Test Bank & Solution Manual for Principles of Information Security 7th Edition

Test Bank for Principles of Information Security 7th Edition

richard@qwconsultancy.com

1|Pa ge

Name:

Class:

Date:

Mod 1 Introduction to Information Security True / False 1. During the early years of computing, the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage. a. True b. False ANSWER: True POINTS: 1 DIFFICULTY: Easy REFERENCES: H1: Introduction to Information Security p. 2 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/2/2017 3:48 PM 2. Network security focuses on the protection of physical items, objects, or areas from unauthorized access and misuse. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: What is Security? p. 8 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 12/4/2016 1:54 PM 3. When a computer is the subject of an attack, it is the entity being attacked. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 10 H1: What is Security? H2: Key Information Security Concepts QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 1 Introduction to Information Security DATE CREATED: DATE MODIFIED:

9/14/2016 10:29 AM 9/14/2016 10:29 AM

4. The value of information comes from the characteristics it possesses. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 11 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 5. E-mail spoofing involves sending an e-mail message with a harmful attachment. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 12/4/2016 2:02 PM 6. The possession of information is the quality or state of having value for some purpose or end. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 1 Introduction to Information Security

DATE CREATED: DATE MODIFIED:

security 9/14/2016 10:29 AM 9/14/2016 10:29 AM

7. A breach of possession may not always result in a breach of confidentiality. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 14 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/8/2017 11:50 AM 8. Hardware is often the most valuable asset possessed by an organization, and it is the main target of intentional attacks. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 16 H1: Components of An Information System H2: Data QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/8/2017 11:50 AM 9. Information security can be an absolute. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 17 H1: Security and The Organization H2: Balancing Information Security and Access QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 1 Introduction to Information Security LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 10. To achieve balance—that is, to operate an information system that satisfies the user and the security professional—the security level must allow reasonable access, yet protect against threats. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 17 H1: Security and The Organization H2: Balancing Information Security and Access QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/8/2017 5:20 PM 11. The bottom-up approach to information security has a higher probability of success than the top-down approach. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 18 H1: Security and The Organization H2: Approaches to Information Security Implementation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 12. Using a methodology will usually have no effect on the probability of success. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Security and The Organization H2: Approaches to Information Security Implementation p. 18 QUESTION TYPE: True / False Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 1 Introduction to Information Security HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 12/4/2016 2:12 PM 13. A champion is a project manager, who may be a departmental line manager or staff unit manager, and has expertise in project management and information security technical requirements. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Security and The Organization H2: Security Professionals p. 20 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 14. A data custodian works directly with data owners and is responsible for the storage, maintenance, and protection of the information. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Data Responsibilities QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 15. The roles of information security professionals focus on protecting the organization’s information systems and stored information from attacks. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 20 Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 1 Introduction to Information Security H1: Security and The Organization H2: Communities of Interest QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/8/2021 10:44 AM Modified True / False 16. Every organization, whether public or private and regardless of size, has information it wants to protect. ______ ANSWER: True POINTS: 1 REFERENCES: H1: Introduction to Information Security p. 2 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 4/6/2021 8:48 AM DATE MODIFIED: 4/8/2021 10:46 AM 17. The history of information security begins with the concept of communications security. ______ ANSWER: False - computer POINTS: 1 REFERENCES: H1: Introduction to Information Security p. 3 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 4/6/2021 8:50 AM DATE MODIFIED: 4/8/2021 10:46 AM 18. RAND Report R-609 was the first widely recognized published document to identify the role of management and policy issues in computer security. ______ ANSWER: True POINTS: 1 REFERENCES: p. 5 H1: Introduction to Information Security H2: The 1970s and ’80s QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 1 Introduction to Information Security STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 4/6/2021 8:53 AM DATE MODIFIED: 4/8/2021 10:46 AM 19. Much of the early research on computer security centered on a system called Management Information and Computing Service (MULTICS). _______ ANSWER: False - Multiplexed POINTS: 1 REFERENCES: p. 6 H1: Introduction to Information Security H2: The 1970s and ’80s QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/8/2021 10:46 AM 20. According to the CNSS, networking is “the protection of information and its critical elements.” _______ False - information security ANSWER: POINTS: 1 REFERENCES: p. 8 H1: What is Security? QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM 21. Indirect attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat. _______ ANSWER: True POINTS: 1 REFERENCES: p. 9 H1: What is Security? H2: Key Information Security Concepts QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 1 Introduction to Information Security DATE CREATED: DATE MODIFIED:

9/14/2016 10:29 AM 4/7/2021 6:36 PM

22. When unauthorized individuals or systems can view information, confidentiality is breached. _______ ANSWER: True POINTS: 1 REFERENCES: p. 11 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM 23. Confidentiality ensures that only those with the rights and privileges to access information are able to do so. _______ ANSWER: True POINTS: 1 REFERENCES: p. 11 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM 24. Information has redundancy when it is free from mistakes or errors and it has the value that the end user expects. _______ ANSWER: False - accuracy POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 1 Introduction to Information Security 25. Hardware is the physical technology that houses and executes the software, stores and transports the data, and provides interfaces for the entry and removal of information from the system. _______ ANSWER: True POINTS: 1 REFERENCES: p. 15 H1: Components of An Information System H2: Hardware QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM 26. A(n) hardware system is the entire set of people, procedures, and technology that enable business to use information. _______ False - information ANSWER: POINTS: 1 REFERENCES: p. 15 H1: Components of An Information System QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM 27. Information security can begin as a grassroots effort in which systems administrators attempt to improve the security of their systems, often referred to as the bottom-up approach. _______ ANSWER: True POINTS: 1 REFERENCES: p. 18 H1: Security and The Organization H2: Approaches to Information Security Implementation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 1 Introduction to Information Security 28. The role of the project manager—typically an executive such as a chief information officer (CIO) or the vice president of information technology (VP-IT)—in this effort cannot be overstated. _______ ANSWER: False - champion POINTS: 1 REFERENCES: p.18 H1: Security and The Organization H2: Approaches to Information Security Implementation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/8/2021 10:48 AM 29. Of the two approaches to information security implementation, the top-down approach has a higher probability of success. _______ ANSWER: True POINTS: 1 REFERENCES: p. 18 H1: Security and The Organization H2: Approaches to Information Security Implementation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM 30. A(n) project team should consist of a number of individuals who are experienced in one or multiple facets of the technical and nontechnical areas. _______ ANSWER: True POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Security Professionals QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:36 PM Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 1 Introduction to Information Security Multiple Choice 31. __________ is a network project that preceded the Internet. a. NIST b. ARPANET c. FIPS d. DES ANSWER: b POINTS: 1 REFERENCES: p. 3 H1: Introduction to Information Security H2: The 1960s QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 32. Which of the following was not an identified fundamental problem with ARPANET security? a. phone numbers for access were closely held and distributed on a need-to-know basis b. vulnerability of password structure and formats c. lack of safety procedures for dial-up connections d. nonexistent user identification and authorizations ANSWER: a POINTS: 1 REFERENCES: p. 4 H1: Introduction to Information Security H2: The 1970s and ’80s QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 4/6/2021 9:04 AM DATE MODIFIED: 4/6/2021 9:07 AM 33. The famous study entitled “Protection Analysis: Final Report” focused on a project undertaken by ARPA to understand and detect __________ in operating systems security. a. bugs b. vulnerabilities c. malware d. maintenance hooks ANSWER: b POINTS: 1 REFERENCES: p. 5 H1: Introduction to Information Security H2: The 1970s and ’80s QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 1 Introduction to Information Security HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/8/2017 5:05 PM 34. __________ was the first operating system to integrate security as one of its core functions. a. UNIX b. DOS c. MULTICS d. ARPANET ANSWER: c POINTS: 1 REFERENCES: p. 6 H1: Introduction to Information Security H2: The 1970s and ’80s QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/8/2017 5:05 PM 35. In 1993, the first ______ conference was held in Las Vegas. Originally, it was established as a gathering for people interested in information security, including authors, lawyers, government employees, and law enforcement officials. a. DEFCON b. CyberCom c. Black Hat d. World Security ANSWER: a POINTS: 1 REFERENCES: p. 7 H1: Introduction to Information Security H2: The 1990s QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 4/6/2021 9:10 AM DATE MODIFIED: 4/8/2021 10:49 AM 36. The protection of the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission, via the application of policy, education, training and awareness, and technology is known as ___________. a. communications security b. network security Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 1 Introduction to Information Security c. physical security d. information security ANSWER: POINTS: REFERENCES:

d 1 p. 8 H1: What Is Security? QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 12/5/2016 7:15 PM DATE MODIFIED: 12/5/2016 7:22 PM 37. A server would experience a(n) __________ attack when a hacker compromises it to acquire information via a remote location using a network connection. a. indirect b. direct c. software d. hardware ANSWER: b POINTS: 1 REFERENCES: p. 9 H1: What is Security? H2: Key Information Security Concepts QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 3/8/2017 5:07 PM 38. A subject or object’s ability to use, manipulate, modify, or affect another subject or object is known as ___________. a. access b. assets c. exploits d. risk ANSWER: a POINTS: 1 REFERENCES: p. 9 H1: What Is Security? H2: Key Information Security Concepts QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:18 PM DATE MODIFIED: 3/8/2017 5:14 PM Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 1 Introduction to Information Security 39. An organizational resource that is being protected is sometimes logical, such as a Web site, software information, or data. Sometimes the resource is physical, such as a person, computer system, hardware, or other tangible object. Either way, the resource is known as a(n) ___________. a. access method b. asset c. exploit d. risk ANSWER: b POINTS: 1 REFERENCES: p. 9 H1: What Is Security? H2: Key Information Security Concepts QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:22 PM DATE MODIFIED: 3/8/2017 5:16 PM 40. A computer is the __________ of an attack when it is used to conduct an attack against another computer. a. subject b. object c. target d. facilitator ANSWER: a POINTS: 1 REFERENCES: p. 10 H1: What is Security? H1: What is Security? H2: Key Information Security Concepts QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 41. A technique used to compromise a system is known as a(n) ___________. a. access method b. asset c. exploit d. risk ANSWER: c POINTS: 1 REFERENCES: p. 10 H1: What Is Security? H2: Key Information Security Concepts Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 1 Introduction to Information Security QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:22 PM DATE MODIFIED: 3/8/2017 5:16 PM 42. In file hashing, a file is read by a special algorithm that uses the value of the bits in the file to compute a single number called the __________ value. a. result b. smashing c. hash d. code ANSWER: c POINTS: 1 REFERENCES: p. 12 H1: What Is Security? H1: What Is Security? QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 9/14/2016 10:30 AM 43. __________ of information is the quality or state of being genuine or original. a. Authenticity b. Spoofing c. Confidentiality d. Authorization ANSWER: a POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 44. __________ has become a widely accepted evaluation standard for training and education related to the security of information systems and is hosted by CNSS. a. NIST SP 800-12 b. NSTISSI No. 4011 c. IEEE 802.11(g) d. ISO 17788 ANSWER: b POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 1 Introduction to Information Security REFERENCES:

