Chapter 7 Security Answers

File: 6e chapter7TextBank.docx, Chapter 7, Security Multiple Choice 1. In the Office of Personnel Management’s case, the security breach made many people vulnerable to this. a) Loss of personal property b) Inaccurate personal data c) Identity theft d) Loss of access to personal data e) Credit card fees Ans: c (Hard) Response: See page 148 2. When the Office of Personnel Management was hacked, all of the following are true except: a) The hackers gained access to the building to steal the records b) It took the Office of Personnel Management many months to detect the break-in c) The hackers likely exploited a stolen password d) The hackers did not need to escape in the blue turbocharged vehicle e) None of the above (indicating that all are true) Ans: a (Medium) Response: See page 148 3. Many organizations and even consumers use this to control access to a network like the Internet, allowing only authorized traffic to pass. a) Encryption b) VPN c) Firewall d) Anonymizing tools e) Filtering Ans: c (Medium) Response: See page 158 4. If you receive an email that says it is from Sam Johnson, your boss, with an odd EXE file as an attachment, it could be dangerous for all of the following reasons except: a) It could be dangerous because the email might not really be from Sam. b) It could be dangerous because the email might be from Sam’s computer without his or her knowledge. c) It could be dangerous even if it was sent knowingly because Sam didn’t know a virus might be attached. d) It could be dangerous because Sam gave someone his password once a long time ago e) None of the above (indicating that all are true). Ans: e (Medium) Response: See page 162 5. It is estimated that ___ % of all firms have been breached: a) 5% or less b) 10% to 20% c) 40% to 60% d) 70% to 90% e) Over 95% Ans: e (Medium) Response: See page 149 6. Who is responsible for decisions about security strategy? a) IT people b) Shared: IT leaders and business leaders c) Business leaders d) Consultants e) Team of consultants and IT people Ans: c (Medium) Response: See page 149 7. Who is responsible for developing security education, awareness, and training programs? a) IT people b) Shared: IT leaders and business leaders c) Business leaders d) Consultants e) Team of consultants and IT people Ans: b (Medium) Response: See page 149 8. In the Anthem Blue Cross breach, where 80 million names, birthdays, social security numbers, etc., were stolen, the hackers got in by: a) Breaking into the building where they were stored b) Obtaining passwords of five or more high-level employees c) Making phone calls to insiders posing as IT people needing to log into their accounts d) Emailing each of the 80 million patients asking for their private information e) Recovering patient records from a large recycling bin Ans: b (Medium) Response: See page 151 9. ___ of breaches are caused by stealing a password a) A very low percentage (somewhere around 1%) b) A low percentage (around 10%) c) A moderate percentage (around 25%) d) A high percentage (around 50%) e) A very high percentage (around 80%) Ans: e (Medium) Response: See page 151 10. The most common password of all in 2014 is: a) Something complex that is hard to remember b) None at all—they most commonly skip passwords and just press ENTER to continue c) “password” d) “123456” e) “Rihanna” Ans: d (Medium) Response: See page 152 11. An “evil twin” in the context of computer security is: a) A virus-laden attachment that looks just like a sincere attachment b) A duplicate badge that allows a nasty person entry into a data center c) Someone who looks just like the Chief Information Officer, but steals data d) An operating system that is not genuine e) A counterfeit wifi connection in a hotel or coffee shop that appears to be genuine Ans: e (Medium) Response: See page 152 12. The cost of a data breach in 2015 is estimated to be: a) between $13 and $18 per record b) c) d) e) between $43 and 65 per record between $145 and $154 per record between $100 and $1,000 per record between $4,520 and $4,580 per record Ans: c (Medium) Response: See page 153 12. On the black market, stolen data in a “kit” that contains credit card information plus social security number and medical information is worth: a) between $13 and $18 per record b) between $43 and 65 per record c) between $145 and $154 per record d) between $100 and $1,000 per record e) between $4,520 and $4,580 per record Ans: d (Medium) Response: See page 154 13. It usually takes ____ for someone in a firm to discover a security compromise in a system, after the evidence shows up in logs or alerts a) Several seconds b) Several minutes c) Several hours d) Several days e) Several months Ans: e (Medium) Response: See page 148 14. Included in the five critical elements that