Chapter 8 Securing Information Systems

Chapter 8 Securing Information Systems 1) Which of the following refers to policies, procedures, and technical measures used to prevent unauthorized access, alteration, theft, or physical damage to information systems? A) Security B) Controls C) Benchmarking D) Algorithms E) Identity management Answer: A Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 2) Which of the following refers to all of the methods, policies, and organizational procedures that ensure the safety of the organization's assets, the accuracy and reliability of its accounting records, and operational adherence to management standards? A) Legacy systems B) SSID standards C) Vulnerabilities D) Security policy E) Controls Answer: E Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 3) Most computer viruses deliver a: A) worm. B) Trojan horse. C) driveby download. D) keylogger. E) payload. Answer: E Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 1 4) Which of the following statements about wireless security is not true? A) SSIDs are broadcast multiple times and can be picked up fairly easily by sniffer programs. B) Radio frequency bands are easy to scan. C) An intruder who has associated with an access point by using the correct SSID is capable of accessing other resources on the network. D) Intruders can force a user's NIC to associate with a rogue access point. E) Bluetooth is the only wireless technology that is not susceptible to hacking by eavesdroppers. Answer: E Difficulty: Challenging AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 5) All of the following are specific security challenges that threaten the communications lines in a client/server environment except: A) errors. B) tapping. C) theft and fraud. D) radiation. E) sniffing. Answer: A Difficulty: Challenging AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 6) All of the following are specific security challenges that threaten corporate servers in a client/server environment except: A) hacking. B) malware. C) denial-of-service attacks. D) sniffing. E) vandalism. Answer: D Difficulty: Challenging AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 2 7) All of the following are specific security challenges that threaten corporate systems in a client/server environment except: A) theft of data. B) copying of data. C) alteration of data. D) radiation. E) hardware failure. Answer: D Difficulty: Challenging AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 8) CryptoLocker is an example of which of the following? A) Worm B) SQL injection attack C) Sniffer D) Evil twin E) Ransomware Answer: E Difficulty: Easy AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 9) Which of the following statements about Internet security is not true? A) The use of P2P networks can expose a corporate computer to outsiders. B) A corporate network without access to the Internet is more secure than one that provides access. C) VoIP is more secure than the switched voice network. D) Instant messaging can provide hackers access to an otherwise secure network. E) Smartphones have the same security weaknesses as other Internet devices. Answer: C Difficulty: Challenging AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 10) A Trojan horse: A) is software that appears to be benign but does something other than expected. B) is a virus that replicates quickly. C) is malware named for a breed of fast-moving Near-Eastern horses. D) installs spyware on users' computers. E) is a type of sniffer used to infiltrate corporate networks. Answer: A Difficulty: Easy AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 3 11) A salesperson clicks repeatedly on the online ads of a competitor in order to drive the competitor's advertising costs up. This is an example of: A) phishing. B) pharming. C) spoofing. D) evil twins. E) click fraud. Answer: E Difficulty: Moderate AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 12) Which of the following is a virus that uses flaws in Windows software to take over a computer remotely? A) Sasser B) Zeus C) Cryptolocker D) ILOVEYOU E) Conficker Answer: E Difficulty: Challenging AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 13) ________ is malware that hijacks a user's computer and demands payment in return for giving back access. A) A Trojan horse B) Ransomware C) Spyware D) A virus E) An evil twin Answer: B Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 14) ________ is malware that logs and transmits everything a user types. A) Spyware B) A Trojan horse C) A keylogger D) A worm E) A sniffer Answer: C Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 4 15) Which of the following statements about botnets is not true? A) Eighty percent of the world's malware is delivered by botnets. B) Botnets are often used to perpetrate DDoS attacks. C) Ninety percent of the world's spam is delivered by botnets. D) Botnets are often used for click fraud. E) It is not possible to make a smartphone part of a botnet. Answer: E Difficulty: Challenging AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 16) Using numerous computers to inundate and overwhelm the network from numerous launch points is called a(n) ________ attack. A) DDoS B) DoS C) SQL injection D) phishing E) botnet Answer: A Difficulty: Moderate AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 17) Which of the following is not an example of a computer used as a target of crime? A) Knowingly accessing a protected computer to commit fraud B) Accessing a computer system without authority C) Illegally accessing stored electronic communication D) Threatening to cause damage to a protected computer E) Breaching the confidentiality of protected computerized data Answer: C Difficulty: Moderate AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 18) Which of the following is not an example of a computer used as an instrument of crime? A) Theft of trade secrets B) Intentionally attempting to intercept electronic communication C) Unauthorized copying of software D) Breaching the confidentiality of protected computerized data E) Schemes to defraud Answer: D Difficulty: Challenging AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 5 19) Which of the following specifically makes malware distribution and hacker attacks to disable websites a federal crime? A) Computer Fraud and Abuse Act B) Economic Espionage Act C) Electronic Communications Privacy Act D) Data Security and Breach Notification Act E) National Information Infrastructure Protection Act Answer: E Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 20) The intentional defacement or destruction of a website is called: A) spoofing. B) cybervandalism. C) cyberwarfare. D) phishing. E) pharming. Answer: B Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 21) Evil twins are: A) Trojan horses that appears to the user to be a legitimate commercial software application. B) e-mail messages that mimic the e-mail messages of a legitimate business. C) fraudulent websites that mimic a legitimate business's website. D) computers that fraudulently access a website or network using the IP address and identification of an authorized computer. E) bogus wireless network access points that look legitimate to users. Answer: E Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 22) Pharming involves: A) redirecting users to a fraudulent website even when the user has typed in the correct address in the web browser. B) pretending to be a legitimate business's representative in order to garner information about a security system. C) setting up fake website to ask users for confidential information. D) using e-mails for threats or harassment. E) setting up fake Wi-Fi access points that look as if they are legitimate public networks. Answer: A Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 6 23) Which of the following is the single greatest cause of network security breaches? A) Viruses B) User lack of knowledge C) Trojan horses D) Cyberwarfare E) Bugs Answer: B Difficulty: Moderate AACSB: Analytical thinking LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 24) Tricking employees into revealing their passwords by pretending to be a legitimate member of a company is called: A) sniffing. B) social engineering. C) phishing. D) pharming. E) snooping Answer: B Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 25) According to Ponemon Institute's 2015 Annual Cost of Cyber Crime Study, the average annualized cost of cybercrime for companies in the United States was approximately: A) $1.5 million. B) $15 million. C) $150 million. D) $1.5 billion. E) $15 billion. Answer: B Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 26) Which of the following refers to eavesdroppers driving by buildings or parking outside and trying to intercept wireless network traffic? A) War driving B) Sniffing C) Cybervandalism D) Drive-by tapping E) Snooping Answer: A Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 7 27) ________ is a crime in which an imposter obtains key pieces of personal information to impersonate someone else. A) Identity theft B) Spoofing C) Social engineering D) Evil twins E) Pharming Answer: A Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 28) ________ identify the access points in a Wi-Fi network. A) NICs B) Mac addresses C) URLs D) UTMs E) SSIDs Answer: E Difficulty: Challenging AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 29) A foreign country attempting to access government networks in order to disable a national power grid is an example of: A) phishing. B) denial-of-service attacks. C) cyberwarfare. D) cyberterrorism. E) evil twins. Answer: C Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 30) According to the 2016 Identity Fraud Study by Javelin Strategy & Research, how much did consumers lose to identity fraud in 2015? A) $1.5 million B) $15 million C) $150 million D) $1.5 billion E) $15 billion Answer: E Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 8 31) All of the following have contributed to an increase in software flaws except: A) the growing complexity of software programs. B) the growing size of software programs. C) demands for timely delivery to markets. D) the inability to fully test programs. E) the increase in malicious intruders seeking system access. Answer: E Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 32) Which of the following is an example of a keylogger? A) Zeus B) Conficker C) Sasser D) ILOVEYOU E) Cryptolocker Answer: A Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 33) Smartphones have the same security flaws as other Internet-connected devices. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 34) The Apple iOS platform is the mobile platform most frequently targeted by hackers. Answer: FALSE Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 35) Viruses can be spread through e-mail. Answer: TRUE Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 36) The term cracker is used to identify a hacker whose specialty is breaking open security systems. Answer: FALSE Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 9 37) Wireless networks are more difficult for hackers to gain access too because radio frequency bands are difficult to scan. Answer: FALSE Difficulty: Moderate AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 38) A computer virus replicates more quickly than a computer worm. Answer: FALSE Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 39) One form of spoofing involves forging the return address on an e-mail so that the e-mail message appears to come from someone other than the sender. Answer: TRUE Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 40) Sniffers enable hackers to steal proprietary information from anywhere on a network, including e-mail messages, company files, and confidential reports. