CBIS Exam 4
threat -
a person or organization that seeks to obtain or alter data or other IS assets
illegally, without the owner's permission and often without the owner's knowledge
vulnerability -
an opportunity for threats to gain access to individual or organizational assets
safeguard -
some measure that individuals or organizations take to block the threat from
obtaining the asset
target -
the asset that is desired by the threat
3 sources of threats -
1. human errors and mistakes (include accidental problems caused by both
employees and non-employees)
2. computer crime (includes employees and former employees who intentionally destroy data
or other system components)
3. natural events and disasters (fires, floods, hurricanes, earthquakes, tsunamis, avalanches,
etc.)
5 types of security loss -
1. unauthorized data disclosure (occurs when a threat obtains data that is supposed
to be protected) - EX. WikiLeaks
2. incorrect data modification (human error, system error)
3. faulty service (problems that result because of incorrect system operation)
4. Denial of service
5. loss of infrastructure (EX. bulldozer cutting off a conduit of fiber-optic cables)
pretexting -
occurs when someone deceives by pretending to be someone else
phishing/email spoofing -
uses pretexting via email/ the phisher pretends to be a legitimate company and
sends an email requesting confidential data, such as account numbers, social security,
passwords, etc
IP spoofing -
occurs when an intruder uses another site's IP address to masquerade as that other
site
sniffing -
a technique for intercepting computer communication
wardrivers -
1|Page
, take computers with wireless connections through an area and search for
unprotected wireless networks/ can monitor and intercept traffic on unsecured wireless
networks
hacking -
breaking into computers, servers, or networks to steal data such as customer lists,
product inventory data, employee data and other proprietary and confidential data
usurpation -
occurs when computer criminals invade a computer system and replace legitimate
problems with their own, unauthorized ones that shut down legitimate applications and
substitute their own processing to spy, steal and manipulate data, or achieve other purposes
advanced persistent threat (APT) -
is a sophisticated, possibly long-running computer hack that is perpetrated by
large, well-funded organizations such as governments
- can be a means to engage in cyberwarfare and cyber-espionage
goal of information security -
to find an appropriate trade-off between the risk of loss and the cost of
implementing safeguards
intrusion detection system (IDS) -
a computer program that senses when another computer is attempting to scan or
access a computer or network
brute force attack -
the password cracker tries every possible combo of characters
cookies -
small files that your browser receives when you visit websites
3 types of safeguards -
1. technical safeguards - involve the hardware and software components of an
information system (firewalls, encryption, identification and authorization)
2. data safeguards (passwords, backup and recovery, physical security)
3. human safeguards (hiring, training, education, compliance, accountability)
smart card -
a plastic card similar to a credit card / have a microchip that is loaded with
identifying data
biometric authentication -
uses personal physical characteristics such as fingerprints, facial features, and
retinal scans to authenticate users
encryption -
the process of transforming clear text into coded, unintelligible text for secure
storage or communication
2|Page
threat -
a person or organization that seeks to obtain or alter data or other IS assets
illegally, without the owner's permission and often without the owner's knowledge
vulnerability -
an opportunity for threats to gain access to individual or organizational assets
safeguard -
some measure that individuals or organizations take to block the threat from
obtaining the asset
target -
the asset that is desired by the threat
3 sources of threats -
1. human errors and mistakes (include accidental problems caused by both
employees and non-employees)
2. computer crime (includes employees and former employees who intentionally destroy data
or other system components)
3. natural events and disasters (fires, floods, hurricanes, earthquakes, tsunamis, avalanches,
etc.)
5 types of security loss -
1. unauthorized data disclosure (occurs when a threat obtains data that is supposed
to be protected) - EX. WikiLeaks
2. incorrect data modification (human error, system error)
3. faulty service (problems that result because of incorrect system operation)
4. Denial of service
5. loss of infrastructure (EX. bulldozer cutting off a conduit of fiber-optic cables)
pretexting -
occurs when someone deceives by pretending to be someone else
phishing/email spoofing -
uses pretexting via email/ the phisher pretends to be a legitimate company and
sends an email requesting confidential data, such as account numbers, social security,
passwords, etc
IP spoofing -
occurs when an intruder uses another site's IP address to masquerade as that other
site
sniffing -
a technique for intercepting computer communication
wardrivers -
1|Page
, take computers with wireless connections through an area and search for
unprotected wireless networks/ can monitor and intercept traffic on unsecured wireless
networks
hacking -
breaking into computers, servers, or networks to steal data such as customer lists,
product inventory data, employee data and other proprietary and confidential data
usurpation -
occurs when computer criminals invade a computer system and replace legitimate
problems with their own, unauthorized ones that shut down legitimate applications and
substitute their own processing to spy, steal and manipulate data, or achieve other purposes
advanced persistent threat (APT) -
is a sophisticated, possibly long-running computer hack that is perpetrated by
large, well-funded organizations such as governments
- can be a means to engage in cyberwarfare and cyber-espionage
goal of information security -
to find an appropriate trade-off between the risk of loss and the cost of
implementing safeguards
intrusion detection system (IDS) -
a computer program that senses when another computer is attempting to scan or
access a computer or network
brute force attack -
the password cracker tries every possible combo of characters
cookies -
small files that your browser receives when you visit websites
3 types of safeguards -
1. technical safeguards - involve the hardware and software components of an
information system (firewalls, encryption, identification and authorization)
2. data safeguards (passwords, backup and recovery, physical security)
3. human safeguards (hiring, training, education, compliance, accountability)
smart card -
a plastic card similar to a credit card / have a microchip that is loaded with
identifying data
biometric authentication -
uses personal physical characteristics such as fingerprints, facial features, and
retinal scans to authenticate users
encryption -
the process of transforming clear text into coded, unintelligible text for secure
storage or communication
2|Page
