Management Information Systems, 12e (Laudon) Chapter 8 Securing Information Systems
1) In addition to e-mail, instant messages and P2P file-sharing can also pose security threats to computer systems and networks. Answer: !"# $iff: 1 Page !ef: 2%& AA'(: "se of I 'A(#: 'omprehension *+ectie: .1 2) 'omputers using ca+le modems to connect to the Internet are more open to penetration than those connecting ia dial-up. Answer: !"# $iff: 2 Page !ef: 2%& AA'(: "se of I 'A(#: 'omprehension *+ectie: .1 /) 0ireless networks are ulnera+le to penetration +ecause radio freuency +ands are easy to scan. Answer: !"# $iff: 2 Page !ef: 2% AA'(: "se of I 'A(#: 'omprehension *+ectie: .1 &) he range of 0i-3i networks can +e e4tended up to two miles +y using e4ternal antennae. Answer: 3A5(# $iff: / Page !ef: 2% AA'(: "se of I 'A(#: 'omprehension *+ectie: .1 ) he 0#P specification calls for an access point and its users to share the same &6-+it encrypted password. Answer: !"# $iff: / Page !ef: 2%7 AA'(: "se of I 'A(#: 'omprehension *+ectie: .1
1 Copyright © 2012 Pearson Education, Inc.
7) 8iruses can +e spread through e-mail. Answer: !"# $iff: 1 Page !ef: 2%7 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 9) 'omputer worms spread much more rapidly than computer iruses. Answer: !"# $iff: 2 Page !ef: 2%7 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 ) *ne form of spoofing inoles forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender. Answer: !"# $iff: 2 Page !ef: 2%% AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 %) (niffers ena+le hackers to steal proprietary information from anywhere on a network, including e-mail messages, company files, and con fidential reports. Answer: !"# $iff: 2 Page !ef: 2%% AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2 16) $o( attacks are used to destroy information and access restricted areas of a companys information system. Answer: 3A5(# $iff: 2 Page !ef: 2%% AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 11) $o( attacks are one of the most economically damaging kinds k inds of computer crime. Answer: !"# $iff: / Page !ef: /66-/61 AA'(: "se of I 'A(#: 'omprehension *+ectie: .2
2 Copyright © 2012 Pearson Education, Inc.
12) ;ero defects cannot +e achieed in larger software programs +ecause fully testing programs that contain thousands of choices and millions of paths would reuire thousands of years. Answer: !"# $iff: 2 Page !ef: /6/ AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 1/) An accepta+le use policy defines the accepta+le leel of access to information assets for different users. Answer: 3A5(# $iff: 2 Page !ef: /16 AA'(: "se of I 'A(#: 'omprehension *+ectie: ./ 1&) iometric authentication is the use of physical characteristics such as retinal images to proide identification. Answer: !"# $iff: 1 Page !ef: /1/ AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .& 1) Packet filtering catches most types of network attacks. Answer: 3A5(# $iff: 2 Page !ef: /1 AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 17)
/ Copyright © 2012 Pearson Education, Inc.
1) Pu+lic key encryption uses two keys. Answer: !"# $iff: 2 Page !ef: /129 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .& 1%) >igh-aaila+ility computing is also referred to as fault tolerance. Answer: 3A5(# $iff: 2 Page !ef: /1% AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 26) oth software metrics and software testing are techniues used to improe software uality. Answer: !"# $iff: 2 Page !ef: /26 AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 21) ???????? refers to policies, procedures, and technical measures used to preent unauthori=ed access, alternation, theft, or physical damage to information systems. A) @(ecurity@ ) @'ontrols@ ') @enchmarking@ $) @Algorithms@ Answer: A $iff: 2 Page !ef: 2%/ AA'(: "se of I 'A(#: 'omprehension *+ectie: ./ 22) ???????? refers to all of the methods, policies, and organi=ational procedures that ensure the safety of the organi=ations assets, the accuracy and relia+ility of its accounting records, and operational adherence to management standards. A) @5egacy systems@ ) @((I$ standards@ ') @8ulnera+ilities@ $) @'ontrols@ Answer: $ $iff: 2 Page !ef: 2%/ AA'(: "se of I 'A(#: 'omprehension *+ectie: ./
& Copyright © 2012 Pearson Education, Inc.
