Chapter 2 Review Questions
1. Why is information security a management problem? What can management do that technology cannot? Decision-makers in organizations must set policy and operate their organization in a manner that complies with the complex, shifting political legislation on the use of technology. Management is responsible for informed policy choices and the enforcement of decisions that affect applications and the IT infrastructures that support them.
2. Why is data the most important asset an organization possesses? What other assets in the organization require protection? Without data there will be no record of anything that they have done.
3. Which management groups are responsible for implementing information security to protect the organization’s ability to function? Both General management and IT management.
4. Has the implementation of networking technology created more or less risk for businesses that use information technology? Why? More risk, now that attackers have the potential to access the networks from anywhere.
5. What is information extortion? Describe how such an attack can cause losses, using an example not found in the text. When information is held hostage until demands are met.
7. What measures can individuals take to protect against shoulder surfing? Avoid, if possible, accessing sensitive information whenever others are present. Be aware of your surroundings.
8. How has the perception of the hacker changed over recent years? What is the profile of a hacker today? The perception of a hacker has changed and grown to include male/females from the ages of 12-60.
9. What is the difference between a skilled hacker and an unskilled hacker (other than skill levels)? How does the protection against each differ? A skilled hacker will create their own tools to get their jobs done, while an unskilled hacker will use tools created by others.
10. What are the various types of malware? How do worms differ from viruses? Do Trojan horses carry viruses or worms? Common types of malware are viruses, worms, Trojan horses, logic bombs, and back doors. Computer viruses are segments of code that induce other programs to perform actions. Worms are malicious programs that replicate themselves constantly without requiring another program to provide a safe environment for replication. Once a trusting user executes a Trojan horse program it will unleash viruses or worms to the local workstation and the network as a whole.
11. Why does polymorphism cause greater concern than traditional malware? How does it affect detection? Polymorphism makes code more difficult to detect. Since the code keeps changing it is harder to detect by anti-viruses.
12. What is the most common form of violation of intellectual property? How does an organization protect against it? What agencies fight it? Unauthorized duplication of software based intellectual property is the most common form of this. There are digital watermarks that can be imbedded into the property to prevent this. The software and information industry association (SIIA) and the business software alliance (BSA).
13. What are the various types of force majeure? Which type might be of greatest concern to an organization in Las Vegas? Oklahoma City? Miami? Los Angeles? Fire, flood, earthquake, tornado, etc are all examples of this. Los Angeles would be most concerned with earthquakes.
14. How does technological obsolescence constitute a threat to information security? How can an organization protect against it? It can be prevented through proper planning and replacing outdated technologies.
15. Does the intellectual property owned by an organization usually have value? If so, how can attackers threaten that value? Yes, if the hacker would steal it and sell copies of it to your competitors it can be bad for your business.
16. What are the types of password attacks? What can a systems administrator do to protect against them? Password crack, brute force, and dictionary are three types of password attacks. To protect against these types of attacks the admin should set policies which require the use of special characters, disallow dictionary works, or set a limit on the number of attempts allowed.
17. Whatisthedifferencebetweenadenial-of-serviceattackandadistributeddenial-of-service attack? Which is more dangerous? Why? A dos attach is when the attacker sends a large number of packets from a single source to overload a system, while a ddos is doing the same thing, but from many computers from many different areas. A ddos attack is much more dangerous because it is harder to track, and there is a larger strain on the network.
18. For a sniffer attack to succeed, what must the attacker do? How can an attacker gain access to a network to use the sniffer system? The attacker must be connected to the network in order to use a sniffer. The hacker can use social engineering to get the credentials of the network.
19. What methods does a social engineering hacker use to gain information about a user’s login id and password? How would this method differ if it were targeted towards an administrator’s assistant versus a data-entry clerk? Social engineers may roleplay as someone of importance who is in need of the credentials or roleplay as someone who may have forgot their credentials to get it from an administrator.
20. What is a buffer overflow, and how is it used against a Web server? A buffer overflow is when more data is sent to a buffer than the buffer can handle. It can be caused by a mismatch in processing rates between machines involved in the communication process.