Quiz 4: Information Security

The 2017 Equifax data breach occurred because attackers _______. A) exploited a vulnerability in some web application software B) sent e-mails to consumers with links to websites with malicious software C) used social engineering to get user IDs and passwords from employees D) were able to access discarded equipment with sensitive information

Equifax hired _______ to help after they suffered two breaches in 2017. A) Cylance B) Mandiant C) Praetorian D) Zero Trust

Consumers ___ put a freeze on their credit with the three credit bureaus; this is ____ for consumers. A) can; an appealing fix B) can; not an appealing fix C) cannot; is a problem for D)cannot; irrelevant

A(n) _________ to an information resource is any danger to which a system may be exposed. A) exposure B) risk C) threat D) vulnerability

The _________ of an information resource is the harm, loss, or damage that can result if a threat compromises that resource. A) exposure B) risk C) threat D) vulnerability

An information resource's _________ is the possibility that the system will be harmed by a threat. A) exposure B) risk C) threat D) vulnerability

Which of the following does NOT contribute to the increasing vulnerability of organizational information resources? A) Increasing skills necessary to be a computer hacker B) International organized crime taking over cybercrime C) Lack of management support D) Smaller, faster, cheaper computers and storage devices E) Today's interconnected, interdependent, wirelessly networked business environment

Which of the following does NOT contribute to the increasing vulnerability of organizational information resources? A) Additional management support B) Decreasing skills necessary to be a computer hacker C) International organized crime taking over cybercrime D) Smaller, faster, cheaper computers and storage devices E) Today's interconnected, interdependent, wirelessly networked business environment

A(n) _________ network is any network within your organization; a(n) _________ network is any network external to your organization. A) trusted; trusted B) trusted; untrusted C) untrusted; trusted D) untrusted; untrusted

Computer crimes typically average _________ of dollars and cause businesses _________ of dollars in damages. A) hundreds; millions B) hundreds; billions C) hundreds of thousands; millions D) hundreds of thousands; billions

Careless Internet surfing is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

You leave your laptop at your desk while you go to the restroom. This is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

You lose the company's USB with your sales spreadsheets on it. This is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

You open an e-mail from your friend that looks a little odd, but you figure your friend would never send you anything bad. This is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

You don't lock your computer when you go to the restroom. This is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

Carelessness using unmanaged devices is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

You get a new smartphone and throw your old one away without erasing all your data. This is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

You never wipe the dust off your computer. This is _________ and is an _________ mistake. A) a human error; intentional B) a human error; unintentional C) social engineering; intentional D) social engineering; unintentional

_________ is an attack in which the perpetrator uses social skills to trick or manipulate legitimate employees into providing confidential company information such as passwords. A) Espionage B) Malware C) Profiling D) Social engineering

You are a nice person, so you hold the door open for the person running in behind you. Since you needed to use your ID badge to open the door, the person running in behind you is __________; this is _________. A) shoulder surfing; a good way to show kindness that causes no harm B) shoulder surfing; an unintentional threat to your organization C) tailgating; a good way to show kindness that causes no harm D) tailgating; an unintentional threat to your organization

_________ is an unintentional threat. A) Espionage B) Identity theft C) Social engineering D) Software attacks

_________ occurs when an unauthorized individual attempts to gain illegal access to organizational information. A) Alien software B) Espionage C) Identity theft D) Information extortion

_________ occur(s) when an attacker either threatens to steal, or actually steals, information from a company and then demands payment for not carrying out a particular act. A) Alien software B) Espionage C) Information extortion D) SCADA attacks

_________ is a deliberate act that involves defacing an organization's website, potentially damaging the organization's image and causing its customers to lose faith. A) Espionage B) Sabotage C) SCADA attacks D) Software attacks

If humans are careless with laptops, this is an _________ error which could cause theft of equipment or information (an _________ error) . A) intentional; intentional B) intentional; unintentional C) unintentional; intentional D) unintentional; unintentional

Intellectual property is NOT protected under _________ laws. A) copyright B) patent C) privacy D) trade secret

A _________ is an intellectual work that is not based on public information. A) copyright B) patent C) trade secret D) trademark