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 41) DoS attacks are used to destroy information and access restricted areas of a company's information system. Answer: FALSE Difficulty: Moderate AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 42) Zero defects cannot be achieved in larger software programs because fully testing programs that contain thousands of choices and millions of paths would require thousands of years. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 43) Most IoT devices support sophisticated security approaches. Answer: FALSE Difficulty: Moderate AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 10 44) Malicious software programs referred to as spyware include a variety of threats such as computer viruses, worms, and Trojan horses. Answer: FALSE Difficulty: Easy AACSB: Application of knowledge LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 45) What are the security challenges faced by wireless networks? Answer: Wireless networks are vulnerable because radio frequency bands are easy to scan. Both Bluetooth and Wi-Fi networks are susceptible to hacking by eavesdroppers. Local area networks (LANs) using the 802.11 standard can be easily penetrated by outsiders armed with laptops, wireless cards, external antennae, and hacking software. Hackers use these tools to detect unprotected networks, monitor network traffic, and, in some cases, gain access to the Internet or to corporate networks. Wi-Fi transmission technology was designed to make it easy for stations to find and hear one another. The service set identifiers (SSIDs) identifying the access points in a Wi-Fi network are broadcast multiple times and can be picked up fairly easily by intruders' sniffer programs. Wireless networks in many locations do not have basic protections against war driving, in which eavesdroppers drive by buildings or park outside and try to intercept wireless network traffic. A hacker can employ an 802.11 analysis tool to identify the SSID. An intruder that has associated with an access point by using the correct SSID is capable of accessing other resources on the network, using the Windows operating system to determine which other users are connected to the network, access their computer hard drives, and open or copy their files. Intruders also use the information they have gleaned to set up rogue access points on a different radio channel in physical locations close to users to force a user's radio NIC to associate with the rogue access point. Once this association occurs, hackers using the rogue access point can capture the names and passwords of unsuspecting users. Difficulty: Challenging AACSB: Information technology; Written and oral communication LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 46) Explain how an SQL injection attack works and what types of systems are vulnerable to this type of attack. Answer: SQL injection attacks take advantage of vulnerabilities in poorly coded web application software to introduce malicious code into a company's systems and networks. These vulnerabilities occur when a web application fails to properly validate or filter data entered by a user on a web page, which might occur when ordering something online. An attacker uses this input validation error to send a rogue SQL query to the underlying database to access the database, plant malicious code, or access other systems on the network. Large web applications using databases are most vulnerable, as they may have hundreds of places for inputting user data, each of which creates an opportunity for an SQL injection attack. Difficulty: Challenging AACSB: Information technology; Written and oral communication LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 11 47) How is the security of a firm's information system and data affected by its people, organization, and technology? Is the contribution of one of these dimensions any more important than the other? Why? Answer: There are various technological essentials to protecting an information system: firewalls, authentication, encryption, anti-virus protection etc. Without technology implemented correctly, there is no security. A firm's employees are its greatest threat, in terms of embezzlement and insider fraud, errors, and lax enforcement of security policies. Probably the most important dimension is organization, because this is what determines a firm's business processes and policies. The firm's information policies can most enhance security by stressing intelligent design of security systems, appropriate use of security technology, and the usability of its security processes. Difficulty: Challenging AACSB: Analytical thinking; Written and oral communication LO: 8-1: Why are information systems vulnerable to destruction, error, and abuse? 