ACCT 305 Accounting Information Systems

Chapter 6 Review Questions 1. Several Unique problems and risks associated with computerized information networks are unauthorized access, use, disclosure, disruption, modification, or destruction 2. Elements included in an ISMS system such as hardware, databases, procedures, and reports. 3. Development of ISMS requires application of the life cycle approach for system maintenance purposes. 4. Risk Management is the identification, assessment, and prioritization of risks. 5. Quantitative Approach - each loss exposure is computed as the product of the cost of an individual loss times the likelihood of its occurrence.
Qualitative Approach – lists out the system’s vulnerabilities and threats and subjectively ranks them in order of their contribution to the company’s total loss exposures. 6. Types of threats that affect information systems a) Active threats include information systems fraud and computer sabotage. b) Passive threats include system faults, as well as natural disasters (e.g., earthquakes, floods, fires, and hurricanes). 7. Characteristics of white-collar criminal 8. Types of individuals pose a threat to an information system a) Computer and information systems personnel: are often given a wide range of access privileges to sensitive data and programs. b) Users: are given narrow access, but can still find ways to commit fraud. c) Intruders and attackers: are given no access, but are highly capable. 9. Types of intruders:- i. White hat hackers legitimately probe systems for weaknesses to help with security. ii. Black hat hackers attack systems for illegitimate reasons. iii. Grey hat hackers are white hat hackers who skirt the edges of the law. 10. Six methods that an individual might use to penetrate a computer

a) Input manipulation is used in most cases of insider computer fraud. b) Program alteration is one of the least common methods. c) Direct file alteration occurs when individuals find ways to bypass the normal process for inputting data into computer programs. d) Data theft is a serious problem. e) Sabotage poses a serious danger to information systems. f) Misappropriation or theft of information occurs when employees use company computers’ resources for their own personal use or their own business.

11. How might a computer program be used to commit acts of sabotage. 12. Virus program is a type of malware that, when executed, replicates by inserting copies of itself into other computer programs, data files, or the boot sector of the hard drive; when this replication succeeds, the affected areas are then said to be "infected"

Examples of computer viruses include Trojan horse, worms, bootsector virus, macro virus and memory resident viruses.

13. Roles that an organization control environment play in information system security a) Management philosophy and operating style b) Organizational structure c) Board of directors and its committees d) Methods of assigning authority and responsibility e) Management control activities f) Internal audit function g) Personnel policies and practices h) External influences 14. The layered approach to access control involves erecting multiple layers of controls that separate the would-be perpetrator from his or her potential target.

Layers of access control might be implemented:

a. Site-access controls – physically separates unauthorized individuals from information systems resources. b. System-access controls – authenticate users with user IDs, passwords, IP addresses, and hardware devices. c. File-access controls – prevent unauthorized access to data and program files. 15. Fault-tolerant computer systems are systems designed around the concepts of fault tolerance. In essence, they have to be able to keep working to a level of satisfaction in the presence of faults.

16. Backups: a) A full backup backs up all files on a given disk.
Each file contains an archive bit that is set to 0. b) An incremental backup backs up only those files that have been modified since the last full or incremental backup. c) A differential backup is the same as an incremental backup, and only the archive bits are not reset to 0. 17. Steps should be taken in development of a disaster recovery plan? a) Assess the company’s critical needs. b) List priorities for recovery. c) Establish strategies and procedures.

18. Recovery strategies and procedures that may be included in a disaster recovery plan a) Emergency response center b) Escalation procedures c) Alternate processing arrangements d) Personnel relocation and replacements plans e) Salvage plan f) Plan for testing and maintaining the system