A _________ is an official document that grants the holder exclusive rights on an invention or a process for a specified period of time. A) copyright B) patent C) trade secret D) trademark

A _________ is a statutory grant that provides the creators or owners of intellectual property with ownership of the property for a designated period. A) copyright B) patent C) trade secret D) trademark

Current US laws award patents for _________ years and copyright protection for _________ years. A) 20; 20 B) 20; life+70 C) life+70; 20 D) life+70; life+70

You purchased a copy of Microsoft Office and give a copy to a friend so he/she doesn't have to buy it too. This is _________ and is _________. A) piracy; legal B) piracy; illegal C) social engineering; legal D) social engineering; illegal

Piracy costs businesses _________ of dollars per year. A) hundreds B) millions C) billions D) trillions

_________ is a remote attack requiring user action. A) DoS B) A logic bomb C) A Trojan horse D) Virus

_________ is a remote attack requiring no user action. A) DoS B) A logic bomb C) A Trojan horse D) Virus

_________ is an attack by a programmer developing a system. A) DoS B) A phishing attack C) A Trojan horse D) Virus

Hackers would use a botnet to perform a _________. A) DDoS B) a logic bomb C) a Trojan horse D) virus

_________ causes pop-up advertisements to appear on your screen. A) Adware B) Marketware C) Spamware D) Spyware

_________ collects personal information about users without their consent. A) Adware B) Marketware C) Spamware D) Spyware

Keystroke loggers and screen scrapers are examples of _________. A) adware B) marketware C) spamware D) spyware

_________ is pestware that users your computer as a launch pad for unsolicited e-mail, usually advertising for products and services. A) Adware B) Marketware C) Spamware D) Spyware

Spam costs US companies _________ of dollars per year. A) hundreds B) millions C) billions D) trillions

If a hacker takes control of equipment such as power grids or nuclear power plants, this is an example of a(n) _________ attack. A) alien software B) espionage C) SCADA D) virus

_________ refers to malicious acts in which attackers use a target's computer systems to cause physical, real-world harm or severe disruption, often to carry out a political agenda. A) A SCADA attack B) Cyberterrorism C) Espionage D) Identity theft

The U.S. government considers the Sony hack _________. A) a SCADA attack B) cyberterrorism C) espionage D) identity theft

________ discovered a unique cryptographic key that triggered an unlock command for Onity hotel locks; ________ used computer code to rob hotel guests around the United States. A) Brocious; Brocious B) Brocious; Cashatt C) Cashatt; Brocious D) Cashatt; Cashatt

Part of the problem with the Onity lock hotel thefts is that although the problem was identified and presented at the Black Hat conference, Onity was unable to correct the issue _____________. A) because they had not included any update mechanism for the locks. B) because Cashatt and Brocious had already reprogrammed the locks, essentially locking Onity out of their own software. C) because there was no way of tracking which locks were compromised. D) because the hotels that utilized the locks had not maintained software updates.

A ______ attack is a targeted attempt to steal sensitive information from a company, such as financial data or personal details about employees. A) Phishing B) Spear-phishing C) Spear-whaling D) Whaling

The goal of whaling is to trick a(n) _______ into revealing personal or corporate data. A) executive B) factory worker C) janitor D) salesperson

The entire basis of a whaling attack is to ___________. A) appear as authentic as possible with actual logos, phone numbers, and various other details used in communications that come from fake email addresses. B) be as ambiguous and broad as possible so that no one person is targeted; rather, a large division in a company is. C) appeal to as many companies as possible at the same time, therefore increasing the likelihood that one will "take the bait." D) establish a line of communication with an entry-level employee or employees first to gain trust, and then gain access to larger systems.

Which well-known company has NOT fallen victim to a whaling attack at present? A) Snapchat B) Yahoo! C) Google D) Facebook

What is TRUE of the DarkHotel Group attacks? A) In 2017, they were able to extract over $100 million dollars from Facebook through whaling attacks. B) Despite utilizing a variation of the same type of attack on intellectual property for over a decade, the group continues to perpetrate cybercrimes and elude arrest. C) They have been specifically targeting political figures since sometime around 2007 by hacking into donor lists. D) The group is effective largely because they continually evolve their tactics.