p. 14 H1: What Is Security? H2: CNSS Security Model QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/8/2021 10:50 AM 45. __________ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse. a. Physical b. Personal c. Object d. Standard ANSWER: a POINTS: 1 REFERENCES: p. 15 H1: Components of An Information System H2: Hardware QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 12/5/2016 12:35 PM 46. An information system is the entire set of __________, people, procedures, and networks that enable the use of information resources in the organization. a. software b. hardware c. data d. All of the above ANSWER: d POINTS: 1 REFERENCES: p. 15 H1: Components of An Information System H2: Software QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 3/8/2017 5:07 PM 47. The protection of tangible items, objects, or areas from unauthorized access and misuse is known as ___________. a. communications security b. network security Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 1 Introduction to Information Security c. physical security d. information security ANSWER: POINTS: REFERENCES:

c 1 p. 15 H1: Components of An Information System H2: Hardware QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:16 PM DATE MODIFIED: 12/5/2016 7:21 PM 48. The ______ is the individual primarily responsible for the assessment, management, and implementation of information security in the organization. a. ISO b. CIO c. CISO d. CTO ANSWER: c POINTS: 1 REFERENCES: p. 19 H1: Security and The Organization H2: Security Professionals QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 49. Which of the following is a valid type of role when it comes to data ownership? a. Data owners b. Data custodians c. Data users d. All of the above ANSWER: d POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Data Responsibilities QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 9/14/2016 10:30 AM Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 1 Introduction to Information Security 50. People with the primary responsibility for administering the systems that house the information used by the organization perform the role of ____. a. Security policy developers b. Security professionals c. System administrators d. End users ANSWER: c POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Security Professionals QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 3/8/2017 5:14 PM 51. Individuals who control, and are therefore ultimately responsible for, the security and use of a particular set of information are known as data __________. a. owners b. custodians c. trustees d. users ANSWER: a POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Data Responsibilities QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 4/6/2021 9:16 AM DATE MODIFIED: 4/6/2021 9:18 AM 52. Individuals who are assigned the task of managing a particular set of information and coordinating its protection, storage, and use are known as data __________. a. owners b. custodians c. trustees d. users ANSWER: c POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 1 Introduction to Information Security REFERENCES:

p. 20 H1: Security and The Organization H2: Data Responsibilities QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 4/6/2021 9:20 AM DATE MODIFIED: 4/6/2021 9:20 AM 53. The community of interest made up of IT managers and skilled professionals in systems design, programming, networks, and other related disciplines is called ______. a. Information Technology Management and Professionals b. Organizational Management and Professionals c. Information Security Management and Professionals d. Executive Management ANSWER: a POINTS: 1 REFERENCES: p. 21 H1: Security and The Organization H2: Communities of Interest QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 4/6/2021 9:21 AM DATE MODIFIED: 4/8/2021 10:51 AM Completion 54. The history of information security begins with the concept of ________ security. computer ANSWER: POINTS: 1 REFERENCES: p. 3 H1: Introduction to Information Security QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 55. During the early years, information security was a straightforward process composed predominantly of ________ security and simple document classification schemes. physical ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 1 Introduction to Information Security POINTS: REFERENCES:

1 p. 3 H1: Introduction to Information Security QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 56. During the ________ War, many mainframes were brought online to accomplish more complex and sophisticated tasks, so it became necessary to enable the mainframes to communicate via a less cumbersome process than mailing magnetic tapes between computer centers. Cold ANSWER: POINTS: 1 REFERENCES: p. 3 H1: Introduction to Information Security H2: The 1960s QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 57. The Internet brought ________ to virtually all computers that could reach a phone line or an Internet-connected local area network. connectivity ANSWER: POINTS: 1 REFERENCES: p. 3 H1: Introduction to Information Security H2: The 1990s QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.2 - Discuss the history of computer security and explain how it evolved into Information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 58. The CNSS model of information security evolved from a concept developed by the computer security industry known as the ________ triad. CIA ANSWER: C.I.A. Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 1 Introduction to Information Security Confidentiality, Integrity, and Availability POINTS: 1 REFERENCES: p. 8 H1: What is Security? QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 59. A computer is the ________ of an attack when it is the entity being targeted. object ANSWER: POINTS: 1 REFERENCES: p. 10 H1: What is Security? H2: Key Information Security Concepts QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 60. The probability of an unwanted occurrence, such as an adverse event or loss, is known as a(n) _________. risk ANSWER: POINTS: 1 REFERENCES: p. 10 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:29 PM DATE MODIFIED: 4/5/2021 3:35 PM 61. Any event or circumstance that has the potential to adversely affect operations and assets is known as a(n) _________. threat ANSWER: POINTS: 1 REFERENCES: p. 10 H1: What is Security? Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 1 Introduction to Information Security H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:29 PM DATE MODIFIED: 12/5/2016 7:31 PM 62. In an organization, the value of ________ of information is especially high when it involves personal information about employees, customers, or patients. confidentiality ANSWER: POINTS: 1 REFERENCES: p. 11 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 63. A potential weakness in an asset or its defensive control system(s) is known as a(n) _________. vulnerability ANSWER: POINTS: 1 REFERENCES: p. 11 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 12/5/2016 7:28 PM DATE MODIFIED: 12/5/2016 7:34 PM 64. Information has ________ when it is whole, complete, and uncorrupted. integrity ANSWER: POINTS: 1 REFERENCES: p. 12 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 1 Introduction to Information Security HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 65. ________ enables authorized users—people or computer systems—to access information without interference or obstruction and to receive it in the required format. Availability ANSWER: POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 66. ________ of information is the quality or state of being genuine or original, rather than a reproduction or fabrication. Authenticity ANSWER: POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 67. The ________ of information is the quality or state of ownership or control of some object or item. possession ANSWER: POINTS: 1 REFERENCES: p. 13 H1: What is Security? H2: Critical Characteristics of Information QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 1 Introduction to Information Security LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 68. The ________ component of an information system comprises applications, operating systems, and assorted command utilities. software ANSWER: POINTS: 1 REFERENCES: p. 15 H1: Components of An Information System H2: Software QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 69. Software is often created under the constraints of ________ management, placing limits on time, cost, and manpower. project ANSWER: POINTS: 1 REFERENCES: p. 15 H1: Components of An Information System H2: Software QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 70. A frequently overlooked component of an information system, ________ are the written instructions for accomplishing a specific task. procedures ANSWER: POINTS: 1 REFERENCES: p. 16 H1: Components of An Information System H2: Procedures QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 1 Introduction to Information Security

DATE CREATED: DATE MODIFIED:

security 9/14/2016 10:30 AM 4/7/2021 6:36 PM

71. The senior technology officer is typically the chief ________ officer. information ANSWER: POINTS: 1 REFERENCES: p. 19 H1: Security and The Organization H2: Security Professionals QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM 72. A(n) ________ is a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives. community of interest ANSWER: POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Communities of Interest QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:36 PM Essay 73. Describe the multiple types of security systems present in many organizations. A successful organization should have multiple layers of security in place to protect its ANSWER: operations, including physical, networks, and information: Physical security, to protect physical items, objects, or areas from unauthorized access and misuse Network security, to protect networking components, connections, and contents Information security, to protect the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission. It is achieved via the application of policy, education, training and awareness, and technology. Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 1 Introduction to Information Security POINTS: REFERENCES:

1 p. 8 H1: What is Security? QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.1 - Define information security DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 4/5/2021 3:40 PM 74. Outline types of data ownership and their respective responsibilities. Data owners: Those responsible for the security and use of a particular set of information. ANSWER: They are usually members of senior management and could be CIOs. The data owners usually determine the level of data classification associated with the data, as well as the changes to that classification required by organizational change. Data custodians: Working directly with data owners, data custodians are responsible for the storage, maintenance, and protection of the information. The duties of a data custodian often include overseeing data storage and backups, implementing the specific procedures and policies laid out in the security policies and plans, and reporting to the data owner. Data users: End users who work with the information to perform their daily jobs supporting the mission of the organization. Data users are included as individuals with an information security role. POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Data Responsibilities QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 9/14/2016 10:30 AM Subjective Short Answer 75. What is the difference between a threat agent and a threat source? A threat agent is the facilitator of an attack, whereas a threat source is a category of ANSWER: objects, people, or other entities that represents a potential danger to an asset. Threats are always present. Some threats manifest themselves in accidental occurrences and others are purposeful. Fire is a threat; however, a fire that has begun in a building is an attack. If an arsonist set the fire, then the arsonist is the threat agent. If an accidental electrical short started the fire, the short is the threat agent. POINTS:

1

Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 1 Introduction to Information Security REFERENCES:

p. 11 H1: What is Security? H2: Key Information Security Concepts QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 4/6/2021 9:25 AM DATE MODIFIED: 4/6/2021 9:28 AM 76. Describe the need for balance between information security and access to information inherent in information systems. To achieve balance—that is, to operate an information system that satisfies the user and the ANSWER: security professional—the security level must allow reasonable access yet protect against threats. POINTS: 1 REFERENCES: p. 17 H1: Security and The Organization H2: Balancing Information Security and Access QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 4/6/2021 9:32 AM DATE MODIFIED: 4/6/2021 9:32 AM 77. Should the overall approach to security be more managerial or technical? The approach to security should be more managerial than technical, although the technical ANSWER: ability of the resources who perform day-to-day activities is critical. The top-down approach to security implementation is by far the best. It has strong upper management support, a dedicated champion, dedicated funding, clear planning, and the opportunity to influence organizational culture. POINTS: 1 REFERENCES: p. 18 H1: Security and The Organization H2: Approaches to Information Security Implementation QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.01.3 - Define key terms and critical concepts of information security DATE CREATED: 4/6/2021 9:35 AM DATE MODIFIED: 4/6/2021 9:36 AM 78. Describe the role of a data trustee. Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 1 Introduction to Information Security ANSWER:

Data trustees are individuals appointed by data owners to oversee the management of a particular set of information and to coordinate with data custodians for its storage, protection, and use. Because data owners are typically top-level executives and managers too busy to oversee the management of their data, they will typically appoint a senior subordinate as a data trustee to handle those responsibilities. POINTS: 1 REFERENCES: p. 20 H1: Security and The Organization H2: Data Responsibilities QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.01.4 - Name the individuals who had a great impact on the profession of dentistry. DATE CREATED: 4/6/2021 9:39 AM DATE MODIFIED: 4/6/2021 9:40 AM

Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 2 The Need for Information Security True / False 1. Media are items of fact collected by an organization and include raw numbers, facts, and words. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction p. 28 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 12/28/2016 9:32 AM DATE MODIFIED: 3/8/2017 5:28 PM 2. Information security’s primary mission is to ensure that systems and their contents retain their confidentiality at any cost. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction p. 28 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 3. Media as a subset of information assets are the systems and networks that store, process, and transmit information. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 28 H1: Introduction QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 12/28/2016 9:34 AM DATE MODIFIED: 12/28/2016 9:35 AM 4. The information security function in an organization safeguards its technology assets. a. True Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 2 The Need for Information Security b. False ANSWER: POINTS: REFERENCES:

True 1 p. 28 H1: Introduction QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:25 PM 5. As an organization grows, it must often use more robust technology to replace the security technologies it may have outgrown. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 28 H1: Introduction H2: Business Needs First QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:25 PM 6. Two watchdog organizations that investigate allegations of software abuse are the Software & Information Industry Association (SIIA) and National Security Agency (NSA). a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The 12 Categories of Threats H2: Compromises to Intellectual Property p. 35 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:26 PM 7. A number of technical mechanisms—digital watermarks and embedded code, copyright codes, and even the intentional placement of bad sectors on software media—have been used to deter or prevent the theft of software intellectual property. Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 2 The Need for Information Security a. True b. False ANSWER: POINTS: REFERENCES:

True 1 p. 35 H1: The 12 Categories of Threats H2: Compromises to Intellectual Property QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 8. Expert hackers are extremely talented individuals who usually devote lots of time and energy to attempting to break into other people’s information systems. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: The 12 Categories of Threats H2: Espionage or Trespass p. 39 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 9. Attacks conducted by scripts are usually unpredictable. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 42 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 2 The Need for Information Security 10. With the removal of copyright protection mechanisms, software can be easily and illegally distributed

and installed.

a. True b. False ANSWER: POINTS: REFERENCES:

True 1 H1: The 12 Categories of Threats H2: Espionage or Trespass p. 45 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/26/2021 6:41 PM 11. Organizations can use dictionaries to regulate password selection during the reset process and thus guard against easyto-guess passwords. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 46 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 12. Forces of nature, sometimes called acts of God, can present some of the most dangerous threats because they usually occur with very little warning and are beyond the control of people. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 47 H1: The 12 Categories of Threats H2: Forces of Nature QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 2 The Need for Information Security DATE CREATED: DATE MODIFIED:

9/14/2016 10:31 AM 3/8/2017 5:27 PM

13. Much human error or failure can be prevented with effective training and ongoing awareness activities. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 50 H1: The 12 Categories of Threats H2: Human Error or Failure QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 14. An advance-fee fraud attack involves the interception of cryptographic elements to determine keys and encryption algorithms. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 51 H1: The 12 Categories of Threats H2: Human Error or Failure QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 15. Compared to Web site defacement, vandalism within a network is less malicious in intent and more public. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 56 H1: The 12 Categories of Threats H2: Sabotage or Vandalism QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 2 The Need for Information Security LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 16. Suppose an act of theft performed by a hacker was accompanied by defacement actions to delay discovery. The first act is obviously in the category of “theft” but the second act is another category—in this case it is a “force of nature.” a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The 12 Categories of Threats H2: Sabotage or Vandalism p. 56 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.2 - Explain why a successful information security program is the shared responsibility of the entire organization DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:26 PM 17. A worm requires that another program is running before it can begin functioning. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The 12 Categories of Threats H2: Software Attacks p. 60 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 18. A worm may be able to deposit copies of itself onto all Web servers that the infected system can reach, so that users who subsequently visit those sites become infected. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 62 H1: The 12 Categories of Threats H2: Software Attacks Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 2 The Need for Information Security QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 19. DoS attacks cannot be launched against routers. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 63 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 20. An e-mail bomb is a form of DoS attack. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 64 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/5/2021 7:35 PM 21. A sniffer program can reveal data transmitted on a network segment, including passwords, the embedded and attached files—such as word-processing documents—and sensitive data transmitted to or from applications. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 65 Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 2 The Need for Information Security H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/9/2017 9:40 AM 22. When electronic information is stolen, the crime is readily apparent. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 73 H1: The 12 Categories of Threats H2: Theft QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:27 PM Modified True / False 23. Media assets are the focus of information security and are the information that has value to the organization, as well as the systems that store, process, and transmit the information. ______ ANSWER: False - Information POINTS: 1 REFERENCES: p. 28 H1: Introduction to Information Security QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 12/28/2016 9:35 AM DATE MODIFIED: 4/26/2021 6:41 PM 24. Intellectual property is defined as “the creation, ownership, and control of ideas as well as the representation of those ideas.” ______ ANSWER: True POINTS: 1 REFERENCES: p. 34 H1: The 12 Categories of Threats Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 2 The Need for Information Security H2: Compromises to Intellectual Property QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 25. When voltage levels lag (experience a momentary increase), the extra voltage can severely damage or destroy equipment. ______ ANSWER: False - spike POINTS: 1 REFERENCES: p. 39 H1: The 12 Categories of Threats H2: Deviations in Quality of Service QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 26. Hackers are “persons who access systems and information without authorization and often illegally.” ______ ANSWER: True POINTS: 1 REFERENCES: H1: The 12 Categories of Threats H2: Compromises to Intellectual Property p. 40 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 27. "Shoulder spying" is used in public or semi-public settings when individuals gather information they are not authorized to have by looking over another individual’s shoulder or viewing the information from a distance. ______ False - surfing ANSWER: POINTS: 1 REFERENCES: p. 40 H1: The 12 Categories of Threats H2: Compromises to Intellectual Property Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 2 The Need for Information Security QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 28. Packet munchkins use automated exploits to engage in distributed denial-of-service attacks. ______ ANSWER: False - monkeys POINTS: 1 REFERENCES: p. 42 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 29. The term phreaker is now commonly associated with an individual who cracks or removes software protection that is designed to prevent unauthorized duplication. ______ ANSWER: False - cracker POINTS: 1 REFERENCES: p. 45 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 30. The application of computing and network resources to try every possible combination of options of a password is called a dictionary attack. ______ False - brute force ANSWER: POINTS: 1 REFERENCES: p. 45 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Modified True / False Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 2 The Need for Information Security HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 31. Cyberterrorists hack systems to conduct terrorist activities via network or Internet pathways. ______ ANSWER: True POINTS: 1 REFERENCES: p. 57 H1: The 12 Categories of Threats H2: Sabotage or Vandalism QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 32. The malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information. ______ ANSWER: True POINTS: 1 REFERENCES: p. 58 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 33. Software code known as a(n) cookie can allow an attacker to track a victim's activity on Web sites. ______ ANSWER: True POINTS: 1 REFERENCES: p. 59 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 2 The Need for Information Security LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 34. The macro virus infects the key operating system files located in a computer’s start-up sector. ______ ANSWER: False - boot POINTS: 1 REFERENCES: p. 60 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 35. A(n) polymorphic threat is one that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures. ______ ANSWER: True POINTS: 1 REFERENCES: p. 62 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 36. Once a(n) back door has infected a computer, it can redistribute itself to all e-mail addresses found on the infected system. ______ ANSWER: False - virus False - worm POINTS: 1 REFERENCES: p. 63 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 2 The Need for Information Security LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 37. One form of e-mail attack that is also a DoS attack is called a mail spoof, in which an attacker overwhelms the receiver with excessive quantities of e-mail. ______ False - bomb ANSWER: POINTS: 1 REFERENCES: p. 64 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 38. A device (or a software program on a computer) that can monitor data traveling on a network is known as a socket sniffer. ______ False - packet ANSWER: POINTS: 1 REFERENCES: p. 65 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM Multiple Choice 39. Which of the following functions does information security perform for an organization? a. Protecting the organization’s ability to function. b. Enabling the safe operation of applications implemented on the organization’s IT systems. c. Protecting the data the organization collects and uses. d. All of the above. ANSWER: d POINTS: 1 REFERENCES: p. 28 Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 2 The Need for Information Security H1: Introduction to Information Security QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.1 - Discuss the need for information security DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 40. The process of maintaining the confidentiality, integrity, and availability of data managed by a DBMS is known as ______ security. a. database b. data c. information d. residual ANSWER: a POINTS: 1 REFERENCES: H1: Introduction to Information Security H2: Business Needs First p. 29 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.2 - Explain why a successful information security program is the shared responsibility of the entire organization DATE CREATED: 12/28/2016 9:39 AM DATE MODIFIED: 4/7/2021 6:34 PM 41. Web hosting services are usually arranged with an agreement defining minimum service levels known as a(n) ____. a. SSL b. SLA c. MSL d. MIN ANSWER: b POINTS: 1 REFERENCES: p. 37 H1: The 12 Categories of Threats H2: Deviations in Quality of Service QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 42. A short-term interruption in electrical power availability is known as a ____. a. fault b. brownout c. blackout d. lag ANSWER: a Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 2 The Need for Information Security POINTS: REFERENCES:

1 p. 39 H1: The 12 Categories of Threats H2: Deviations in Quality of Service QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 43. When information gatherers employ techniques that cross a legal or ethical threshold, they are conducting ______. a. industrial espionage b. competitive intelligence c. opposition research d. hostile investigation ANSWER: a POINTS: 1 REFERENCES: p. 39 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/15/2016 12:27 PM DATE MODIFIED: 4/7/2021 6:34 PM 44. A long-term interruption (outage) in electrical power availability is known as a(n) ______. a. blackout b. sag c. brownout d. fault ANSWER: a POINTS: 1 REFERENCES: p. 39 H1: The 12 Categories of Threats H2: Deviations in Quality of Service QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 9:44 AM DATE MODIFIED: 4/7/2021 6:34 PM Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 2 The Need for Information Security 45. Hackers can be generalized into two skill groups: expert and ______. a. novice b. journeyman c. packet monkey d. professional ANSWER: a POINTS: 1 REFERENCES: p. 40 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 46. Acts of ______ can lead to unauthorized real or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter. a. bypass b. theft c. trespass d. security ANSWER: c POINTS: 1 REFERENCES: p. 40 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 47. The ______ data file contains the hashed representation of the user’s password. a. SLA b. SNMP c. FBI d. SAM ANSWER: d POINTS: 1 REFERENCES: p. 46 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 2 The Need for Information Security DATE MODIFIED:

4/7/2021 6:34 PM

48. A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system’s encrypted password file is known as a(n) ______. a. rainbow table b. dictionary c. crib d. crack file ANSWER: a POINTS: 1 REFERENCES: p. 46 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 10:21 AM DATE MODIFIED: 4/7/2021 6:34 PM 49. Human error or failure often can be prevented with training, ongoing awareness activities, and ______. a. threats b. controls c. hugs d. paperwork ANSWER: b POINTS: 1 REFERENCES: p. 50 H1: The 12 Categories of Threats H2: Human Error or Failure QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 7:05 PM 50. Advance-Fee fraud is an example of a ______ attack. a. social engineering b. virus c. worm d. spam ANSWER: a POINTS: 1 REFERENCES: p. 51 H1: The 12 Categories of Threats H2: Human Error or Failure QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 2 The Need for Information Security HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/26/2021 6:42 PM 51. One form of online vandalism is ______ operations, which interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency. a. hacktivist b. phreak c. hackcyber d. cyberhack ANSWER: a POINTS: 1 REFERENCES: p. 56 H1: The 12 Categories of Threats H2: Sabotage or Vandalism QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 52. ______ is the premeditated, politically motivated attacks against information, computer systems, computer programs, and data that result in violence against noncombatant targets by subnational groups or clandestine agents. a. infoterrorism b. cyberterrorism c. hacking d. cracking ANSWER: b POINTS: 1 REFERENCES: p. 57 H1: The 12 Categories of Threats H2: Sabotage or Vandalism QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 53. ____ is any technology that aids in gathering information about a person or organization without their knowledge. a. A bot b. Spyware c. A Trojan d. A worm ANSWER: b POINTS: 1 REFERENCES: p. 59 H1: The 12 Categories of Threats Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 2 The Need for Information Security H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:29 PM 54. ______ are malware programs that hide their true nature and reveal their designed behavior only when activated. a. Viruses b. Worms c. Spam d. Trojan horses ANSWER: d POINTS: 1 REFERENCES: p. 62 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 55. Which of the following is an example of a Trojan horse program? a. Netsky b. MyDoom c. Klez d. Happy99.exe ANSWER: d POINTS: 1 REFERENCES: p. 62 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 9/14/2016 10:31 AM 56. As frustrating as viruses and worms are, perhaps more time and money is spent on resolving virus ______. a. false alarms b. polymorphisms c. hoaxes d. urban legends ANSWER: c POINTS: 1 REFERENCES: p. 63 Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 2 The Need for Information Security H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 57. In a ______ attack, the attacker sends a large number of connection or information requests to disrupt a target from a small number of sources. a. denial-of-service b. distributed denial-of-service c. virus d. spam ANSWER: a POINTS: 1 REFERENCES: p. 63 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 58. A ______ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time. a. denial-of-service b. distributed denial-of-service c. virus d. spam ANSWER: b POINTS: 1 REFERENCES: p. 63 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 59. ______ are compromised systems that are directed remotely (usually by a transmitted command) by the attacker to participate in an attack. a. Drones b. Helpers c. Zombies d. Servants Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 2 The Need for Information Security ANSWER: POINTS: REFERENCES:

c 1 p. 63 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 60. In the ______ attack, an attacker monitors (or sniffs) packets from the network, modifies them, and inserts them back into the network. a. zombie-in-the-middle b. sniff-in-the-middle c. server-in-the-middle d. man-in-the-middle ANSWER: d POINTS: 1 REFERENCES: p. 66 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 61. The ______ hijacking attack uses IP spoofing to enable an attacker to impersonate another entity on the network. a. WWW b. TCP c. FTP d. HTTP ANSWER: b POINTS: 1 REFERENCES: p. 66 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 62. The redirection of legitimate user Web traffic to illegitimate Web sites with the intent to collect personal information is known as ______. Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 2 The Need for Information Security a. pharming b. phishing c. sniffing d. spoofing ANSWER: POINTS: REFERENCES:

a 1 p. 66 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 10:24 AM DATE MODIFIED: 4/7/2021 6:34 PM 63. The average amount of time between hardware failures, calculated as the total amount of operation time for a specified number of units divided by the total number of failures, is known as ______. a. mean time between failure (MTBF) b. mean time to diagnose (MTTD) c. mean time to failure (MTTF) d. mean time to repair (MTTR) ANSWER: a POINTS: 1 REFERENCES: p. 67 H1: The 12 Categories of Threats H2: Technical Hardware Failures or Errors QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 10:27 AM DATE MODIFIED: 4/7/2021 6:34 PM 64. The average amount of time until the next hardware failure is known as ______. a. mean time between failure (MTBF) b. mean time to diagnose (MTTD) c. mean time to failure (MTTF) d. mean time to repair (MTTR) ANSWER: c POINTS: 1 REFERENCES: p. 67 H1: The 12 Categories of Threats H2: Technical Hardware Failures or Errors Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 2 The Need for Information Security QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 10:29 AM DATE MODIFIED: 4/7/2021 6:34 PM 65. Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL) longer than ______ characters in Internet Explorer 4.0, the browser will crash. a. 64 b. 128 c. 256 d. 512 ANSWER: c POINTS: 1 REFERENCES: p. 69 H1: The 12 Categories of Threats H2: Technical Software Failures or Errors QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM Completion 66. A(n) ______ is a potential risk to an information asset. threat ANSWER: POINTS: 1 REFERENCES: H1: Information Security Threats And Attacks p. 30 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 67. A(n) ______ is an act against an asset that could result in a loss. attack ANSWER: POINTS: 1 REFERENCES: p. 30 H1: Information Security Threats And Attacks Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 2 The Need for Information Security QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 68. Duplication of software-based intellectual property is more commonly known as software ______. piracy ANSWER: POINTS: 1 REFERENCES: p. 34 H1: The 12 Categories of Threats H2: Compromises to Intellectual Property QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 69. ______ is the percentage of time a particular service is available. uptime ANSWER: up-time up time POINTS: 1 REFERENCES: p. 38 H1: The 12 Categories of Threats H2: Deviations in Quality of Service QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 9:42 AM DATE MODIFIED: 4/7/2021 6:34 PM 70. A momentary low voltage is called a(n) ______. sag ANSWER: POINTS: 1 REFERENCES: p. 39 H1: The 12 Categories of Threats H2: Compromises to Intellectual Property QUESTION TYPE: Completion Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 2 The Need for Information Security HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/8/2021 11:39 AM 71. Some information gathering techniques are quite legal—for example, using a Web browser to perform market research. These legal techniques are called, collectively, competitive ______. intelligence ANSWER: POINTS: 1 REFERENCES: p. 39 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 72. When information gatherers employ techniques in a commercial setting that cross the threshold of what is legal or ethical, they are conducting industrial ______. espionage ANSWER: POINTS: 1 REFERENCES: p. 39 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 73. The expert hacker sometimes is called a(n) ______ hacker. elite ANSWER: POINTS: 1 REFERENCES: p. 40 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Completion HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 2 The Need for Information Security STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 74. Script ______ are hackers of limited skill who use expertly written software to attack a system. kiddies ANSWER: POINTS: 1 REFERENCES: p. 42 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 75. A(n) ______ hacks the public telephone network to make free calls or disrupt services. phreaker ANSWER: POINTS: 1 REFERENCES: p. 45 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 76. Attempting to reverse-calculate a password is called ______. cracking ANSWER: POINTS: 1 REFERENCES: p. 45 H1: The 12 Categories of Threats H2: Espionage or Trespass QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 2 The Need for Information Security DATE CREATED: DATE MODIFIED:

9/14/2016 10:31 AM 4/7/2021 6:34 PM

77. In the context of information security, ESD is the acronym for ______ discharge. electrostatic ANSWER: POINTS: 1 REFERENCES: p. 49 H1: The 12 Categories of Threats H2: Forces of Nature QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/8/2021 11:46 AM 78. In the context of information security, ______ is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker. social engineering ANSWER: POINTS: 1 REFERENCES: p. 50 H1: The 12 Categories of Threats H2: Human Error or Failure QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/8/2021 11:46 AM 79. The ______ fraud is a social engineering attack that involves convincing the victim to participate in a seeming moneymaking venture while getting the victim to pay fees or bribes or to refund uncleared international payments. advance-fee ANSWER: advance fee POINTS: 1 REFERENCES: p. 51 H1: The 12 Categories of Threats H2: Human Error or Failure QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 2 The Need for Information Security DATE CREATED: DATE MODIFIED:

9/14/2016 10:31 AM 4/7/2021 6:34 PM

80. A computer virus consists of segments of code that perform ______ actions. malicious ANSWER: POINTS: 1 REFERENCES: p. 59 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 81. A(n) ______ is a malicious program that replicates itself constantly without requiring another program environment. worm ANSWER: POINTS: 1 REFERENCES: p. 60 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 82. A virus or worm can have a payload that installs a(n) ______ door or trap door component in a system, which allows the attacker to access the system at will with special privileges. back ANSWER: POINTS: 1 REFERENCES: p. 63 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 2 The Need for Information Security 83. ______ is unsolicited commercial e-mail. Spam ANSWER: POINTS: 1 REFERENCES: p. 64 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 84. ______ is a technique used to gain unauthorized access to computers, wherein the intruder sends messages with a source IP address that has been forged to indicate that the messages are coming from a trusted host. Spoofing ANSWER: POINTS: 1 REFERENCES: p. 65 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM 85. ______ occurs when an application running on a Web server inserts commands into a user’s browser session and causes information to be sent to a hostile server. cross-site scripting (XSS) ANSWER: cross-site scripting XSS cross site scripting (XSS) cross site scripting POINTS: REFERENCES:

1 p. 68 H1: The 12 Categories of Threats H2: Technical Software Failures or Errors QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 2 The Need for Information Security LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 12/28/2016 10:30 AM DATE MODIFIED: 4/7/2021 6:34 PM 86. A(n) ______ is an application error that occurs when more data is sent to a program than it is designed to handle. buffer overrun ANSWER: buffer overflow POINTS: 1 REFERENCES: p. 69 H1: The 12 Categories of Threats H2: Technical Software Failures or Errors QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 4/7/2021 6:34 PM Essay 87. There are 12 general categories of threat to an organization's people, information, and systems. List at least six of the general categories of threat and identify at least one example of those listed. Compromises to intellectual property ANSWER: Software attacks Deviations in quality of service Espionage or trespass Forces of nature Human error or failure Information extortion Sabotage or vandalism Theft Technical hardware failures or errors Technical software failures or errors Technological obsolescence POINTS: 1 REFERENCES: p. 34 H1: The 12 Categories of Threats QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:38 PM Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 2 The Need for Information Security 88. Describe viruses and worms. A computer virus consists of segments of code that perform malicious actions. This code ANSWER: behaves very much like a virus pathogen attacking animals and plants, using the cell’s own replication machinery to propagate and attack. The code attaches itself to the existing program and takes control of that program’s access to the targeted computer. The viruscontrolled target program then carries out the virus’s plan by replicating itself into additional targeted systems. A worm is a malicious program that replicates itself constantly without requiring another program to provide a safe environment for replication. Worms can continue replicating themselves until they completely fill available resources, such as memory, hard drive space, and network bandwidth. POINTS: 1 REFERENCES: p. 59 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:38 PM 89. Describe the capabilities of a sniffer. A sniffer is a program or device that can monitor data traveling over a network. Sniffers ANSWER: can be used both for legitimate network management functions and for stealing information from a network. Unauthorized sniffers can be extremely dangerous to a network’s security because they are virtually impossible to detect and can be inserted almost anywhere. This makes them a favorite weapon in the hacker’s arsenal. Sniffers often work on TCP/IP networks, where they’re sometimes called packet sniffers. Sniffers add risk to the network because many systems and users send information on local networks in clear text. A sniffer program shows all the data going by, including passwords, the data inside files, and screens full of sensitive data from applications. POINTS: 1 REFERENCES: p. 65 H1: The 12 Categories of Threats H2: Software Attacks QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 9/14/2016 10:31 AM DATE MODIFIED: 3/8/2017 5:39 PM Subjective Short Answer Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 2 The Need for Information Security 90. Why is information security a management problem? What can management do that technology cannot? General management, IT management, and information security management are each ANSWER: responsible for implementing information security that protects the organization’s ability to function. Although many business and government managers shy away from addressing information security because they perceive it to be a technically complex task, implementing information security actually has more to do with management than technology. Just as managing payroll involves management more than mathematical wage computations, managing information security has more to do with policy and its enforcement than the technology of its implementation. POINTS: REFERENCES:

1 p. 29 H1: Introduction To The Need For Information Security H2: Business Needs First QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.2 - Explain why a successful information security program is the shared responsibility of the entire organization DATE CREATED: 4/8/2021 12:11 PM DATE MODIFIED: 4/8/2021 12:12 PM 91. What is information extortion? Describe how such an attack can cause losses. When an attacker can control access to an asset, it can be held hostage to the attacker’s demands. For example, if attackers gain access to a database and then encrypt its data, they may extort money or other value from the owner by threatening to share the encryption key and the data with others. POINTS: 1 REFERENCES: p. 54 H1: The 12 Categories of Threats H2: Information Extortion QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.3 - List and describe the threats posed to information security and common attacks associated with those threats DATE CREATED: 4/8/2021 12:17 PM DATE MODIFIED: 4/8/2021 12:18 PM ANSWER:

92. What is a SQL Injection? SQL injection occurs when developers fail to properly validate user input before using it to ANSWER: query a relational database allowing an attacker to gain unauthorized access to data. POINTS: 1 REFERENCES: H1: The 12 Categories of Threats H2: Technical Software Failures or Errors Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 2 The Need for Information Security p. 68 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.02.4 - List the common information security issues that result from poor software development efforts DATE CREATED: 4/8/2021 12:21 PM DATE MODIFIED: 4/8/2021 12:23 PM

Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 3 Information Security Management True / False 1. A standard is a written instruction provided by management that informs employees and others in the workplace about proper behavior. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Information Security Policy, Standards, And Practices H2: Policy as the Foundation for Planning p. 88 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 3/8/2017 6:27 PM 2. Good security programs begin and end with policy. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 88 H1: Information Security Policy, Standards, And Practices QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 9/14/2016 10:37 AM 3. The ISSP is a plan which sets out the requirements that must be met by the information security blueprint or framework. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 91 H1: Information Security Policy, Standards, And Practices H2: Issue-Specific Security Policy QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 3 Information Security Management LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 12/28/2016 3:23 PM 4. You can create a single, comprehensive ISSP document covering all information security issues. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 92 H1: Information Security Policy, Standards, And Practices H2: Issue-Specific Security Policy QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 3/8/2017 6:28 PM 5. Each policy should contain procedures and a timetable for periodic review. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 94 H1: Information Security Policy, Standards, And Practices H2: Issue-Specific Security Policy QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 9/14/2016 10:37 AM 6. A policy should state that if employees violate a company policy or any law using company technologies, the company will protect them, and the company will provide for the employee's legal defense. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 94 Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 3 Information Security Management H1: Information Security Policy, Standards, And Practices H2: Issue-Specific Security Policy QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 4/27/2021 7:31 PM 7. A managerial guidance SysSP document is created by the IT experts in a company to guide management in the implementation and configuration of technology. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 95 H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:37 AM DATE MODIFIED: 9/14/2016 10:37 AM 8. ACLs are more specific to the operation of a system than rule-based policies and they may or may not deal with users directly. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 97 H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 9. To remain viable, security policies must have a responsible individual, a schedule of reviews, a method for making Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 3 Information Security Management recommendations for reviews, and policy issuance and planned revision dates. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Information Security Policy, Standards, And Practices H2: Policy Management p. 103 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:28 PM 10. The policy administrator is responsible for the creation, revision, distribution, and storage of the policy. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Information Security Policy, Standards, And Practices H2: Policy Management p. 103 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 11. Every member of the organization's InfoSec department must have a formal degree or certification in information security. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Security Education, Training, And Awareness Program H2: Security Education p. 105 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 3 Information Security Management

DATE CREATED: DATE MODIFIED:

implementing security policy in the organization 9/14/2016 10:38 AM 9/14/2016 10:38 AM

12. Security training provides detailed information and hands-on instruction to employees to prepare them to perform their duties securely. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Security Education, Training, And Awareness Program H2: Security Training p. 106 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 13. The security framework is a more detailed version of the security blueprint. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 14. The complete details of ISO/IEC 27002 are widely available to everyone. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks H2: The ISO 27000 Series QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 3 Information Security Management LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 12/28/2016 3:52 PM 15. The ISO/IEC 27000 series is derived from an earlier standard, BS7799. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks H2: The ISO 27000 Series QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 12/28/2016 3:49 PM 16. The global information security community has universally agreed with the justification for the code of practices as identified in the ISO/IEC 17799. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 108 H1: Information Security Blueprint, Models, and Frameworks H2: The ISO 27000 Series QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 17. Failure to develop an information security system based on the organization’s mission, vision, and culture guarantees the failure of the information security program. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 110 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 3 Information Security Management LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 18. NIST 800-14's Principles for Securing Information Technology Systems can be used to make sure the needed key elements of a successful effort are factored into the design of an information security program and to produce a blueprint for an effective security architecture. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 110 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:28 PM 19. NIST Special Publication 800-18 Rev. 1, The Guide for Developing Security Plans for Federal Information Systems, includes templates for major application security plans, and provides detailed methods for assessing, designing, and implementing controls and plans for applications of varying size. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 111 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 20. In 2016, NIST published a new Federal Master Cybersecurity Framework to create a mandatory framework for managing cybersecurity risk for the delivery of critical infrastructure services at every organization in the United States, based on vendor-specific technologies. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 111 H1: Information Security Blueprint, Models, and Frameworks Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 3 Information Security Management H2: NIST Security Models QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:29 PM 21. Managerial controls set the direction and scope of the security process and provide detailed instructions for its conduct. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:29 PM 22. To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 115 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM Modified True / False 23. The operational plan documents the organization’s intended long-term direction and efforts for the next several years. _____ ANSWER: False - strategic POINTS: 1 REFERENCES: p. 84 H1: Information Security Planning And Governance Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 3 Information Security Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 24. Guidelines are detailed statements of what must be done to comply with policy. _____ ANSWER: False - Standards POINTS: 1 REFERENCES: p. 88 H1: Information Security Policy, Standards, And Practices H2: Policy as the Foundation for Planning QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 25. A(n) strategic information security policy is also known as a general security policy, and sets the strategic direction, scope, and tone for all security efforts. _____ ANSWER: False - enterprise POINTS: 1 REFERENCES: p. 91 H1: Information Security Policy, Standards, And Practices H2: Enterprise Information Security Policy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:32 PM 26. Systems-specific security policies are organizational policies that provide detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies. _____ ANSWER: False - Issue POINTS: 1 REFERENCES: p. 91 H1: Information Security Policy, Standards, And Practices Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 3 Information Security Management H2: Issue-Specific Security Policy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 27. A security policy should begin with a clear statement of purpose. _____ ANSWER: True POINTS: 1 REFERENCES: p. 94 H1: Information Security Policy, Standards, And Practices H2: Issue-Specific Security Policy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 28. A(n) capability table specifies which subjects and objects users or groups can access. _____ ANSWER: True POINTS: 1 REFERENCES: p. 95 H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 29. To remain viable, security policies must have a responsible manager, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and revision date. _____ ANSWER: True POINTS: 1 REFERENCES: p. 103 Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 3 Information Security Management H1: Information Security Policy, Standards, And Practices H2: Policy Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:32 PM 30. Some policies may also need a(n) sunset clause indicating their expiration date. _____ ANSWER: True POINTS: 1 REFERENCES: p. 104 H1: Information Security Policy, Standards, And Practices H2: Policy Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 31. The Computer Security Resource Center at NIST provides several useful documents free of charge in its special publications area. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Security Education, Training, And Awareness Program H2: Security Training p. 106 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:33 PM 32. The security model is the basis for the design, selection, and implementation of all security program elements, including policy implementation and ongoing policy and program management. _____ ANSWER: False - blueprint Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 3 Information Security Management POINTS: REFERENCES:

1 p. 107 H1: Information Security Blueprint, Models, and Frameworks QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 33. The stated purpose of ISO/IEC 27002 is to offer guidelines and voluntary directions for information security management. _____ ANSWER: True POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks H2: The ISO 27000 Series QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 34. NIST responded to a mandate and created a voluntary Risk Management Framework that provides an effective approach to manage cybersecurity risks. _____ ANSWER: True POINTS: 1 REFERENCES: p. 111 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:34 PM 35. Technical controls are the tactical and technical implementations of security in the organization. _____ ANSWER: True POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 3 Information Security Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 36. One of the basic tenets of security architectures is the layered implementation of security, which is called defense in redundancy. _____ ANSWER: False - depth POINTS: 1 REFERENCES: p. 115 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 37. Within security perimeters the organization can establish security redundancies, each with differing levels of security, between which traffic must be screened. _____ ANSWER: False - domains POINTS: 1 REFERENCES: p. 116 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 38. The key components of the security perimeter include firewalls, DMZs (demilitarized zones), Web servers, and IDPSs. _____ ANSWER: False - proxy POINTS: 1 REFERENCES: p. 116 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 3 Information Security Management STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM Multiple Choice 39. Which of these is NOT a unique function of information security management? a. hardware b. planning c. policy d. programs ANSWER: a POINTS: 1 REFERENCES: H1: Introduction To The Management Of Information Security P. 82 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.1 - Describe the different management functions with respect to information security DATE CREATED: 4/21/2021 5:54 PM DATE MODIFIED: 4/27/2021 7:35 PM 40. Which of these is not one of the general categories of security policy? a. Category-specific policy (CSP) b. Enterprise information security policy (EISP) c. Issue-specific security policy (ISSP) d. Systems-specific policy (SysSP) ANSWER: a POINTS: 1 REFERENCES: p. 83 H1: Introduction To The Management Of Information Security H2: Policy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.1 - Describe the different management functions with respect to information security DATE CREATED: 4/25/2021 1:14 PM DATE MODIFIED: 4/25/2021 1:17 PM 41. A(n) _____ plan is a plan for the organization’s intended efforts over the next several years (long-term). a. standard b. operational c. tactical d. strategic ANSWER: d POINTS: 1 REFERENCES: H1: Information Security Planning And Governance Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 3 Information Security Management p. 84 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:36 PM 42. Which of these best defines information security governance? a. The application of the principles and practices of corporate governance to the information security function. b. The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction. c. Executive management’s responsibility to provide strategic direction, ensure the accomplishment of objectives. d. The process of defining and specifying the long-term direction (strategy) to be taken by an organization. ANSWER: a POINTS: 1 REFERENCES: p. 84 H1: Information Security Planning And Governance H2: Information Security Leadership QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 4/25/2021 1:20 PM DATE MODIFIED: 4/25/2021 1:22 PM 43. The goals of information security governance include all but which of the following? a. Regulatory compliance by using information security knowledge and infrastructure to support minimum standards of due care b. Strategic alignment of information security with business strategy to support organizational objectives c. Risk management by executing appropriate measures to manage and mitigate threats to information resources d. Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved ANSWER: a POINTS: 1 REFERENCES: p. 84 H1: Information Security Planning And Governance H2: Information Security Leadership QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 9/14/2016 10:38 AM Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 3 Information Security Management DATE MODIFIED:

9/14/2016 10:38 AM

44. The actions taken by management to specify the short-term goals and objectives of the organization are _____. a. operational planning b. tactical planning c. strategic planning d. contingency planning ANSWER: a POINTS: 1 REFERENCES: p. 87 H1: Information Security Planning And Governance H2: Planning Levels QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 4/25/2021 1:28 PM DATE MODIFIED: 4/27/2021 7:37 PM 45. The actions taken by management to specify the intermediate goals and objectives of the organization are _____. a. operational planning b. tactical planning c. strategic planning d. contingency planning ANSWER: b POINTS: 1 REFERENCES: p. 87 H1: Information Security Planning And Governance H2: Planning Levels QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 4/25/2021 1:25 PM DATE MODIFIED: 4/27/2021 7:37 PM 46. A detailed statement of what must be done to comply with management intent is known as a _____. a. guideline b. standard c. procedure d. practice ANSWER: b POINTS: 1 REFERENCES: p. 88 H1: Information Security Policy, Standards, And Practices H2: Policy as the Foundation for Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 3 Information Security Management DATE CREATED: DATE MODIFIED:

4/25/2021 1:34 PM 4/27/2021 7:37 PM

47. Standards may be published, scrutinized, and ratified by a group, as in formal or _____ standards. a. de formale b. de public c. de jure d. de facto ANSWER: c POINTS: 1 REFERENCES: p. 88 H1: Information Security Policy, Standards, And Practices H2: Policy as the Foundation for Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 48. Nonmandatory recommendations the employee may use as a reference is known as a _____. a. guideline b. standard c. procedure d. practice ANSWER: a POINTS: 1 REFERENCES: p. 88 H1: Information Security Policy, Standards, And Practices H2: Policy as the Foundation for Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 4/25/2021 1:32 PM DATE MODIFIED: 4/27/2021 7:37 PM 49. The _____is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization’s security efforts. a. SysSP b. EISP c. GSP d. ISSP ANSWER: b POINTS: 1 REFERENCES: p. 91 H1: Information Security Policy, Standards, And Practices H2: Enterprise Information Security Policy QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 3 Information Security Management HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 50. The EISP component of _____ provides information on the importance of information security in the organization and the legal and ethical obligation to protect critical information about customers, employees, and markets. a. Need for Information Security b. Information Security Responsibilities and Roles c. Statement of Purpose d. Information Security Elements ANSWER: a POINTS: 1 REFERENCES: p. 92 H1: Information Security Policy, Standards, And Practices H2: Enterprise Information Security Policy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 4/25/2021 1:38 PM DATE MODIFIED: 4/25/2021 1:40 PM 51. _____often function as standards or procedures to be used when configuring or maintaining systems. a. ESSPs b. EISPs c. ISSPs d. SysSPs ANSWER: d POINTS: 1 REFERENCES: p. 95 H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 52. The SETA program is a control measure designed to reduce the instances of _____ security breaches by employees. a. intentional b. external c. accidental d. physical Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 3 Information Security Management ANSWER: POINTS: REFERENCES:

c 1 H1: Security Education, Training, And Awareness Program p. 104 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 53. An information security _____ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training. a. plan b. framework c. model d. policy ANSWER: b POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 54. The stated purpose of ISO/IEC 27002:2013 is to give guidelines for organizational information security standards and information security _____ practices. a. implementation b. certification c. management d. accreditation ANSWER: c POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks H2: The ISO 27000 Series QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/14/2021 7:14 PM 55. When ISO 17799 first came out, several countries, including the United States, Germany, and Japan, refused to adopt it, claiming that it had fundamental problems. Which of the following is NOT one of those problems? Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 3 Information Security Management a. The standard lacked the measurement precision associated with a technical standard. b. It was not as complete as other frameworks. c. The standard was hurriedly prepared, given the tremendous impact its adoption could have on industry information security controls. d. The global information security community had already defined a justification for a code of practice, such as the one identified in ISO/IEC 17799. ANSWER: d POINTS: 1 REFERENCES: p. 108 H1: Information Security Blueprint, Models, and Frameworks H2: The ISO 27000 Series QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:38 PM 56. SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security _____. a. plan b. standard c. policy d. blueprint ANSWER: d POINTS: 1 REFERENCES: p. 110 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 57. According to NIST SP 800-14's security principles, security should _____. a. support the mission of the organization b. require a comprehensive and integrated approach c. be cost-effective d. All of the above ANSWER: d POINTS: 1 REFERENCES: p. 110 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 3 Information Security Management DATE MODIFIED:

4/17/2021 2:21 PM

58. In early 2014, in response to Executive Order 13636, NIST published the Cybersecurity Framework, which intends to allow organizations to _____. a. identify and prioritize opportunities for improvement within the context of a continuous and repeatable process b. assess progress toward a recommended target state c. communicate among local, state, and national agencies about cybersecurity risk d. None of these ANSWER: a POINTS: 1 REFERENCES: p. 111 H1: Information Security Blueprint, Models, and Frameworks H2: NIST Security Models QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 59. The spheres of security are the foundation of the security framework and illustrate how information is under attack from a variety of sources, with far fewer protection layers between the information and potential attackers on the _____ side of the organization. a. technology b. Internet c. people d. operational ANSWER: c POINTS: 1 REFERENCES: p. 113 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 60. _____ controls cover security processes that are designed by strategic planners and implemented by the security administration of the organization. a. Managerial b. Technical c. Operational d. Informational ANSWER: a POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 3 Information Security Management HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 61. _____ controls address personnel security, physical security, and the protection of production inputs and outputs. a. Informational b. Operational c. Technical d. Managerial ANSWER: b POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 62. _____ is a strategy for the protection of information assets that uses multiple layers and different types of controls (managerial, operational, and technical) to provide optimal protection. a. Networking b. Proxy c. Defense in depth d. Best-effort ANSWER: c POINTS: 1 REFERENCES: p. 115 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 63. _____ is a strategy of using multiple types of controls that prevent the failure of one system from compromising the security of information. a. Firewalling b. Hosting c. Redundancy d. Domaining ANSWER: c POINTS: 1 REFERENCES: p. 115 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 3 Information Security Management HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:39 PM 64. Redundancy can be implemented at a number of points throughout the security architecture, such as in _____. a. firewalls b. proxy servers c. access controls d. All of the above ANSWER: d POINTS: 1 REFERENCES: p. 115 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 65. Security _____ are the areas of trust within which users can freely communicate. a. perimeters b. domains c. rectangles d. layers ANSWER: b POINTS: 1 REFERENCES: p. 116 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM Completion 66. The _____ of an organization are the intermediate states obtained to achieve progress toward a goal or goals. objectives ANSWER: POINTS: 1 REFERENCES: p. 84 H1: Information Security Planning And Governance QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 3 Information Security Management

DATE CREATED: DATE MODIFIED:

expectations of the organization’s senior management with respect to it 9/14/2016 10:38 AM 4/17/2021 2:20 PM

67. The process of _____ planning is that of defining and specifying the long-term direction to be taken by an organization. strategic ANSWER: POINTS: 1 REFERENCES: p. 84 H1: Information Security Planning And Governance QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 4/25/2021 1:44 PM DATE MODIFIED: 4/25/2021 1:45 PM 68. The process of _____ governance is the executive management team’s responsibility to provide strategic direction. corporate ANSWER: POINTS: 1 REFERENCES: p. 84 H1: Information Security Planning And Governance QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 4/25/2021 1:47 PM DATE MODIFIED: 4/25/2021 1:48 PM 69. A(n) _____ plan is used to plan for the organization’s intended efforts on a day-to-day basis for the next several months. operational ANSWER: POINTS: 1 REFERENCES: H1: Information Security Planning And Governance H2: Planning Levels p. 87 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.2 - Define information security governance and list the expectations of the organization’s senior management with respect to it DATE CREATED: 4/25/2021 1:50 PM Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 3 Information Security Management DATE MODIFIED:

4/27/2021 7:39 PM

70. A(n) _____ directs members of an organization as to how issues should be addressed and how technologies should be used. policy ANSWER: POINTS: 1 REFERENCES: p. 88 H1: Information Security Policy, Standards, And Practices QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 71. _____-specific security policies often function as standards or procedures to be used when configuring or maintaining security technologies. Systems ANSWER: POINTS: 1 REFERENCES: p. 95 H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/27/2021 7:40 PM 72. A(n) _____ control list is a specification of authorization that govern the rights and privileges of users to a particular information asset. access ANSWER: POINTS: 1 REFERENCES: p. 95 H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 3 Information Security Management

DATE CREATED: DATE MODIFIED:

procedures, and guidelines 4/25/2021 1:54 PM 4/25/2021 1:56 PM

73. _____ rules are the instructions a system administrator codes into a server, networking device, or security device to specify how it operates. configuration ANSWER: POINTS: 1 REFERENCES: H1: Information Security Policy, Standards, And Practices H2: System-Specific Security Policy p. 97 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 4/25/2021 1:58 PM DATE MODIFIED: 4/25/2021 1:59 PM 74. Policy _____ means the employee must agree to the policy which means policies must be agreed to by act or affirmation. compliance ANSWER: POINTS: 1 REFERENCES: p. 100 H1: Information Security Policy, Standards, And Practices H2: Developing and Implementing Effective Security Policy QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 4/25/2021 2:00 PM DATE MODIFIED: 4/25/2021 2:01 PM 75. It is good practice for the policy _____ to solicit input both from technically adept information security experts and from business-focused managers in each community of interest when making revisions to security policies. administrator ANSWER: POINTS: 1 REFERENCES: p. 103 H1: Information Security Policy, Standards, And Practices H2: Policy Management QUESTION TYPE: Completion HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 3 Information Security Management STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 76. Some policies may need a(n) _____ indicating their expiration date. sunset clause ANSWER: POINTS: 1 REFERENCES: p. 104 H1: Information Security Policy, Standards, And Practices H2: Policy Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 77. The security _____ is an outline or structure of the organization’s overall information security strategy that is used as a road map for planned changes to its information security environment. framework ANSWER: POINTS: 1 REFERENCES: p. 107 H1: Information Security Blueprint, Models, and Frameworks QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 78. _____ controls are information security safeguards focusing on lower-level planning that deals with the functionality of the organization’s security. These safeguards include disaster recovery and incident response planning. Operational ANSWER: POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 3 Information Security Management LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 79. Implementing multiple types of technology and thereby precluding that the failure of one system will compromise the security of information is referred to as _____. redundancy ANSWER: defense in depth POINTS: 1 REFERENCES: p. 115 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 80. _____ controls are information security safeguards that focus on the application of modern technologies, systems, and processes to protect information assets. Technical ANSWER: POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 81. _____ controls are security processes that are designed by strategic planners and implemented by the security administration of the organization. Managerial ANSWER: POINTS: 1 REFERENCES: p. 114 H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 3 Information Security Management DATE MODIFIED:

4/17/2021 2:20 PM

82. A security _____ defines the boundary between the outer limit of an organization’s security and the beginning of the outside world. perimeter ANSWER: POINTS: 1 REFERENCES: H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture p. 115 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM Essay 83. What three purposes does the ISSP serve? The issue-specific security policy, or ISSP, 1) addresses specific areas of technology, 2) ANSWER: requires frequent updates, and 3) contains a statement about the organization’s position on a specific issue. POINTS: 1 REFERENCES: p. 91 H1: Information Security Policy, Standards, And Practices H2: Issue-Specific Security Policy QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:49 PM 84. What is the purpose of security education, training, and awareness (SETA)? The purpose of SETA is to enhance security by: ANSWER: Improving awareness of the need to protect system resources Developing skills and knowledge so computer users can perform their jobs more securely Building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems POINTS: 1 REFERENCES: H1: Security Education, Training, And Awareness Program p. 105 QUESTION TYPE: Essay HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 3 Information Security Management STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM Subjective Short Answer 85. List and briefly describe the general categories of information security policy. ANSWER:

In InfoSec, there are three general policy categories:

• Enterprise information security policy (EISP)—Developed within the

• •

context of the strategic IT plan, this sets the tone for the InfoSec department and the InfoSec climate across the organization. The CISO typically drafts the program policy, which is usually supported and signed by the CIO or the CEO. Issue-specific security policies (ISSPs)—These are sets of rules that define acceptable behavior within a specific organizational resource, such as email or Internet usage. Systems-specific policies (SysSPs)—A merger of technical and managerial intent, SysSPs include both the managerial guidance for the implementation of a technology as well as the technical specifications for its configuration.

POINTS: REFERENCES:

1 H1: Information Security Policy, Standards, And Practices p. 90 H2: Policy as the Foundation for Planning QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.3 - Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines DATE CREATED: 4/25/2021 2:06 PM DATE MODIFIED: 4/27/2021 7:41 PM 86. What is the purpose of the SETA program? The purpose of SETA is to enhance security by doing the following: ANSWER: • Improving awareness of the need to protect system resources • Developing skills and knowledge so computer users can perform their jobs more securely • Building in-depth knowledge as needed to design, implement, or operate security programs for organizations and systems POINTS:

1

Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 3 Information Security Management REFERENCES:

H1: Security Education, Training, And Awareness Program p. 104 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.03.4 - List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization DATE CREATED: 4/25/2021 2:14 PM DATE MODIFIED: 4/25/2021 2:15 PM 87. Briefly describe management, operational, and technical controls, and explain when each would be applied

as part of a security framework. ANSWER:

Management controls cover security processes that are designed by strategic planners and implemented by an organization’s security administration. These designs include setting the direction and scope of the security processes and provide detailed instruction for their conduct. Operational controls deal with the functionality of security in the organization, including disaster recovery and incident response planning.

