ to catch intruders in the act.

A) detection systems
B) deflection systems
C) prevention systems
D) monitored systems

Question 49

When dealing with customer data,strong measures are required to avoid customer ___________________ problems.

Question 50

In most corporations,the ___________________ is responsible for monitoring network security Web sites frequently and downloading updated antivirus software as needed.

Question 51

A ____ models normal behavior of a system and its users from reference information collected by various means.

A) behavior-based intrusion detection system
B) signature-based intrusion detection system
C) pattern-based intrusion detection system
D) role-based intrusion detection system

Question 52

All ____ should be created with enough frequency to enable a full and quick restoration of data if an attack destroys the original.

A) images
B) restorations
C) servers
D) backups

Question 53

___________________ is a broad class of cybercrime that involves the use of computer hardware,software,or networks to misrepresent facts for the purpose of causing someone to do or refrain from doing something that causes loss.

Question 54

The key to security is to implement a(n)____________________ security solution to make computer break-ins so difficult that an attacker eventually gives up.

Question 55

A(n)____ should be developed well in advance of any incident and be approved by both the organization's legal department and senior management.

A) response network
B) communication plan
C) alerting plan
D) response plan

Question 56

____________________ is a set of beliefs about right and wrong behavior.

Question 57

The ____ should define clearly the process for deciding if an attack is dangerous enough to warrant shutting down or disconnecting critical systems from the network.

A) response network
B) risk assessment
C) response plan
D) security policy

Question 58

In a security incident,the primary goal must be ____.

A) to attempt to monitor or catch an intruder
B) inflict damage to the intruder
C) to regain control and limit damage
D) to place the system back in service

Question 59

A thorough ____ should test system safeguards to ensure that they are operating as intended.

A) risk assessment
B) policy audit
C) penetration test
D) security audit

Question 60

A completed ____________________ identifies the most dangerous threats to a company and helps focus security efforts on the areas of highest payoff.

Question 61

Creating a detailed ____________________ of all events also will document the incident for later prosecution.

Question 62

Why is it important to conduct periodic IT security audits?

Question 63

A well-developed ____________________ helps keep an incident under technical and emotional control.

Question 64

List three specific responsibilities of an ethics officer.

Question 65

Because security incident documentation may become court evidence,an organization should establish a set of document handling procedures using the ____________________ department as a resource.

Question 66

A(n)_____________________ should be conducted after an incident to determine exactly what happened and to evaluate how the organization responded.

Question 67

List four tasks that are critical to establishing an effective data privacy program.

Question 68

A(n)______________________________ is software and/or hardware that monitors system and network resources and activities,and notifies network security personnel when it identifies possible intrusions from outside the organization or misuse from within the organization.

Question 69

List three potential costs of a security breach.

Question 70

Define corporate ethics and explain the primary function of a corporate ethics policy.