30

IT Security (Subject) / IT Security (Lesson)

This lesson was created by medianist.

Learn lesson

This lesson is not released for learning.

back  |  next 1 / 1

• What are the 4 reasons hackers hack? a.Profit (crime pays) b.Advantage (corporate espionage) c.     Social protest (embarrass government or company) d.     National state conflict (cyber warfare)
• How has information security changed over time? a) Technology changed over time and keeps on doing so. b) Due to these changes the information security had to change as well à adapt security information security to the technology development and keep adapting it in future.
• Explain how threats, exposure, and vulnerability relate to risk Risk is the probability of a threat acting on a vulnerability. Threat situations are for example unauthorized access, modification (changes), destruction (delete), and disclosure (illegal copy) Vulnerability means a known problem within a system or program, like a weakness. Exposure stands for the opportunity for an attack on a vulnerability. The longer the company is on, the bigger the risk  
• What is the most important component in developing a security program? The policy dictates the technology and influences the priorities. Having the top management on your side when developing a security program is inevitable
• What background, skills, and knowledge must an information security professional have? Get the right certification (CISSP, GIAC) Consider earning a graduate degree in INFOSEC Increase your disaster recovery and risk management skills
• Explain the difference between security and assurance. Security is oriented towards technology, whereas assurance is management-oriented and focuses on human beings. Assurance will eventually replace security Security: A system of people, processes, and technology controls are essential elements of information technology security including operations security, applications development security, physical security, and cryptography. Security is technically oriented. The focus is the protection of the data.-  availability of systems and data for intended use only,- 
• Explain the relationship between IT secuirty principles and system life cycle. Give an example. (ref: NIST 800-27) IT principles provide a foundation upon which a more consistent and structured approach to the design, development, and implementation of IT security capabilities can be constructed. Those principles can be applied in different phases of the system life cycle. If applied, they can either support the system life cycle or even represent the key to successful completion of the life-cycle phase.
• Explain the Security Service Model (ref: NIST 800-33, page 5, Fig 3-1). a.     The Security Service Model shows the primary services and supporting elements used in implementing an information technology security capability, along with their primary relationships. The model also classifies the services according to their primary purpose as follows: ·         Support. These services are generic and underlie most information technology security capabilities, e.g. Identification, cryptographic key management, security administration or system protections (least privilege, object reuse…). ·         Prevent. These services focus on preventing a security breach from occurring, e.g. authentication, authorization, access control enforcement, transaction privacy, non-repudiation…). ·         Recover. The services in this category focus on the detection and recovery from a security breach, e.g. audit, proof of wholeness, restore “secure” state, intrusion detection and containment…). b.     Example primary availability services: One aspect of maintaining effectiveness is protection from unauthorized changes or deletions by defining authorized access and enforcing this definition. Mission effectiveness is also maintained by detecting intrusions, detecting a loss of wholeness, and providing the means of returning to a secure state. c.     Example Primary Confidentiality Services: The detection and recovery services that can play an important role in maintaining availability and integrity do not apply to confidentiality. The protection of communications from disclosure, the enforcement of authorized read accesses, and the capability for privacy provide for confidentiality.
• What are the conditions for NO or ACCEPTABLE risks? (ref: NIST 800-33, page 18). a.     No risk: There is no flaw or weakness known. You have to deal with normal risk situations, however you are not aware of them in advance. b.     Acceptable risks: Flaws or weaknesses representing an acceptable risk that is understood and tolerated usually because the cost or difficulty of implementing an effective countermeasure for the associated vulnerability exceeds the expectation of loss or the hacker’s cost is expected to be smaller than his gain. c.     Copy from the paper: ·         The mitigation of risk from attack by technical means can be accomplished at the following points: ·         − Flaw exists. Remedy: implement assurance techniques to reduce the likelihood of a flaw. ·         − Flaw is exploitable. Remedy: apply layered protections and architectural designs to prevent exploitability. ·         − Attacker’s cost is less than gain –Remedy: apply protections to increase attacker’s cost (note that non-technical choices such as limiting what is processed can significantly reduce attacker’s gain) ·         − Loss is too great. –Remedy: apply design principles, architectural designs, and technical protections to limit extent of attack, thereby reducing loss. (Again, note that non-technical choices such as limiting what is processed may provide the most effective risk mitigation.)