Dyn is a cloud-based internet performance management company that provides DNS services for internet websites. It was attacked with _________ in 2016. A) alien software B) a DDoS C) espionage D) a SCADA attack

Dyn's hackers formed a botnet from _________. A) corporate servers B) devices incorporating the Internet of Things C) individuals willing to become part-time hackers D) programmers within the company

Jim finds out that someone accessed his bank account pretending to be him and stole thousands of dollars. This is an example of ____________. A) sabotage B) identity theft C) intellectual property D) information extortion

Sarah received an email that claimed to be from her bank. The email asked her to provide her password. Sarah later found out that the email was not from her bank and that she had given sensitive information to someone who gained access to her accounts. This is an example of a ____________. A) worm B) trojan horse C) phishing attack D) denial of service attack

An employee at ABC Inc. downloaded an email and opened the attachment contained within the message. Shortly afterwards all employees were blocked from accessing files on the company's servers and the criminals told ABC Inc. they would have to pay a large amount of Bitcoin to regain access to their files. ABC Inc. was a victim of ____________. A) ransomware B) identity theft C) spyware D) cyber warfare

If you accept the potential risk, continue operating with no controls, and absorb any damages that occur, you have adopted a risk _________ strategy. A) acceptance B) avoidance C) limitation D) transference

Your company decides not to implement security procedures because employees refuse to comply anyway. This is an example of risk _________. A) acceptance B) avoidance C) limitation D) transference

If you limit your risk by implementing controls that minimize the impact of the threat, you have implemented a risk _________ strategy. A) acceptance B) avoidance C) limitation D) transference

Your company hires FireEye to install security software and monitor your systems. This is an example of risk _________. A) acceptance B) avoidance C) limitation D) transference

If you shift your risk by using other means to compensate for the loss like purchasing insurance, you have implemented a risk _________ strategy. A) acceptance B) avoidance C) limitation D) transference

Your company decides to purchase security insurance from Travelers Insurance in case your systems get hacked and employee information is stolen. This is an example of risk _________. A) acceptance B) avoidance C) limitation D) transference

_________ is a physical control. A) A company gate B) Encryption C) A firewall D) VPN

_________ is an access control. A) A company gate B) Encryption C) A firewall D) RFID

_________ is a communications control. A) A company gate B) Encryption C) A firewall D) RFID

_________ controls prevent unauthorized individuals from gaining access to a company's facilities. A) Access B) Communications C) Physical D) Useful

_________ controls restrict unauthorized individuals from using information resources. A) Access B) Communications C) Physical D) Useful

_________ controls secure the movement of data across networks. A) Access B) Communications C) Physical D) Useful

Suppose your university automatically logs you off of a university computer after 15 minutes of disuse. This is an example of a(n) _________ control. A) access B) communication C) physical D) useful

Biometrics is an example of something the user _________. A) does B) has C) is D) knows

Your student ID is an example of something the user _________. A) does B) has C) is D) knows

If you have to speak into your phone to unlock it, this is an example of something the user _________. A) does B) has C) is D) knows

Typing in your password to access a system is an example of something the user _________. A) does B) has C) is D) knows

A(n) _________ is a system that prevents a specific type of information from moving between untrusted networks and private networks. A) anti-malware system B) DMZ C) ERP D) firewall

A(n) _________ is a software package that attempts to identify and eliminate viruses and worms. A) anti-malware system B) DMZ C) ERP D) firewall

A(n) _________ is located between two firewalls. A) anti-malware system B) DMZ C) ERP D) spamware detector

_________ is the process of converting an original message into a form that cannot be read by anyone except the intended receiver. A) Authorization B) Blacklisting C) Encryption D) Firewalling

In public-key encryption, the _________ key is used for locking and the _________ key is used for unlocking. A) private; private B) private; public C) public; private D) public; public

_________ is a private network that uses a public network to connect users. A) DoS B) ERP C) RFID D) VPN

Which of the following is NOT an advantage of VPN? A) Cost B) Flexibility C) Remote access D) Security