2/) 0hich of the following does not pose a security threat to wireless networksB A) +roadcasted ((I$s ) scanna+ility of radio freuency +ands ') (C5 inection attacks $) geographic range of wireless signals Answer: ' $iff: 1 Page !ef: 2%-2%7 AA'(: Analytic (kills 'A(#: #aluation in terms of assess *+ectie: .1 2&) #lectronic data are more suscepti+le to destruction, fraud, error, and misuse +ecause information systems concentrate data in computer files that A) are usually +ound up in legacy systems that are difficult to access and difficult to correct in case of error. ) are not secure +ecause the technology to secure them did not e4ist at the time the files were created. ') hae the potential to +e accessed +y large num+ers of people and +y groups outside of the organi=ation. $) are freuently aaila+le on the Internet. Answer: ' $iff: 2 Page !ef: 2%/-2%& AA'(: Analytic (kills 'A(#: Analysis in terms of compare *+ectie: .1 2) "nauthori=ed access is a security challenge that is most likely to occur in which of the following points of a corporate networkB A) client computer ) communications lines ') corporate serer $) internal corporate +ack-end system Answer: A $iff: / Page !ef: 2%/ AA'(: Analytic (kills 'A(#: Analysis in terms of e4amine *+ectie: .1
Copyright © 2012 Pearson Education, Inc.
27) (niffing is a security challenge that is most likely to occur in which of the following points of a corporate networkB A) client computer ) communications lines ') corporate serers $) internal corporate +ack-end system Answer: $iff: 2 Page !ef: 2%/ AA'(: Analytic (kills 'A(#: Analysis in terms of e4amine *+ectie: .1 29) Inputting data into a poorly programmed 0e+ form in order to disrupt a companys systems and networks is called A) a roan horse. ) an (C5 inection attack. ') key logging. $) a $$o( attack. Answer: $iff: 2 Page !ef: 2% AA'(: Analytic (kills 'A(#: Analysis in terms of e4amine *+ectie: .1 2) he Internet poses specific security pro+lems +ecause A) it was designed to +e easily accessi+le. ) Internet data is not run oer secure lines. ') Internet standards are uniersal. $) it changes so rapidly. Answer: A $iff: 2 Page !ef: 2%& AA'(: "se of I 'A(#: 'omprehension *+ectie: .1 2%) 0hich of the following statements a+out the Internet security is not trueB A) he use of P2P networks can e4pose a corporate computer to outsiders. ) A corporate network without access to the Internet is more secure than one proides access. ') 8oIP is more secure than the switched oice network. $) Instant messaging can proide hackers access to an otherwise secure network. Answer: ' $iff: 2 Page !ef: 2%&-2% AA'(: Analytic (kills 'A(#: Analysis in terms of appraise *+ectie: .1
7 Copyright © 2012 Pearson Education, Inc.
/6) An independent computer program that copies itself from one computer to another oer a network is called a A) worm. ) roan horse. ') +ug. $) pest. Answer: A $iff: 2 Page !ef: 2%7 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 /1) A salesperson clicks repeatedly on the online ads of a competitor in order to drie the competitors adertising costs up. his is an e4ample of A) phishing. ) pharming. ') spoofing. $) click fraud. Answer: $ $iff: 2 Page !ef: /62 AA'(: Analytic (kills 'A(#: Analysis in terms of categori=e *+ectie: .2 /2) In 266&, I'C users were enticed +y a sales message from a supposed anti-irus endor. *n the endors site, a small program called Ditglieder was downloaded to the users machine. he program ena+led outsiders to infiltrate the users machine. 0hat type of malware is this an e4ample ofB A) roan horse ) irus ') worm $) spyware Answer: A $iff: 2 Page !ef: 2% AA'(: Analytic (kills 'A(#: Analysis in terms of categori=e *+ectie: .1