• Explain Functional and Assurance requirements. Functional requirements: Describe what a system should do. It’s about the question ‘What?’ Assurance requirements: Describe how functional requirements should be implemented and tested (doing the right thing). It’s about the question ‘Why’?
• Advertisement
• How are the psychological motives of a hacker related to risk? Greed, emotions, monetary reasons…
• Explain the difference and relationships between policies and standards. Provide examples. Policies are management instructions indicating a predetermined course of action, or a way to handle a problem or situation. Policies are high-level statements that provide guidance to workers who must make present and future decisions. Policies are generalized requirements that must be written down and communicated to certain groups of people inside, and in some cases outside, the organization. Policies also can be considered to be business rules. Policies are mandatory and can be thought of as the equivalent of organization-specific law. Special approval is required when a worker wishes to take a course of action that is not in compliance with policy. Because compliance is required, policies use definitive words like "must not" or "you must." Cybersecurity standards are security standards which enable organizations to practice safe security techniques to minimize the number of successful cybersecurity attacks. These guides provide general outlines as well as specific techniques for implementing cybersecurity Policies are managerial on a strategic level, telling what to do. Standards are tactical, describing how to do for technical procedures (operational).  Examples for Policies (i.e. bring laptop to work):
• What are 5 ways to deal with and ``implement`` risk countermethods? Accept (tolerate smaller risks/losses) -> high likelihood, low impact Avoidance Transfer - insurance
• Discuss the ISO 27000 series (27001, 27002) ISO27001 managerial code of practice deals with information security management (see content)
• Explain the Clark-Wilson model Requires mathematical proof that steps are performed in order exactly as they are listed (operating system), authenticates the individuals who perform the steps (working isolation), and defines separation of duties (insures integrity)
• How are continuity planning and disaster recovery planning alike and different? Both share the common goal of keeping a business running in the event of an emergency or interruptions
• Business continuity plan (BCP) describes the critical processes, procedures, and personnel that must be protected in the event of an emergency uses the business impact analysis (BIA) to evaluate risks to the organization and to prioritize the systems in use for purposes of recovery no matter what happened, you stay in business
• Disaster recovery plan (DRP) describes the exact steps and procedures personnel in key departments should be followed in order to recover critical business systems in the event of a disaster that causes the loss of access to systems required for business operations Everything’s back to normal
• The 4 ways cyber criminals commit crimes Botnet Fast Flux Zombie Computer Social Engineering
• Describe Botnet a network of software robots, or bots, that automatically spread malware
• What is Fast Flux moving data quickly among the computers in a botnet to make it difficult to trace the source of malware or phishing websites
• What is Zombie Computer a computer that has been hacked into and is used to launch malicious attacks or to become part of a botnet
• What is Social Engineering using lies and manipulation to trick people into revealing their personal information. Phishing is a form of social engineering
• What is Denial-of-Service attacks flooding a network or server with traffic in order to make it unavailable to its users
• What is Skimmers Devices that steal credit card information when the card is swiped through them. This can happen in stores or restaurants when the card is out of the owner's view, and frequently the credit card information is then sold online through a criminal community
• How does a public/private key encryption work? Klartext wird mit dem öffentlichen Schlüssel verschlüsselt. Der Geheimtext kann nur mit dem privaten Schlüssel wieder entschlüsselt werden
• What is the difference between a bastion host and a firewall. A Bastion host is a special purpose computer on a network specifically designed and configured to withstand attacks. The computer generally hosts a single application, for example a proxy server
• Explain how a SYN/ACK denial of service attacks work and how to deal with them. 3-way handshake 1. Client request connection 2. Server reply done, sent SYN-ACK & waiting for ACK(Port half-open SYN_RECV) Clients DOES NOT send ACK NETSTAT shows open ports
• What is Cloud Computing? Provide details. Processes and data storage somewhere on the cloud. Not concern with physical location. Only access via Internet Client PC’s become dumb workstations that access vendor servers (mainframe days- centralize) Virtual servers over the Internet Outsourcing on the Internet Pay-per-use service in real time over the Internet.
• As a corporate manger, what must you be alert to or aware of when dealing with international business partners? a.     Different laws, culture

back  |  next 1 / 1