48) The HIPAA Act of 1996: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. E) identifies computer abuse as a crime and defines abusive activities. Answer: D Difficulty: Moderate AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 49) The Gramm-Leach-Bliley Act: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. E) identifies computer abuse as a crime and defines abusive activities. Answer: A Difficulty: Challenging AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 12 50) The Sarbanes-Oxley Act: A) requires financial institutions to ensure the security of customer data. B) specifies best practices in information systems security and control. C) imposes responsibility on companies and management to safeguard the accuracy of financial information. D) outlines medical security and privacy rules. E) identifies computer abuse as a crime and defines abusive activities. Answer: C Difficulty: Moderate AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 51) Which of the following is the most common type of electronic evidence? A) Voice-mail B) Spreadsheets C) Instant messages D) E-mail E) VOIP data Answer: D Difficulty: Moderate AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 52) Which of the following is a type of ambient data? A) Computer log containing recent system errors B) A file deleted from a hard disk C) A file that contains an application's user settings D) A set of raw data from an environmental sensor E) Data that has been recorded over Answer: B Difficulty: Easy AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 53) Computer forensics tasks include all of the following except: A) presenting collected evidence in a court of law. B) securely storing recovered electronic data. C) collecting physical evidence on the computer. D) finding significant information in a large volume of electronic data. E) recovering data from computers while preserving evidential integrity. Answer: C Difficulty: Moderate AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 13 54) Target has had to pay out over $100 million to U.S. banks, credit card companies and consumers as a result of a data breach in 2013. Answer: TRUE Difficulty: Easy AACSB: Application of knowledge LO: 8-2: What is the business value of security and control? 55) Three major concerns of system builders and users are disaster, security, and human error. Of the three, which do you think is most difficult to deal with? Why? Answer: Student answers will vary. Example answers are: Disaster might be the most difficult because it is unexpected, broad-based, and frequently life threatening. In addition, the company cannot know if the disaster plan will work until a disaster occurs, and then it's too late to make corrections. Security might be the most difficult because it is an ongoing problem, new viruses are devised constantly, and hackers get smarter every day. Furthermore, damage done by a trusted employee from inside cannot be obviated by system security measures. Human error might be most difficult because it isn't caught until too late, and the consequences may be disastrous. Also, administrative error can occur at any level and through any operation or procedure in the company. Difficulty: Challenging AACSB: Analytical thinking; Written and oral communication LO: 8-2: What is the business value of security and control? 56) Hackers and their companion viruses are an increasing problem, especially on the Internet. What are the most important measurers for a firm to take to protect itself from this? Is full protection feasible? Why or why not? Answer: For protection, a company must institute good security measures, which will include firewalls, investigation of personnel to be hired, physical and software security and controls, antivirus software, and internal education measures. These measures are best put in place at the time the system is designed, and careful attention paid to them. A prudent company will engage in disaster protection measures, frequent updating of security software, and frequent auditing of all security measures and of all data upon which the company depends. Full protection may not be feasible in light of the time and expenses involved, but a risk analysis can provide insights into which areas are most important and vulnerable. These are the areas to protect first. Difficulty: Moderate AACSB: Analytical thinking; Information technology; Written and oral communication LO: 8-2: What is the business value of security and control? 14 57) Define computer forensics and describe the types of problems it is designed to address. Answer: Computer forensics involves the scientific collection, examination, authentication, preservation, and analysis of data held on or retrieved from computer storage media in such a way that the information can be used as evidence in a court of law. It deals with the following problems: • Recovering data from computers while preserving evidential integrity • Securely storing and handling recovered electronic data • Finding significant information in a large volume of electronic data • Presenting the information to a court of law Electronic evidence may reside on computer storage media in the form of computer files and as ambient data, which are not visible to the average user. An example might be a file that has been deleted on a PC hard drive. Data that a computer user may have deleted on computer storage media can be recovered through various techniques. Computer forensics experts try to recover such hidden data for presentation as evidence. An awareness of computer forensics should be incorporated into a firm's contingency planning process. Difficulty: Challenging AACSB: Application of knowledge; Written and oral communication LO: 8-2: What is the business value of security and control? 58) Your company, an online discount pet supply store, has calculated that a loss of Internet connectivity for 3 hours results in a potential loss of $2,000 to $3,000 and that there is a 50% chance of this occurring each year. What is the annual expected loss from this exposure? A) $500 B) $1,000 C) $1,250 D) $1,500 E) $2,500 Answer: C Difficulty: Moderate AACSB: Application of knowledge LO: 8-3: What are the components of an organizational framework for security and control? 