A URL that begins with https uses _________. A) DMZ B) ERP C) TLS D) VPN

A _________ site is a fully configured computer facility with all of the company's services, communication links, and physical plant operations. A) cold B) hot C) medium D) warm

A _________ site typically does not include the actual application the company needs to get the business back up and running immediately. A) cold B) hot C) medium D) warm

A _________ site provides only rudimentary services and facilities. A) cold B) hot C) medium D) warm

A _________ site is the most expensive option. A) cold B) hot C) medium D) warm

A _________ site is the least expensive option. A) cold B) hot C) medium D) warm

Suppose you have a primary location in New York City where you main corporate servers are located. Just in case something happens in New York City, you have backup servers that are updated every minute in Chicago. This is an example of a _________ site. A) cold B) hot C) medium D) warm

Auditing _________ the computer means verifying processing by checking for known outputs using specific inputs. A) around B) into C) through D) with

Auditing _________ the computer means auditors check inputs, outputs, and processing. A) around B) into C) through D) with

Auditing _________ the computer means using a combination of client data, auditor software, and client and auditor hardware. A) around B) into C) through D) with

Dave and Darla are worried about their home's security as there have been a lot of robberies in the neighborhood lately. To ease their concern, they purchase insurance for their home and possessions. This is an example of __________. A) risk analysis B) risk acceptance C) risk transference D) controls

XYZ Inc. scanned the fingerprints of all of their employees and now uses these fingerprints to authenticate their employees and grant them access to different areas of the company's facilities. XYZ Inc. is utilizing which type of technology? A) Cookies B) Intellectual Property C) Biometrics D) Malware

Judith works from home. In order to access her corporate email and other computer systems she logs into a virtual private network (VPN). The VPN is an example of _____________. A) a communications control B) a passphrase C) a digital certificate D) an audit

Triple Z Travelsite allows customers to reserve discount hotel rooms and airline tickets with certain companies they have relationships with. In order to secure the credit card information used by customers, which of the following controls would you recommend Triple Z use? A) Biometrics B) Transport layer security C) Whitelisting D) Audits

Ransomware negatively affected the city of Atlanta in many ways. Which vulnerability was the main cause of the problems? A) Today's interconnected, interdependent, wirelessly networked business environment B) Smaller, faster, cheaper computers and storage devices C) Decreasing skills necessary to be a computer hacker D) International organized crime taking over cybercrime E) Lack of management support

_______ is designed to erase information permanently, not to hold it ransom. A) Petya B) RobbinHood C) SamSam D) WannaCry

The 2017 Equifax data breach was more damaging to lenders than to consumers.

Equifax's CIO, CTO, and CEO lost their jobs due to the 2017 data breach.

Equifax could have upgraded and patched the software that was the cause of the breach.

An intranet is a trusted network.

VPN is a trusted network.

The internet is an untrusted network.

The recent trend indicates that CEOs lose their jobs after data breaches. In theory, this should impact the "lack of management support" factor that increases the vulnerability of organizational information resources.

Cybercrime is typically nonviolent but lucrative.

It is always safe to open e-mails and click on links from your friends.

If a hacker enters a building with an official-looking ID badge. This is considered social engineering.

Social engineers will often pose as real employees or contractors such as exterminators or fire marshals.

Social engineering is an unintentional threat on the part of the employee.

You are a nice person, so you hold the door open for the person running in behind you. Since you needed to use your ID badge to open the door, the person running in behind you is tailgating.

You need to be particularly careful of tailgating at airport terminals.

Competitive intelligence and espionage are similar except that competitive intelligence crosses the legal boundary.

Competitive intelligence is legal while espionage is illegal even though both involve collecting information about competitors.

Dumpster diving is always theft and is always illegal.

Once a copyright and patent is established, it applies to all countries in the world.

You purchased a copy of Microsoft Office and give a copy to a friend so he/she doesn't have to buy it too. This is piracy and is illegal.

You are a computer programmer who feels short-changed by your organization. To get back at them, you would most likely use a Trojan horse, back door, or logic bomb.

Cyberterrorism is typically carried out by individuals or groups whereas cyberwarfare is carried out by nation states or nonstate actors such as terrorists.

Onity replaced all vulnerable hotel room locks after someone published the computer code for an unlocking device.