9 Copyright © 2012 Pearson Education, Inc.
//) !edirecting a 0e+ link to a different address is a form of A) snooping. ) spoofing. ') sniffing. $) war driing. Answer: $iff: 2 Page !ef: 2%% AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 /&) A keylogger is a type of A) worm. ) roan horse. ') irus. $) spyware. Answer: $ $iff: 1 Page !ef: 2% AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 /) >ackers create a +otnet +y A) infecting 0e+ search +ots with malware. ) +y using 0e+ search +ots to infect other computers. ') +y causing other peoples computers to +ecome @=om+ie@ P's following a master computer. $) +y infecting corporate serers with @=om+ie@ roan horses that allow undetected access through a +ack door. Answer: ' $iff: 2 Page !ef: 2%% AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 /7) "sing numerous computers to inundate and oerwhelm the network from numerous launch points is called a ???????? attack. A) $$o( ) $o( ') (C5 inection $) phishing Answer: A $iff: 2 Page !ef: 2%% AA'(: "se of I 'A(#: 'omprehension *+ectie: .1
Copyright © 2012 Pearson Education, Inc.
/9) 0hich of the following is not an e4ample of a computer used as a target of crimeB A) knowingly accessing a protected computer to commit fraud ) accessing a computer system without authority ') illegally accessing stored electronic communication $) threatening to cause damage to a protected computer Answer: ' $iff: 2 Page !ef: /66 AA'(: Analytic (kills 'A(#: Analysis in terms of categori=e *+ectie: .1 /) 0hich of the following is not an e4ample of a computer used as an instrument of crimeB A) theft of trade secrets ) intentionally attempting to intercept electronic communication ') unauthori=ed copying of software $) +reaching the confidentiality of protected computeri=ed data Answer: $ $iff: 2 Page !ef: /66 AA'(: Analytic (kills 'A(#: Analysis in terms of categori=e *+ectie: .1 /%) Phishing is a form of A) spoofing. ) logging. ') sniffing. $) driing. Answer: A $iff: 2 Page !ef: /61 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 &6) An e4ample of phishing is A) setting up a +ogus 0i-3i hot spot. ) setting up a fake medical 0e+ site that asks users for confidential information. ') pretending to +e a utility companys employee in order to garner information from that company a+out their security system. $) sending +ulk e-mail that asks for financial aid under a false prete4t. Answer: $iff: 2 Page !ef: /61 AA'(: Analytic (kills 'A(#: Analysis in terms of categori=e *+ectie: .1
% Copyright © 2012 Pearson Education, Inc.
&1) #il twins are A) roan horses that appears to the user to +e a legitimate commercial software application. ) e-mail messages that mimic the e-mail messages of a legitimate +usiness. ') fraudulent 0e+ sites that mimic a legitimate +usinesss 0e+ site. $) +ogus wireless network access points that look legitimate to users. Answer: $ $iff: 1 Page !ef: /61 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 &2) Pharming inoles A) redirecting users to a fraudulent 0e+ site een when the user has typed in the correct address in the 0e+ +rowser. ) pretending to +e a legitimate +usinesss representatie in order to garner information a+out a security system. ') setting up fake 0e+ sites to ask users for confidential information. $) using e-mails for threats or harassment. Answer: A $iff: 2 Page !ef: /61 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 &/) Eou hae +een hired as a security consultant for a law firm. 0hich of the following constitutes the greatest source of security threats to the firmB A) wireless network ) employees ') authentication procedures $) lack of data encryption Answer: $iff: 2 Page !ef: /62 AA'(: Analytic (kills 'A(#: #aluation in terms of assess *+ectie: .1 &&) ricking employees to reeal their passwords +y pretending to +e a legitimate mem+er of a company is called A) sniffing. ) social engineering. ') phishing. $) pharming. Answer: $iff: 1 Page !ef: /62 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 16 Copyright © 2012 Pearson Education, Inc.