59) Application controls: A) can be classified as input controls, processing controls, and output controls. B) govern the design, security, and use of computer programs and the security of data files in general throughout the organization. C) apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment. D) include software controls, computer operations controls, and implementation controls. E) monitor the use of system software and prevent unauthorized access to software and programs. Answer: A Difficulty: Moderate AACSB: Information technology LO: 8-3: What are the components of an organizational framework for security and control? 15 60) ________ controls ensure that valuable business data files on either disk or tape are not subject to unauthorized access, change, or destruction while they are in use or in storage. A) Software B) Administrative C) Data security D) Implementation E) Input Answer: C Difficulty: Challenging AACSB: Information technology LO: 8-3: What are the components of an organizational framework for security and control? 61) An analysis of an information system that rates the likelihood of a security incident occurring and its cost would be included in which of the following? A) Security policy B) AUP C) Risk assessment D) Business impact analysis E) Business continuity plan Answer: C Difficulty: Moderate AACSB: Application of knowledge LO: 8-3: What are the components of an organizational framework for security and control? 62) A statement ranking information risks and identifying security goals would be included in which of the following? A) Security policy B) AUP C) Risk assessment D) Business impact analysis E) Business continuity plan Answer: A Difficulty: Moderate AACSB: Application of knowledge LO: 8-3: What are the components of an organizational framework for security and control? 63) Which of the following defines acceptable uses of a firm's information resources and computing equipment? A) An information systems audit policy B) A CA policy C) A MSSP D) A UTM system E) An AUP Answer: E Difficulty: Easy AACSB: Application of knowledge LO: 8-3: What are the components of an organizational framework for security and control? 16 64) Which of the following focuses primarily on the technical issues of keeping systems up and running? A) Business continuity planning B) Security policies C) Disaster recovery planning D) An AUP E) An information systems audit Answer: C Difficulty: Moderate AACSB: Application of knowledge LO: 8-3: What are the components of an organizational framework for security and control? 65) An acceptable use policy defines the acceptable level of access to information assets for different users. Answer: FALSE Difficulty: Moderate AACSB: Application of knowledge LO: 8-3: What are the components of an organizational framework for security and control? 17 66) How can a firm's security policies contribute and relate to the six main business objectives? Give examples. Answer: A firm's security policies can contribute and relate to the six main business objectives as follows: (1) Operational excellence: Security policies are essential to operational excellence. A firm's daily transactions can be severely disrupted by cybercrime such as hackers. A firm's efficiency relies on accurate data. In addition, information assets have tremendous value, and the repercussions can be devastating if they are lost, destroyed, or placed in the wrong hands. (2) New products, services, business models. Security policies protect a company's ideas for new products and services, which could be stolen by competitors. Additionally, enhanced security could be seen by a customer as a way to differentiate your product. (3) Customer and supplier intimacy: Customers rely on your security if they enter personal data into your information system, for example, credit card information into your e-commerce site. The information you receive from customers and suppliers directly affects how able you are to customize your product, service, or communication with them. (4) Improved decision making: Secure systems make data accuracy a priority, and good decision making relies on accurate and timely data. Lost and inaccurate data would lead to compromised decision making. (5) Competitive advantage: The knowledge that your firm has superior security than another would, on an otherwise level playing field, make your firm more attractive to do business with. Also, improved decision-making, new products and services, which are also affected by security (see above), will contribute to a firm's competitive advantage. Strong security and control also increase employee productivity and lower operational costs. (6) Survival: New laws and regulations make keeping your security system up to date a matter of survival. Inadequate security and control may result in serious legal liability. Firms have been destroyed by errors in security policies. Difficulty: Challenging AACSB: Analytical thinking; Written and oral communication LO: 8-3: What are the components of an organizational framework for security and control? 67) What is the role of an information systems audit? Answer: An information systems audit examines the firm's overall security environment as well as controls governing individual information systems. The auditor should trace the flow of sample transactions through the system and perform tests, using, if appropriate, automated audit software. The information systems audit may also examine data quality. The audit should review technologies, procedures, documentation, training, and personnel. A thorough audit will even simulate an attack or disaster to test the response of the technology, information systems staff, and business employees. The audit lists and ranks all control weaknesses and estimates the probability of their occurrence. It then assesses the financial and organizational impact of each threat. Management is expected to devise a plan for countering significant weaknesses in controls. Difficulty: Moderate AACSB: Application of knowledge; Written and oral communication LO: 8-3: What are the components of an organizational framework for security and control? 