Question 1

What is the difference between a computer-assisted crime and a computer-targeted crime?

Accepted Answer

The difference between a computer-assisted crime and a computer-targeted crime is that in the computer-assisted crime, a computer is used as a tool. This is done to help carry out a crime. A computer-targeted crime concerns incidents wherein a computer was the victim of an attack crafted to harm it and its owners specifically.

Question 2

Pete is transferring evidence in a particular manner from Holland to China for forensic testing. Who has determined how computer evidence is to be handled?

Accepted Answer

The International Organization on Computer Evidence (IOCE) determines how computer evidence is to be handled. The IOCE was created to develop international principles dealing with how digital evidence is to be collected and handled so various courts will recognize and use the evidence in the same manner. State-side, the Scientific Working Group on Digital Evidence (SWDGE) exists. The IOCE and the SWDGE developed a standardized recovery of computer-based evidence with the following attributes: consistency with all legal systems, allowance for the use of a common language, durability, ability to cross international and state boundaries, ability to instill confidence in the integrity of evidence, applicability to all forensic evidence, and applicability at every level including that of individual, agency, and country.

Question 3

Evidence has its own life cycle and courts and laws find evidence categories to garner different weight and values. What type of evidence provides the greatest amount of reliability?

Accepted Answer

Best evidence is the primary evidence used in a trial because it provides the most reliability. Oral evidence is not considered best evidence because there is not firsthand reliable proof that supports its validity and it therefore does not have as good of standing as legal documentation. Oral evidence may be used to interpret a legal document, but it cannot be used to dispute it.

Question 4

Evidence has its own life cycle and courts and laws find evidence categories to garner different weight and values. What type of evidence can prove a fact all by itself?

Accepted Answer

Direct evidence can prove a fact all by itself and does not need backup information to refer to. When direct evidence is used, presumptions are not required, such as an eye witness. Although oral evidence would be secondary in nature, it is still direct evidence. Direct evidence often is based on information gathered from a witness's five senses.

Question 5

Evidence has its own life cycle and courts and laws find evidence categories to garner different weight and values. What type of evidence can prove an intermediate effect that can then be used to deduce another fact?

Accepted Answer

Circumstantial evidence can prove an intermediate fact that can then be used to deduce another fact. This type of fact is used so the judge or jury will logically assume the existence of a primary fact. Often, collaborating evidence or supporting evidence is used to help prove an idea or point. It cannot stand on its own, but is used as a supplementary tool to help prove a primary piece of evidence or to strengthen circumstantial evidence.

Question 6

Evidence has its own life cycle and courts and laws find evidence categories to garner different weight and values. What type of evidence involves testifying only on the facts as a witness?

Accepted Answer

Opinion evidence involves testifying only on the facts as a witness. When a witness testifies, the opinion rule dictates that s/he must testify for only the facts of the issue and not opinion of the facts. This is slightly different from when an expert witness is used, because an expert is used primarily for an educated opinion. Most lawyers call in expert witnesses to testify and help the defending or prosecuting sides better understand the subject matter so they can help the judge and jury better understand the matters of the case.

Question 7

When it comes to computer crimes, there are two main types of surveillance. Which type would include security guards?

Accepted Answer

When it comes to computer crimes, physical surveillance involves security guards. Physical surveillance pertains to security cameras, security guards, and closed-circuit TV (CCTV), which may capture evidence. Physical surveillance can also be used by an undercover agent to learn about the suspect's spending activities, family, friends, and personal habits in the hope of gathering more clues for the case.

Question 8

When it comes to computer crimes, there are two main types of surveillance. Which type would include auditing events?

Accepted Answer

When it comes to computer crimes, computer surveillance includes auditing events. Computer surveillance pertains to audit events. Auditing events passively monitor events by using network sniffers, keyboard monitors, wiretaps, and line monitoring. In most jurisdictions, active monitoring may require a search warrant. In most workplace environments, to legally monitor an individual, the person must be warned ahead of time that his/her activities may be subject to this type of monitoring.

Question 9

There are many different types of computer crimes that can be committed with different methods. What computer crime is committed when the criminal commits small crimes to prevent the overall crime from being noticed?

Accepted Answer

When a criminal commits small crimes to avoid the overall crime being noticed they are committing a salami attack. A salami attack is one in which the attacker commits several small crimes with the hope that the overall larger crime will go unnoticed. Salami attacks usually take place in the accounting departments of companies and the most common example of a salami attack involves subtracting a small amount of funds from many accounts with the hope that such an insignificant amount would be overlooked.

Question 10

There are many different types of computer crimes that can be committed with different methods. What computer crime is committed when there is an alteration of data?

Accepted Answer

Data Diddling is a computer crime where there is an alteration of data. This modification happens before the data is entered into an application or as soon as it completes processing and is outputted from an application. This type of crime is common and one of the easiest to prevent by using access and accounting controls, supervision, auditing, separation of duties, and authorization limits.

Question 11

There are many different types of computer crimes that can be committed with different methods. What method would include tracking and exploiting network traffic?