It was easy and cheap for Aaron Cashatt to break into hotel rooms with Onity locks on them.

Whaling attacks are easier to detect than typical phishing attacks because they are so highly personalized and targeted.

Whaling attacks have the biggest impact on financial institutions due to the nature of their business; it is not a true concern for other types of organizations.

The Dyn DDoS hack illustrates the vulnerability of the Internet of Things.

The SCADA attacks on Dyn were so severe that they eventually blocked or significantly slowed user access to dozens of other websites like Twitter, Netflix, and CNN.

Dyn is a cloud-based internet performance management company that provides virtual private networks for internet websites.

IT security is the business of everyone in an organization.

People tend to violate security procedures because the procedures are inconvenient.

If you choose not to protect your information systems, you have adopted a risk acceptance strategy.

If you choose to spend as much as you can to protect your information systems, you have adopted a risk transference strategy.

If you choose limit your risk by implementing firewalls and other security measures, you have adopted a risk limitation strategy.

ID cards address physical and access controls.

Authentication occurs after authorization.

Passwords are a huge information security problem for all organizations.

Weak passwords can be addressed through multi-factor authentication.

Authorization means someone has privileges to do certain things on a system.

Anti-malware systems are generally reactive.

Whitelisting allows nothing to run unless it is on the whitelist.

Blacklisting allows everything to run unless it is on the list.

People, devices, software, and websites can be blacklisted and whitelisted.

Employee monitoring systems are illegal and unethical.

The external audit of information systems is frequently a part of the overall external auditing performed by a CPA firm.

People are not liable for fraudulent use of their credit cards.

A CPA firm typically performs an internal business audit.

Government systems typically lack resources and IT expertise and operate on outdated hardware and software. This makes them particularly vulnerable to ransomware attacks.

RobbinHood was a DDoS attack on the city of Atlanta.

___ refers to all the processes and policies designed to protect an organization's information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

A(n) ___ to an information resource is any danger to which a system may be exposed.

The ___ of an information resource is the harm, loss, or damage that can result if a threat compromises that resource.

An information resource's ___ is the possibility that the system will be harmed by a threat.

___ refers to illegal activities conducted over computer networks, particularly the internet.

___ involves rummaging through commercial or residential trash to find discarded information.

___ is the deliberate assumption of another person's identity, usually to gain access to his or her financial information or to frame him or her for a crime.

A ___ is an intellectual work that is not based on public information.

A ___ is an official document that grants the holder exclusive rights on an invention or a process for a specified period of time.

A ___ is a statutory grant that provides the creators or owners of intellectual property with ownership of the property for a designated period.

___ are small amounts of information that websites store on your computer, temporarily or more or less permanently.

A ___ is the probability that a threat will impact an information resource.

In risk ___, the organization takes concrete actions against risks.

Information security controls are also called ___.

___ controls prevent unauthorized individuals from gaining access to a company's facilities.

___ controls restrict unauthorized individuals from using information resources.

___ controls secure the movement of data across networks.

___ posits that users be granted the privilege for an activity only if there is a justifiable need for them to perform that activity.

___ is a process in which a company identifies the software that it will allow to run on its computers.

___ allows everything to run unless it is on the list.

What are the five factors that contribute to the increasing vulnerability of organizational information resources? Consider a current data breach and how each of these factors contributed to that breach.

Why are employees the biggest threats to an organization? What can you do to protect your future company's assets?

Identity theft is a deliberate threat to information systems and is one of the largest concerns of consumers and businesses today. What are the four techniques the book mentions for illegally obtaining information? How can you protect yourself from each of these threats?

Organizations spend a great deal of time and money protecting their information resources. To figure out what needs to be protected and how they are going to protect it, they need to perform risk management. What is the goal of risk management? List and describe the three processes of risk management. How can organizations mitigate risk? Describe a company that has adopted each risk mitigation strategy.

What are the six basic guidelines for creating strong passwords? Without divulging your passwords, how do your passwords "add up" and why? HINT: You should specifically address each of the six guidelines for your passwords. Now suppose you are a manager and you know employees won't have strong passwords, how do you address this issue?