&) >ow do software endors correct flaws in their software after it has +een distri+utedB A) issue +ug fi4es ) issue patches ') re-release software $) issue updated ersions Answer: $iff: 2 Page !ef: /6/ AA'(: "se of I 'A(#: 'omprehension *+ectie: .& &7) he >IPAA Act of 1%%9 A) reuires financial institutions to ensure the security of customer data. ) specifies +est practices in information systems security and control. ') imposes responsi+ility on companies and management to safeguard the accuracy of financial information. $) outlines medical security and priacy rules. Answer: $ $iff: 2 Page !ef: /67 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2 &9) he Framm-5each-liley Act A) reuires financial institutions to ensure the security of customer data. ) specifies +est practices in information systems security and control. ') imposes responsi+ility on companies and management to safeguard the accuracy of financial information. $) outlines medical security and priacy rules. Answer: A $iff: / Page !ef: /67 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2 &) he (ar+anes-*4ley Act A) reuires financial institutions to ensure the security of customer data. ) specifies +est practices in information systems security and control. ') imposes responsi+ility on companies and management to safeguard the accuracy of financial information. $) outlines medical security and priacy rules. Answer: ' $iff: 2 Page !ef: /67 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2
11 Copyright © 2012 Pearson Education, Inc.
&%) he most common type of electronic eidence is A) oice mail. ) spreadsheets. ') instant messages. $) e-mail. Answer: $ $iff: 2 Page !ef: /69 AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 6) #lectronic eidence on computer storage media that is not isi+le to the aerage user is called ???????? data. A) defragmented ) am+ient ') forensic $) fragmented Answer: $iff: 2 Page !ef: /69 AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 1) Application controls A) can +e classified as input controls, processing controls, and output controls. ) goern the design, security, and use of computer programs and the security of data files in general throughout the organi=ation. ') apply to all computeri=ed applications and consist of a com+ination of hardware, software, and manual procedures that create an oerall control enironment. $) include software controls, computer operations controls, and implementation controls. Answer: A $iff: 2 Page !ef: /6 AA'(: "se of I 'A(#: 'omprehension *+ectie: ./ 2) ???????? controls ensure that alua+le +usiness data files on either disk or tape are not su+ect to unauthori=ed access, change, or destruction while they are in use or in storage. A) (oftware ) Administratie ') $ata security $) Implementation Answer: ' $iff: / Page !ef: /6 AA'(: "se of I 'A(#: 'omprehension *+ectie: ./ 12 Copyright © 2012 Pearson Education, Inc.
/) Analysis of an information system that rates the likelihood of a security incident occurring and its cost is included in aGn) A) security policy. ) A"P. ') risk assessment. $) +usiness impact analysis. Answer: ' $iff: 2 Page !ef: /6% AA'(: "se of I 'A(#: 'omprehension *+ectie: ./ &) AGn) ???????? system is used to identify and authori=e different categories of system users and specify which portions of the organi=ations systems each user can access. A) identity management ) A"P ') authentication $) firewall Answer: A $iff: 1 Page !ef: /16 AA'(: "se of I 'A(#: 'omprehension *+ectie: .& ) 0hich of the following is not one of the main firewall screening techniuesB A) application pro4y filtering ) static packet filtering ')
1/ Copyright © 2012 Pearson Education, Inc.