Accepted Answer

The computer crime method that includes tracking and exploiting network traffic is password sniffing. Several tools are available on the Internet that provide this functionality. Capturing a password is tricky because it is a piece of data that is usually only used when a user wants to authenticate into a domain or access a resource. Some systems and applications do send passwords over the network in clear text, but a majority of them do not anymore.

Question 12

There are many different types of computer crimes that can be committed with different methods. What computer crime allows an attacker to eavesdrop?

Accepted Answer

Emanation capturing allows a criminal to eavesdrop. Every electrical devise emits electrical waves into the surrounding environment. These waves contain information comparable to how wireless technologies work. These waves can be carried over a distance, depending on the strength of the signals and the material and objects in the surrounding area. Attackers have used devices to capture these waves and port them to their own computer systems so they can access information not intended for them.

Question 13

What type of evidence pertains to oral or written evidence presented in court that has no firsthand proof of accuracy or reliability?

Accepted Answer

Hearsay evidence pertains to oral or written evidence presented in court that has no firsthand proof of accuracy or reliability. If a witness testifies about secondhand evidence he heard someone else say, it is too far removed from fact and has too many variables that can cloud the truth. If business documents were made during regular business routings, the may be admissible.
However, if these records were made just to be presented in court, they could be categorized as hearsay evidence. To be admissible, the following is considered: Procedures for collecting and maintaining evidence, proof of how errors were avoided, identification of custodian and skill set, and reasonable explanations for why certain actions were taken and why specific procedures were bypassed.

Question 14

Mitch must review audit trail information. What is the method for such a review?

Accepted Answer

Audit trail reviews can be completed manually or by automated means. If an organization reviews audit trails manually, it needs to establish a system of how, when, and why they are viewed. Usually audit logs are very popular items right after a security breach, unexplained system action, or system interruption. Audit rails can be done by automated means with the use of an audit-reduction tool which discards mundane task information and records system performance, security, and user functionality information that can be useful to a security professional or administrator.

Question 15

Theresa is suspicious of an employee's activity when they are logged-on to their computer. Theresa decides to monitor this employee for fraudulent activity, but plans to review the information later. What type of monitoring is Theresa using?

Accepted Answer

Often, when an organization is suspicious of an employee's activities, they observe their behavior when they are logged-on to their computer through keystroke monitoring. The person using this type of monitoring can have the characters written to an audit log to be reviewed at a later time. This type of auditing is usually done only for special cases and only for a specific amount of time, because the amount of information captured can be overwhelming and unimportant.

Question 16

What type of access control is principled on the idea that individuals should be given access only to the information they absolutely require in order to perform their job duties?

Accepted Answer

The need-to-know access control is principled on the idea that individuals should be given access only to the information they absolutely require in order to perform their job duties. Management will decide what a user needs to know or what access rights are necessary and the administrator will configure the access control mechanisms. It is important to understand that it is management's job to determine the security requirements of individuals and how access is authorized. The security administrator configures the security mechanisms to fulfill these requirements, but it is not their job to determine security requirements of users.

Question 17

What is the proper term for a process to have no more privileges than necessary to be able to fulfill its functions?

Accepted Answer

Least privilege is the term for a process to have no more privileges than necessary to be able to fulfill its functions. Once resources and processes are isolated properly, least privilege needs to been forced. Only processes that need to carry out critical system functions should be allowed to run and other less privileged processes should call upon the more privileged processes to carry out these types of activities when necessary. This type of indirect activity protects the system from poorly-written or misbehaving code Processes should possess a level of privilege only as long as they really need it.

Question 18

What should companies be concerned with when determining the best products to purchase while determining what would be the most cost effective with concerns to hardware failures?

Accepted Answer

When determining what would be the best product to purchase while determining what would be the most cost effective with concerns to hardware failure, is the mean time before failure (MTBF). The mean time before failure is how long before hardware will fail and need replacement and the estimated cost of the replacement. It is important to calculate the (MTBF) to determine device value, the risk of equipment failure, and whether to opt for other devices that may offer better value.

Question 19

In Tracy's company, there has been a security breach. The company triaged the situation to determine its depth. What would be the next stage of an incident response procedure?

Accepted Answer

Investigation is the next state of an incident response procedure. Investigation involves the proper collection of relevant data, which will be used in the analysis and following states. The goals of these states are to reduce the impact of the incident, identify the cause of the incident, resume operations as soon as possible, and apply what was learned to prevent the incident from recurring.

Question 20

When providing bad news during a crisis communication, which tactic should be employed when communicating the news?

Accepted Answer

When communicating bad news, the most effective and honest method is to simply state the facts and provide the bad news all at once. While an effort should be made to keep the bad news to simply the facts (and not speculation), an effort should also be made to avoid sugarcoating or lightening the bad news in any way.
Most audiences will respond best when bad news is provided in a straight-forward manner and not sugarcoated for the audience. When providing the bad news, stay positive by following it with a plan of action or providing the next steps that will be taken for the organization.

Quiz 7: Operations