Chapter 2 Review Questions
1. Management is needed to perform risk assessments and spend and substantial amount of money to protect the day to day functioning of the organization. Technology does not set policies nor fix the various social issues
2. Data is the most important asset an organization possesses because it represents the daily transaction records and its ability effectively deliver value to its customers. Without data organizations would not be able to carry out day to day task. The functioning of the organization and the safe operation of applications, technology and people are other assets that require protection.
3. General management and IT management are both responsible for security implementations for organizations.
4. Business networks are now connected to other networks external to the organization which has made it easier for unauthorized access to the organizations networks creating vulnerability.
5. Information extortion occurs when a hacker performs an attack on your system and steals valuable information or compromising data. The hacker then contacts the person whose information it has stolen and demands compensation or some other form of recognition to get the personal information returned.
6. Employee’s mistakes can lead to the findings of classified data, internal errors entered, deletion or modification of data and the most recent the storage of sensitive data on unauthorized devices such as cell phones and laptops.
7. Individuals could protect themselves by not revealing personal or sensitive information while in crowded areas such as coffee shops etc.
8. Hackers were usually described as males as young as 13 with no immediate supervision and were thought to spend an abundant amount of time on the computer. Now a hacker could be anyone male or female with varying technical skills to interfere with an organization network.
9. A skilled hacker develops software and code exploits, and masters many technologies like programming, network protocols and operating systems. The unskilled hacker uses expert written software to exploit a system, usually with little knowledge of how it works. You can protect yourself from both by making sure you have an updated virus protection application.
10. Types of malware: Viruses, worms, Trojan horses, logic bombs and back doors. Viruses and worms both can do damage. Worms are typically stand-alone programs whereas Trojan horses may carry either or both.
11. Polymorphism changes over time making it more difficult to detect.
12. Software Piracy. Software licensing helps aid in the fight against this. SIIA and BSA both help in the fight against IP violations.
13. Force Majeure is a term used for a greater force that cannot be controlled. Las Vegas might experience a dust storm, Oklahoma City might experience a tornado, and Miami might experience a hurricane whereas Los Angeles would be victim of wild fires.\
14. When technology becomes outdated, and results in an increased threat. Technology must be replaced or updated regular

15. Cracking, Brute force and Dictionary attacks are the 3 types of password attacks Limit the number of password attempts, enforce minimum complexity policy (numbers, capitals etc.), and disallow dictionary words in passwords.
16. DOS attacks are a single user sending a large number of connections in an attempt to overwhelm a target server. DDOS is when many users (or many compromised systems) simultaneously perform a DOS attack. The DDOS is more dangerous because unlike a DOS there is no single user you can block, no easy way to overcome it.
17. The hacker must gain access to a network to install the sniffer. This is usually done using social engineering to get into the organization to plant a physical sniffer device.
18. By gaining access as an overlooked employee such as a janitor to get physical access to assets. A data entry clerk could be easily swayed by mentioning the CEO in a very profound manner whereas someone higher up would need more proof of your presence.
19. When more data is sent then the receivers buffer can handle this usually results in a non-buffer application memory being overwritten. If this were to happen on a webserver this could allow an attacker to run executable codes on the web server to either manipulate files immediately or create a backdoor for later use.

Exercises 1. I believe this hacker falls into four major categories: deliberate acts of trespass, compromises to intellectual property, technical failures, and managerial failure. 2. Michael Demon Calce, also known as Mafiaboy, was a high school student from West Island, Quebec, who launched a series of highly publicized DDOS (denial-of-service) attacks in February 2000 against large commercial websites. Mafiaboy was caught because he left traces of evidence that lead to him he used one of the computers at a local university to launch an attack on CNN he also admitted in a chat room conversation that he was the one causing all the frenzy among the organizations. 3. The information on the protection page of the manual. 4. Was not able to search on this webpage. 5. People: Employees low awareness for information security. Internet Security: malware, spyware and Trojans Social engineering: The art of manipulating people in performing task to gain access to confidential information.