9) An authentication token is aGn) A) deice the si=e of a credit card that contains access permission data. ) type of smart card. ') gadget that displays passcodes. $) electronic marker attached to a digital authori=ation file. Answer: ' $iff: 2 Page !ef: /1/ AA'(: "se of I 'A(#: 'omprehension *+ectie: .& ) 0hich of the following is not a trait used for identification in +iometric systemsB A) retinal image ) oice ') hair color $) face Answer: ' $iff: 1 Page !ef: /1/ AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .& %) A firewall allows the organi=ation to A) preent unauthori=ed communication +oth into and out of the network. ) monitor network hot spots for signs of intruders. ') preent known spyware and malware from entering the system. $) all of the a+oe. Answer: A $iff: 2 Page !ef: /1& AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 76) In which techniue are network communications are analy=ed to see whether packets are part of an ongoing dialogue +etween a sender and a receierB A) stateful inspection ) intrusion detection system ') application pro4y filtering $) packet filtering Answer: A $iff: / Page !ef: /1 AA'(: "se of I 'A(#: 'omprehension *+ectie: .&
1& Copyright © 2012 Pearson Education, Inc.
71) ???????? use scanning software to look for known pro+lems such as +ad passwords, the remoal of important files, security attacks in progress, and system administration errors. A) (tateful inspections ) Intrusion detection systems ') Application pro4y filtering technologies $) Packet filtering technologies Answer: $iff: 2 Page !ef: /17 AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 72) 'urrently, the protocols used for secure information transfer oer the Internet are A) 'PHIP and ((5. ) (->P and 'A. ') >P and 'PHIP. $) ((5, 5(, and (->P. Answer: $ $iff: 1 Page !ef: /19 AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 7/) Dost antiirus software is effectie against A) only those iruses actie on the Internet and through e-mail. ) any irus. ') any irus e4cept those in wireless communications applications. $) only those iruses already known when the software is written. Answer: $ $iff: 2 Page !ef: /17 AA'(: Analytic (kills 'A(#: (ynthesis in terms of applying *+ectie: .& 7&) In which method of encryption is a single encryption key sent to the receier so +oth sender and receier share the same keyB A) ((5 ) symmetric key encryption ') pu+lic key encryption $) priate key encryption Answer: $iff: 2 Page !ef: /19 AA'(: "se of I 'A(#: 'omprehension *+ectie: .&
1 Copyright © 2012 Pearson Education, Inc.
7) A digital certificate system A) uses third-party 'As to alidate a users identity. ) uses digital signatures to alidate a users identity. ') uses tokens to alidate a users identity. $) is used primarily +y indiiduals for personal correspondence. Answer: A $iff: 2 Page !ef: /1 AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 77) $owntime refers to periods of time in which a A) computer system is malfunctioning. ) computer system is not operational. ') company or organi=ation is not operational. $) computer is not online. Answer: $iff: 2 Page !ef: /1% AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 79) 3or 166 aaila+ility, online transaction processing reuires A) high-capacity storage. ) a multi-tier serer network. ') fault-tolerant computer systems. $) dedicated phone lines. Answer: ' $iff: 1 Page !ef: /1% AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 7) In controlling network traffic to minimi=e slow-downs, a technology called ???????? is used to e4amine data files and sort low-priority data from high-priority data. A) high aaila+ility computing ) deep-packet inspection ') application pro4y filtering $) stateful inspection Answer: $iff: / Page !ef: /1% AA'(: "se of I 'A(#: 'omprehension *+ectie: .&
17 Copyright © 2012 Pearson Education, Inc.
7%) he deelopment and use of methods to make computer systems resume their actiities more uickly after mishaps is called A) high aaila+ility computing. ) recoery oriented computing. ') fault tolerant computing. $) disaster recoery planning. Answer: $iff: 2 Page !ef: /1% AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 96) (maller firms may outsource some or many security functions to A) I(Ps. ) DI(s. ') D((Ps. $) 'As. Answer: ' $iff: 2 Page !ef: /1% AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 91) A practice in which eaesdroppers drie +y +uildings or park outside and try to intercept wireless network traffic is referred to as ????????. Answer: war driing $iff: 2 Page !ef: 2%-2%7 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 92) Dalicious software programs referred to as ???????? include a ariety of threats such as computer iruses, worms, and roan horses. Answer: malware $iff: 1 Page !ef: 2%7 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .1 9/) ???????? is a crime in which an imposter o+tains key pieces of personal information to impersonate someone else. Answer: Identity theft $iff: 1 Page !ef: /61 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2