18 68) How does disaster recovery planning differ from business continuity planning? Answer: Disaster recovery planning devises plans for the restoration of disrupted computing and communications services. Disaster recovery plans focus primarily on the technical issues involved in keeping systems up and running, such as which files to back up and the maintenance of backup computer systems or disaster recovery services. Business continuity planning, on the other hand, focuses on how the company can restore business operations after a disaster strikes. The business continuity plan identifies critical business processes and determines action plans for handling mission-critical functions if systems go down. Difficulty: Easy AACSB: Application of knowledge; Written and oral communication LO: 8-3: What are the components of an organizational framework for security and control? 69) Which of the following specifications replaced WEP with a stronger security standard that features changing encryption keys? A) TLS B) AUP C) VPN D) WPA2 E) UTM Answer: D Difficulty: Challenging AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 70) Which of the following statements about passwords is not true? A) Authentication cannot be established by the use of a password. B) Password systems that are too rigorous may hinder employee productivity. C) Passwords can be stolen through social engineering. D) Passwords are often disregarded by employees. E) Passwords can be sniffed when being transmitted over a network. Answer: A Difficulty: Challenging AACSB: Application of knowledge LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 71) An authentication token is a(n): A) device the size of a credit card that contains access permission data. B) type of smart card. C) gadget that displays passcodes. D) electronic marker attached to a digital authorization file. Answer: C Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 19 72) All of the following are currently being used as traits that can be profiled by biometric authentication except: A) fingerprints. B) facial characteristics. C) body odor. D) retinal images. E) voice. Answer: C Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 73) A firewall allows the organization to: A) enforce a security policy on data exchanged between its network and the Internet. B) check the accuracy of all transactions between its network and the Internet. C) create an enterprise system on the Internet. D) check the content of all incoming and outgoing e-mail messages. E) create access rules for a network. Answer: A Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 74) ________ use scanning software to look for known problems such as bad passwords, the removal of important files, security attacks in progress, and system administration errors. A) Stateful inspections B) Intrusion detection systems C) Application proxy filtering technologies D) Packet filtering technologies E) Firewalls Answer: B Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 20 75) Currently, the protocols used for secure information transfer over the Internet are: A) TCP/IP and SSL. B) S-HTTP and CA. C) HTTP and TCP/IP. D) S-HTTP and SHTML. E) SSL, TLS, and S-HTTP. Answer: E Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 76) In which method of encryption is a single encryption key sent to the receiver so both sender and receiver share the same key? A) SSL/TLS B) Symmetric key encryption C) Public key encryption D) Private key encryption E) Distributed encryption Answer: B Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 77) A digital certificate system: A) uses third-party CAs to validate a user's identity. B) uses digital signatures to validate a user's identity. C) uses tokens to validate a user's identity. D) is used primarily by individuals for personal correspondence. E) protects a user's identity by substituting a certificate in place of identifiable traits. Answer: A Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 21 78) All of the following are types of information systems general controls except: A) application controls. B) computer operations controls. C) physical hardware controls. D) software controls. E) administrative controls Answer: A Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 79) For 100-percent availability, online transaction processing requires: A) high-capacity storage. B) a multi-tier server network. C) fault-tolerant computer systems. D) dedicated phone lines. E) a digital certificate system. Answer: C Difficulty: Easy AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 80) In controlling network traffic to minimize slow-downs, a technology called ________ is used to examine data files and sort low-priority data from high-priority data. A) high availability computing B) deep packet inspection C) application proxy filtering D) stateful inspection E) unified threat management Answer: B Difficulty: Challenging AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 22 81) An authentication system in which a user must provide two types of identification, such as a bank card and PIN, is called: A) smart card authentication. B) biometric authentication. C) two-factor authentication. D) symmetric key authorization. E) token authentication. Answer: C Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 82) Which of the following provides additional security by determining whether packets are part of an ongoing dialogue between a sender and receiver? A) NAT B) Packet filtering C) Deep packet inspection D) Stateful inspection E) Application proxy filtering Answer: D Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 83) Comprehensive security management products, with tools for firewalls, VPNs, intrusion detection systems, and more, are called ________ systems. A) DPI B) MSSP C) NSP D) PKI E) UTM Answer: E Difficulty: Challenging AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 84) Organizations can use existing network security software to secure mobile devices. Answer: FALSE Difficulty: Challenging AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 23 85) The dispersed nature of cloud computing makes it difficult to track unauthorized access. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 86) Biometric authentication is the use of personal, biographic details such as the high school you attended and the first street you lived on to provide identification. Answer: FALSE Difficulty: Easy AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 87) Packet filtering catches most types of network attacks. Answer: FALSE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 88) NAT conceals the IP addresses of the organization's internal host computers to deter sniffer programs. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 89) SSL is a protocol used to establish a secure connection between two computers. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 90) Public key encryption uses two keys. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 24 91) Smartphones typically feature state-of-the-art encryption and security features, making them highly secure tools for businesses. Answer: FALSE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 92) Authentication refers to verifying that a person is who he or she claims to be. Answer: TRUE Difficulty: Moderate AACSB: Application of knowledge LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 93) You can test software before it is even written by conducting a walkthrough. Answer: TRUE Difficulty: Moderate AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 94) When errors are discovered in software programs, the sources of the errors are found and eliminated through a process called debugging. Answer: TRUE Difficulty: Easy AACSB: Information technology LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 95) Is the cloud a safer and more secure computing environment than an in-house network? Why or why not? Answer: Student evaluations will vary, but should include the understanding that using the cloud for computing distributes data to remote services that a company will not have final control of, that a company's cloud data will be stored alongside the data of other companies, and that various safeguards should be in place to protect your data. A sample answer is: The safety of cloud computing as compared to in-house network computing depends on the security implemented both at the corporation and at the service provider. For example, the company will need to ensure secure procedures and make sure that employees have secure passwords and access levels. The cloud service provider should use encryption for all data, at a minimum. Clients should make sure that the service provider complies with local privacy rules, external security audits, and certifications and provides proof of encryption mechanisms. Difficulty: Moderate AACSB: Information technology; Written and oral communication LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 25 96) Why is software quality important to security? What specific steps can an organization take to ensure software quality? Answer: Software errors pose a constant threat to information systems, causing untold losses in productivity. Growing complexity and size of software programs, coupled with demands for timely delivery to markets, have contributed to an increase in software flaws or vulnerabilities. A major problem with software is the presence of hidden bugs or program code defects. Studies have shown that it is virtually impossible to eliminate all bugs from large programs. Flaws in commercial software not only impede performance but also create security vulnerabilities that open networks to intruders. To correct software flaws once they are identified, the software vendor creates small pieces of software called patches to repair the flaws without disturbing the proper operation of the software. Organizations must maintain best efforts to both make sure purchased software is up to date and make sure their own software and programming is as bugfree as possible by employing software metrics and rigorous software testing. Ongoing use of metrics allows the information systems department and end users to jointly measure the performance of the system and identify problems as they occur. Examples of software metrics include the number of transactions that can be processed in a specified unit of time, online response time, the number of payroll checks printed per hour, and the number of known bugs per hundred lines of program code. For metrics to be successful, they must be carefully designed, formal, objective, and used consistently. Early, regular, and thorough testing will contribute significantly to system quality. Good testing begins before a software program is even written by using a walkthrough—a review of a specification or design document by a small group of people carefully selected based on the skills needed for the particular objectives being tested. Once developers start writing software programs, coding walkthroughs also can be used to review program code. However, code must be tested by computer runs. When errors are discovered, the source is found and eliminated through a process called debugging. Difficulty: Moderate AACSB: Information technology; Written and oral communication LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 26 97) You have just been hired as a security consultant by MegaMalls Inc., a chain of retail malls, to make sure that the security of their information systems is up to par. Outline the steps you will take to achieve this. Answer: To ensure that the security of MegaMalls' information systems is up to par, I would take the following steps: (1) Establish what data and processes are important and essential to the company. Determine what external and internal information is essential to the different employee roles in the company. (2) Conduct a security audit and create a risk assessment analysis. (3) Establish what legal/governmental/industry standards need to be adhered to and which international standards are relevant. (4) Conduct a business impact analysis and determine a disaster recovery and business continuity plan. (5) Create a security policy that defines an acceptable use policy, authorization policies and processes. (6) Plan for any change management needed. (7) Determine how the success of your policy will be measured and set up means for measuring this. (8) Implement such policies. (9) Measure and evaluate the effectiveness of the policy and make any additional adjustments. Difficulty: Challenging AACSB: Analytical thinking; Written and oral communication LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 98) What is a digital certificate? How does it work? Answer: Digital certificates are data files used to establish the identity of users and electronic assets for protection of online transactions. A digital certificate system uses a trusted third party, known as a certification authority, to validate a user's identity. The CA verifies a digital certificate user's identity offline. This information is put into a CA server, which generates an encrypted digital certificate containing owner identification information and a copy of the owner's public key. The certificate authenticates that the public key belongs to the designated owner. The CA makes its own public key available publicly either in print or perhaps on the Internet. The recipient of an encrypted message uses the CA's public key to decode the digital certificate attached to the message, verifies it was issued by the CA, and then obtains the sender's public key and identification information contained in the certificate. Using this information, the recipient can send an encrypted reply. The digital certificate system would enable, for example, a credit card user and a merchant to validate that their digital certificates were issued by an authorized and trusted third party before they exchange data. Public key infrastructure (PKI), the use of public key cryptography working with a certificate authority, is now widely used in e-commerce. Difficulty: Moderate AACSB: Information technology; Written and oral communication LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 27 99) Name and describe four firewall screening technologies. Answer: There are a number of firewall screening technologies, including static packet filtering, stateful inspection, Network Address Translation, and application proxy filtering. They are frequently used in combination to provide firewall protection. • Packet filtering examines selected fields in the headers of data packets flowing back and forth between the trusted network and the Internet, examining individual packets in isolation. This filtering technology can miss many types of attacks. • Stateful inspection provides additional security by determining whether packets are part of an ongoing dialogue between a sender and a receiver. It sets up state tables to track information over multiple packets. Packets are accepted or rejected based on whether they are part of an approved conversation or attempting to establish a legitimate connection. • Network Address Translation (NAT) can provide another layer of protection when static packet filtering and stateful inspection are employed. NAT conceals the IP addresses of the organization's internal host computer(s) to prevent sniffer programs outside the firewall from ascertaining them and using that information to penetrate internal systems. • Application proxy filtering examines the application content of packets. A proxy server stops data packets originating outside the organization, inspects them, and passes a proxy to the other side of the firewall. If a user outside the company wants to communicate with a user inside the organization, the outside user first communicates with the proxy application, and the proxy application communicates with the firm's internal computer. Likewise, a computer user inside the organization goes through the proxy to talk with computers on the outside. Difficulty: Challenging AACSB: Information technology; Written and oral communication LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 100) Explain how two-factor authentication increases security. Answer: Two-factor authentication increases security by validating users by a multistep process. To be authenticated, a user must provide two means of identification, one of which is typically a physical token, such as a smartcard or chip-enabled bank card, and the other of which is typically data, such as a password or PIN (personal identification number). Biometric data, such as fingerprints, iris prints, or voice prints, can also be used as one of the authenticating mechanisms. A common example of two-factor authentication is a bank card; the card itself is the physical item, and the PIN is the data that go with it. Difficulty: Challenging AACSB: Information technology; Written and oral communication LO: 8-4: What are the most important tools and technologies for safeguarding information resources? 28