are used to raise security in a firm are all of the following except: a) Infrastructure b) Law enforcement c) Policies d) Training e) Investments Ans: b (Hard) Response: See page 155 15. Examples of multi-factor authentication are: a) passwords and text messages b) passwords with longer than one character c) a human will chat with you to see who you are d) using two badges to allow you into a building e) none of the above Ans: a (Medium) Response: See pages 157, 158 16. All of the following are classic signs of a phishing message except: a) Your email in-box is full and you must click on a link to increase storage b) You just won a lottery or contest, and you need to click on a link to claim your prize c) Poor grammar or spelling in a note that purports to be from a large company d) Goods or services are offered at an impossibly low price e) An emailed ad oddly does not provide any active links Ans: e (Hard) Response: See page 161 17. Spoofing is: a) When someone makes fun of you for falling for a phishing scam b) When the “from” address says the name/email address of a person different from who really sent it c) When hackers snoop around in a system d) When a person from IT unlocks your email account e) When you receive a notice of an inheritance Ans: b (Medium) Response: See page 162 True/False 18. Over time, attackers have had to increase their skills to be able to attack systems or create viruses. Ans: False Response: See page 155 19. Thanks to tightened security in operating systems, it is more difficult than ever before for hackers to break into systems, compared to the early 1990s, when people were much less often protected, less aware of risks, and more easily fooled. Ans: False Response: See page 155 20. If you receive an email from your son, and the body of the email tells you to open an attachment because it is funny, the risk is pretty close to zero because it came from your son. Ans: False Response: See page 162 21. In the Target breach, the HVAC systems were actually attached to the retail sales system. Ans: True Response: See page 153 22. In the Target breach, the IT department was warned on or about the time the files were transferred. Ans: True Response: See page 153 23. According to the late L. Dain Gary, “You cannot make a computer secure.” Ans: True Response: See page 154 24. A hacker who buys credit card information from hackers receives a short-term guarantee in case the card is declined. Ans: True Reesponse: See page 155 25. You can purchase stolen credit cards on the “deep web” using a browser called “Tor.” Ans: True Response: See page 155 26. The deep web is a part of the internet that includes unindexed websites offering both legal and illegal items, such as passports, citizenship, and even murders for hire. Ans: True Response: See page 155 27. The Deep Web is reputed to be 400 times larger than the public web. Ans: True Response: See page 155 28. A challenge question is when you are stopped at the gate and the guard asks who you are. Ans: False Response: See page 156 29. Two factor authentication is when you use two different methods for people trying to use the system. For instance, you can use a password and a challenge question Ans: True Response: See page 156 30. Firewalls can be either in hardware or software form. Ans: True Response: See page 157 Short Answer 31. This is a situation in which the thief counterfeits a different person’s address Ans: spoofing Response: See page 162 32. What is a piece of software that traps keystrokes and stores them for hackers to inspect later? Ans: Key logger Response: See page 152 33. What is Poulson’s Law? Ans: Information is secure when it costs more to get to it than it is worth. Response: See page 154 Essay 34. What security and controls should a company use to protect its computer infrastructure? Why do managers need to be involved in the decisions about security and control measures? 35. Internal threats are considered the most lethal threat. What are they, why are they so lethal and what can a company do to protect against them? 36. What are the shortcomings of passwords? 37. What is a challenge question? 38. Of the seven security policies noted in Chapter 7 (Figure 7.5), name at least three. Matching 39. Match the security tool to its security category. Hardware system security and control Hardware system security and control Network and software security control Network and software security control Broadcast medium security and controls Firewalls used to control access to a network Encryption techniques to protect the content of transmitted messages Server software to protect Web sites Security information management schemes to protect against unauthorized access to computers and the network Filtering software that keeps “black listed” sites from displaying