19 Copyright © 2012 Pearson Education, Inc.
9&) ???????? is the scientific collection, e 4amination, authentication, preseration, and analysis of data held on or retrieed from computer storage media in such a way that the information can +e used as eidence in a court of law. Answer: 'omputer forensics $iff: 2 Page !ef: /69 AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2 9) *n the whole, ???????? controls apply to all computeri=ed applications and consist of a com+ination of hardware, software, and manual procedures that create an oerall control enironment. Answer: general $iff: / Page !ef: /6 AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 97) AGn) ???????? e4amines the firms oerall security enironment as well as the controls goerning indiidual information systems. Answer: DI( audit $iff: 2 Page !ef: /12 AA'(: "se of I 'A(#: 'omprehension *+ectie: .2 99) ???????? refers to the a+ility to know that a person is who he or she claims to +e. Answer: Authentication $iff: 2 Page !ef: /12-/1/ AA'(: !eflectie hinking 'A(#: 'omprehension *+ectie: .2 9) 'omprehensie security management products, with tools for firewalls, 8P
6) 0hen errors are discoered in software programs, the sources of the errors are found and eliminated through a process called ????????. Answer: de+ugging $iff: 1 Page !ef: /2/ AA'(: "se of I 'A(#: 'omprehension *+ectie: .& 1) $iscuss the issue of security challenges on the Internet as that issue applies to a glo+al enterprise. 5ist at least Internet security challenges. Answer: 5arge pu+lic networks, including the Internet, are more ulnera+le +ecause they are irtually open to anyone and +ecause they are so huge that when a+uses do occur, they can hae an enormously widespread impact. 0hen the Internet +ecomes part of the corporate network, the organi=ations information systems can +e ulnera+le to actions from outsiders. 'omputers that are constantly connected to the Internet ia ca+le modem or $(5 line are more open to penetration +y outsiders +ecause they use a fi4ed Internet address where they can +e more easily identified. he fi4ed Internet address creates the target for ha ckers. o +enefit from electronic commerce, supply chain management, and other digital +usiness processes, companies need to +e open to outsiders such as customers, suppliers, and trading partners. 'orporate systems must +e e4tended outside the organi=ation so that employees working with wireless and other mo+ile computing deices can access them. his reuires a new security culture and infrastructure, allowing corporations to e4tend their security policies to include procedures for suppliers and other +usiness partners. $iff: 2 Page !ef: 2%/-2% AA'(: Analytic (kills 'A(#: Analysis in terms of appraise *+ectie: .2
1% Copyright © 2012 Pearson Education, Inc.
2) >ow can a firms security policies contri+ute and relate to the si4 main +usiness o+ectiesB Fie e4amples. Answer: G1) *perational e4cellence: (ecurity policies are essential to ope rational e4cellence. A firms daily transactions can +e seerely disrupted + y cy+ercrime such as hackers. A firms efficiency relies on accurate data. In addition, information assets hae tremendous alue, and the repercussions can +e deastating if they are lost, destroyed, or placed in the wrong hands. G2) uman error might +e most difficult +ecause it isnt caught until too late, and the conseuences may +e disastrous. Also, administratie error can occur at any leel and through any operation or procedure in the company. $iff: 2 Page !ef: 2%/-/2/ AA'(: Analytic (kills 'A(#: #aluation in terms of assess *+ectie: .2
26 Copyright © 2012 Pearson Education, Inc.
&) 0hat are the security challenges faced +y wireless networksB Answer: 0ireless networks are ulnera+le +ecause radio freuency +ands are easy to scan. oth luetooth and 0i-3i networks are suscepti+le to hacking +y eaesdroppers. 5ocal area networks G5Aackers use these tools to detect unprotected networks, monitor network traffic, and, in some cases, gain access to the Internet or to corporate networks. 0i-3i transmission technology was designed to make it easy for stations to find and hear one another. he service set identifiers (SSIDs) identifying the access points in a 0i-3i network are +roadcast multiple times and can + e picked up fairly easily +y intruders sniffer programs. 0ireless networks in many locations do not hae + asic protections against war driing, in which eaesdroppers drie +y +uildings or park outside and try to intercept wireless network traffic. A hacker can employ an 62.11 analysis tool to identify the ((I$. An intruder that has associated with an access point +y using the correct ((I$ is capa+le of accessing other resources on the network, using the 0indows operating system to determine which other users are connected to the network, access their computer hard dries, and open or copy their files. Intruders also use the information they hae gleaned to set up rogue access points on a different radio channel in physical locations close to users to force a users radio
21 Copyright © 2012 Pearson Education, Inc.
) 0hy is software uality important to securityB 0hat specific steps can an organi=ation take to ensure software ualityB Answer: (oftware errors pose a constant threat to information systems, causing untold losses in productiity. Frowing comple4ity and si=e of software programs, coupled with demands for timely deliery to markets, hae contri+uted to an increase in software flaws or ulnera+ilities. A maor pro+lem with software is the presence of hidden +ugs or program code defects. (tudies hae shown that it is irtually impossi+le to eliminate all +ugs from large programs. 3laws in commercial software not only impede performance +ut also create security ulnera+ilities that open networks to intruders. o correct software flaws once they are identified, the software endor creates small pieces of software called patches to repair the flaws without distur+ing the proper operation of the software. *rgani=ations must maintain +est efforts to +oth make sure purchased software is up to date and make sure their own software and programming is as +ugfree as possi+le +y employing software metrics and rigorous software testing. *ngoing use of metrics allows the information systems department and end users to ointly measure the performance of the system and identify pro+lems as they occur. #4amples of software metrics include the num+er of transactions that can +e processed in a specified unit of time, online response time, the num+er of payroll checks printed per hour, and the num+er of known +ugs per hundred lines of program code. 3or metrics to +e successful, they must +e carefully designed, formal, o+ectie, and used consistently. #arly, regular, an d thorough testing will contri+ute significantly to system uality. Food testing +egins +efore a software program is een written +y using a walkthrougha reiew of a specification or design document +y a small group of people carefully selected +ased on the skills needed for the particular o+ecties +eing tested. *nce deelopers start writing software programs, coding walkthroughs also can +e used to reiew program code. >oweer, code must +e tested +y computer runs. 0hen errors are discoered, the source is found and eliminated through a process called de+ugging. $iff: 2 Page !ef: /6/, /26-/2/ AA'(: Analytic (kills 'A(#: #aluation in terms of assess *+ectie: .2 7) >ackers and their companion iruses are an increasing pro+lem, especially on the Internet. 0hat are the most important measurers for a firm to take to protect itself from thisB Is full protection feasi+leB 0hy or why notB Answer: 3or protection, a company must institute good security measures, which will include firewalls, inestigation of personnel to +e hired, physical and software security and controls, antiirus software, and internal education measures. hese measures are +est put in place at the time the system is designed, and careful attention paid to them. A prudent company will engage in disaster protection measures, freuent updating of security software, and freuent auditing of all security measures and of all data upon which the company depends. 3ull protection may not +e feasi+le in light of the time and e4penses inoled, +ut a risk analysis can proide insights into which areas are most important and ulnera+le. hese are the areas to protect first. $iff: 2 Page !ef: /12-/2/ AA'(: Analytic (kills 'A(#: (ynthesis in terms of applying *+ectie: .&
22 Copyright © 2012 Pearson Education, Inc.
9) Eou hae ust +een hired as a security consultant +y DegaDalls Inc., a national chain of retail malls, to make sure that the security of their information systems is up to par. *utline the steps you will take to achiee this. Answer: 1. #sta+lish what data and processes are important and essential to the company. $etermine what e4ternal and internal information is essential to the different employee roles in the company. 2. 'onduct an DI( audit, a security audit, and create a risk assessment analysis. /. #sta+lish what legalHgoernmentalHindustry standards need to +e adhered to and which international standards are releant. &. 'onduct a +usiness impact analysis and determine a disaster recoery and +usiness continuity plan. . 'reate a security policy that defines an accepta+le use policy, authori=ation policies and processes. 7. Plan for any change management needed. 9. $etermine how the success of your policy will +e measured and set up means for measuring this. . Implement such policies. %. Deasure and ealuate the effectieness of the policy and make any additional adustments. $iff: / Page !ef: /6-/2/ AA'(: Analytic (kills 'A(#: (ynthesis in terms of +uild, model *+ectie: .& ) 0hat is a digital certificateB >ow does it workB Answer: $igital certificates are data files used to esta+lish the identity of users and electronic assets for protection of online transactions. A digital certificate system uses a trusted third party, known as a certification authority, to alidate a users identity. he 'A erifies a digital certificate users identity offline. his information is put into a 'A serer, which generates an encrypted digital certificate containing owner identification information and a copy of the owners pu+lic key. he certificate authenticates that the pu+lic key +elongs to the designated owner. he 'A makes its own pu+lic key aaila+le pu+licly either in print or perhaps on the Internet. he recipient of an encrypted message uses the 'As pu+lic key to decode the digital certificate attached to the message, erifies it was issued +y the 'A, and then o+tains the senders pu+lic key and identification information contained in the certificate. "sing this information, the recipient can send an encrypted reply. he digital certificate system would ena+le, for e4ample, a credit card user and a merchant to alidate that their digital certificates were issued +y an authori=ed and trusted third party +efore they e4change data. Pu+lic key infrastructure GPJI), the use of pu+lic key cryptography working with a certificate authority, is now widely used in e-commerce. $iff: 2 Page !ef: /1 AA'(: Analytic (kills 'A(#: Analysis in terms of summari=e *+ectie: .&
2/ Copyright © 2012 Pearson Education, Inc.
%) $efine a fault-tolerant computer system and a high-aaila+ility computer system. >ow do they differB 0hen would each +e usedB Answer: oth systems use +ackup hardware resources. 3ault-tolerant computer systems contain e4tra memory chips, processors, and disk storage d eices that can +ack the system up and keep it running to preent a system failure. >igh-aaila+ility computing places the emphasis on uick recoery from a system crash. A high-aaila+ility system includes redundant serers, mirroring, load +alancing, clustering, storage area networks, and a good disaster recoery plan. he main difference +etween them is that fault-tolerant computer systems dont go d ownK high-aaila+ility computer systems go down, +ut can recoer uickly. 'ompanies needing a technology platform with 166 percent, 2&-hr system aaila+ility, use fault-tolerant computer systems. >igh-aaila+ility computing enironments are a minimum reuirement for firms with heay electronic commerce processing or that depend on digital networks for their internal operations. $iff: 2 Page !ef: /1% AA'(: Analytic (kills 'A(#: #aluation in terms of compare, assess *+ectie: .& %6) >ow is the security of a firms information system and data affected +y its people, organi=ation, and technologyB Is the contri+ution of one of these dimensions any more important than the otherB 0hyB Answer: here are arious technological essentials to protecting an information system: firewalls, authentication, encryption, anti-irus protection etc. 0ithout technology implemented correctly, there is no security. A firms employees are its greatest threat, in terms of em+e==lement and insider fraud, errors, and la4 enforcement of security policies. Pro+a+ly the most important dimension is organi=ation, +ecause this is what determines a firms +usiness processes and policies. he firms information policies can most enhance security +y stressing intelligent design of security systems, appropriate use of security technology, and the usa+ility of its security processes. $iff: / Page !ef: 2%/-/2/ AA'(: Analytic (kills 'A(#: #aluation in terms of assess *+ectie: .2
2& Copyright © 2012 Pearson Education, Inc.