Technical controls address tactical and technical issues related to designing and implementing security in the organization, as well as issues related to examining and selecting appropriate technologies for protecting information. POINTS: 1 REFERENCES: H1: Information Security Blueprint, Models, and Frameworks H2: Design of the Security Architecture p. 114 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.03.5 - Discuss the Dental Practice Act. DATE CREATED: 4/25/2021 2:11 PM DATE MODIFIED: 4/25/2021 2:12 PM

Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 4 Risk Management True / False 1. The upper management of an organization must structure the IT and information security functions to defend the organization’s information assets. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction to Risk Management p. 122 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 9/14/2016 10:42 AM 2. According to Sun Tzu, if you know yourself and know your enemy, you have an average chance to be successful in an engagement. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 122 H1: Introduction to Risk Management H2: Sun Tzu and the Art of Risk Management QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:17 PM 3. Knowing yourself means identifying, examining, and understanding the threats facing the organization's information assets. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 122 H1: Introduction to Risk Management H2: Sun Tzu and the Art of Risk Management QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 4 Risk Management DATE MODIFIED:

5/17/2021 6:57 PM

4. Risk control, also known as risk treatment, is the application of controls that reduce the risks to an organization’s information assets to an acceptable level. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 123 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.2 - Explain the risk management framework and process model, including major components DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 5/17/2021 6:58 PM 5. In addition to their other responsibilities, the three communities of interest are responsible for determining which control options are cost effective for the organization. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 125 H1: The Risk Management Framework H2: The Roles of the Communities of Interest QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.2 - Explain the risk management framework and process model, including major components DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:18 PM 6. Residual risk is the risk that organizations are willing to accept even after current current controls have been applied. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The Risk Management Framework H2: Defining the Organization’s Risk Tolerance and Risk Appetite p. 126 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 4 Risk Management DATE CREATED: DATE MODIFIED:

9/14/2016 10:42 AM 5/17/2021 6:59 PM

7. The organization should adopt naming standards that do not convey information to potential system attackers. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 132 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 5/17/2021 6:59 PM 8. Identifying human resources, documentation, and data information assets of an organization is easier than identifying hardware and software assets. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 133 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 5/17/2021 7:00 PM 9. A data classification scheme is a formal access control methodology used to assign a level of availability to an information asset and thus restrict when people who can access it. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 134 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 4 Risk Management DATE CREATED: DATE MODIFIED:

9/14/2016 10:42 AM 5/17/2021 7:01 PM

10. Within a data classification scheme, "comprehensive" means that an information asset should fit in only one category. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 135 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:19 PM 11. A security clearance is a component of a data classification scheme that assigns a status level to systems to designate the maximum level of classified data that may be stored on them. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 135 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:19 PM 12. When determining the relative importance of each asset, refer to the organization’s mission statement or statement of objectives to determine which elements are essential, which are supportive, and which are merely adjuncts. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 135 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 4 Risk Management DATE CREATED: DATE MODIFIED:

9/14/2016 10:42 AM 9/14/2016 10:42 AM

13. When it is necessary to calculate, estimate, or derive values for information assets, you might give consideration to the value incurred from the cost of protecting the information. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis p. 162 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 9/14/2016 10:42 AM 14. The value of information to the organization's competition should influence the asset's valuation. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 162 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 9/14/2016 10:42 AM 15. You cannot use qualitative measures to rank information asset values. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 139 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 4 Risk Management DATE MODIFIED:

9/14/2016 10:42 AM

16. The threats-vulnerabilities-assets (TVA) worksheet is a document that shows a comparative ranking of prioritized assets against prioritized threats, with an indication of any vulnerabilities in the asset/threat pairings. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 141 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 9/14/2016 10:42 AM 17. Risk mitigation is the risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards, but it is not the preferred approach to controlling risk. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Risk Treatment/Risk Response p. 152 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.6 - Describe various options for a risk treatment strategy DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 5/17/2021 7:02 PM 18. If the acceptance risk treatment strategy is used to handle every vulnerability in the organization, its managers may be unable to conduct proactive security activities and may portray an apathetic approach to security in general. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Risk Treatment/Risk Response H2: Risk Acceptance p. 154 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.6 - Describe various options for a risk treatment strategy DATE CREATED: 9/14/2016 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 4 Risk Management DATE MODIFIED:

5/17/2021 7:03 PM

19. To determine if the risk to an information asset is acceptable or not, you estimate the expected loss the organization will incur if the risk is exploited. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 157 H1: Managing Risk QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:21 PM 20. In a cost-benefit analysis, a single loss expectancy (SLE) is the calculated value associated with the most likely loss from an attack; the SLE is the product of the asset’s value and the annualized loss expectancy. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 163 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:22 PM 21. Some information security experts argue that it is virtually impossible to determine the true value of information and information-bearing assets. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 161 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 4 Risk Management DATE MODIFIED:

9/14/2016 10:42 AM

22. Cost-benefit analyses (CBAs) cannot be calculated after controls have been functioning for a time, as observation over time prevents precision in evaluating the benefits of the safeguard and determining whether it is functioning as intended. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 163 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:42 AM DATE MODIFIED: 3/8/2017 9:22 PM Modified True / False 23. When an organization depends on IT-based systems to remain viable, InfoSec and the discipline of asset management must become an integral part of the economic basis for making business decisions. _____ False - risk ANSWER: POINTS: 1 REFERENCES: H2: Sun Tzu and the Art of Risk Management H1: Introduction to Risk Management p. 122 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 5/5/2021 6:07 PM DATE MODIFIED: 5/5/2021 6:08 PM 24. Establishing a competitive business model, method, or technique enables an organization to provide a product or service that is superior and creates a(n) competitive advantage. _____ ANSWER: True POINTS: 1 REFERENCES: p. 122 H1: Introduction to Risk Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 4 Risk Management 25. "Know the enemy" means identifying, examining, and understanding the competition facing the organization. _____ False - threats ANSWER: False - threat POINTS: 1 REFERENCES: H1: Introduction to Risk Management H2: Sun Tzu and the Art of Risk Management p. 123 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 5/5/2021 6:10 PM DATE MODIFIED: 5/17/2021 7:06 PM 26. The identification, analysis, and evaluation of risk as initial parts of risk management is called risk assessment. _____ ANSWER: True POINTS: 1 REFERENCES: H1: The Risk Management Framework p. 123 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/5/2021 6:13 PM DATE MODIFIED: 5/5/2021 6:14 PM 27. The RM policy is a strategic document that formalizes much of the intent of the Infosec group. _____ ANSWER: False - governance POINTS: 1 REFERENCES: H1: The Risk Management Framework p. 125 H2: The RM Policy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/5/2021 6:17 PM DATE MODIFIED: 5/17/2021 7:08 PM 28. Risk acceptance defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility. _____ ANSWER: False - appetite Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 4 Risk Management POINTS: REFERENCES:

1 H1: The Risk Management Framework H2: Defining the Organization’s Risk Tolerance and Risk Appetite p. 126 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 29. Pervasive risk is the amount of risk that remains to an information asset even after the organization has applied its desired level of controls. _____ False - Residual ANSWER: POINTS: 1 REFERENCES: p. 126 H1: The Risk Management Framework H2: Defining the Organization’s Risk Tolerance and Risk Appetite QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 30. Risk perception is the assessment of the amount of risk an organization is willing to accept for a particular information asset, typically part of the risk appetite. _____ False - tolerance ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Framework H2: Defining the Organization’s Risk Tolerance and Risk Appetite p. 127 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/5/2021 6:21 PM DATE MODIFIED: 5/5/2021 6:22 PM 31. Risk analysis is the enumeration and documentation of risks to an organization's information assets. _____ ANSWER: False - identification POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 4 Risk Management REFERENCES:

p. 129 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:09 PM 32. Within data classification schemes, it is important that all categories used be unique and mutually exclusive. _____ ANSWER: False - comprehensive POINTS: 1 REFERENCES: p. 135 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:10 PM 33. One way to determine which information assets are valuable is by evaluating which information asset(s) would expose the company to liability or embarrassment if revealed. _____ ANSWER: True POINTS: 1 REFERENCES: p. 135 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:11 PM 34. Each of the threats faced by an organization must be evaluated, including determining the threat's potential to endanger the organization, which is known as a threat prioritization. _____ ANSWER: False - assessment POINTS: 1 REFERENCES: p. 136 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Modified True / False Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 4 Risk Management HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 35. Risk mitigation is the process of assigning a risk rating or score to each information asset. _____ False - assessment ANSWER: POINTS: 1 REFERENCES: p. 136 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 36. Likelihood is the probability that a specific vulnerability within an organization will be the target of an attack. _____ ANSWER: True POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Analysis p. 144 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 37. The mitigation risk treatment strategy applies controls and safeguards that eliminate or reduce the remaining uncontrolled risk. _____ ANSWER: True POINTS: 1 REFERENCES: p. 152 H1: Risk Treatment/Risk Response QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.6 - Describe various options for a risk treatment strategy DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:12 PM Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 4 Risk Management 38. The computed value of the ALE compares the costs and benefits of a particular control alternative to determine whether the control is worth its cost. _____ ANSWER: False - cost-benefit analysis (CBA) False - cost-benefit analysis False - CBA POINTS: 1 REFERENCES: p. 159 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 39. Cost mitigation is the process of preventing the financial impact of an incident by implementing a control. _____ ANSWER: False - avoidance POINTS: 1 REFERENCES: p. 160 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 40. Exposure factor is the expected percentage of loss that would occur from a particular attack. _____ ANSWER: True POINTS: 1 REFERENCES: p. 163 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 4 Risk Management 41. The concept of competitive _____ refers to falling behind the competition. a. disadvantage b. drawback c. failure d. shortcoming ANSWER: a POINTS: 1 REFERENCES: p. 123 H1: Introduction To Risk Management QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:17 PM 42. Risk _____ is the application of security mechanisms to reduce the risks to an organization’s data and information systems. a. avoidance b. treatment c. identification d. assessment ANSWER: b POINTS: 1 REFERENCES: p. 123 H1: The Risk Management Framework QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.2 - Explain the risk management framework and process model, including major components DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:16 PM 43. Risk _____ is the identification, analysis, and evaluation of risk as initial parts of risk management. a. management b. assessment c. identification d. control ANSWER: b POINTS: 1 REFERENCES: p. 123 H1: The Risk Management Framework QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.2 - Explain the risk management framework and process model, including major components DATE CREATED: 5/5/2021 6:26 PM DATE MODIFIED: 5/5/2021 6:27 PM 44. The risk management (RM) _____ is the overall structure of the strategic planning and design for the entirety of the organization’s RM efforts. Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 4 Risk Management a. assessment c. acceptance ANSWER: POINTS: REFERENCES:

b. framework d. treatment b 1 H1: The Risk Management Framework p. 123 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/5/2021 6:30 PM DATE MODIFIED: 5/5/2021 6:32 PM 45. Risk _____ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoffs between perfect security and unlimited accessibility. a. benefit b. appetite c. acceptance d. residual ANSWER: b POINTS: 1 REFERENCES: p. 126 H1: The Risk Management Framework H2: Defining the Organization’s Risk Tolerance and Risk Appetite QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:17 PM 46. Risk _____ is the assessment of the amount of risk an organization is willing to accept for a particular information asset, typically synthesized into the organization’s overall risk appetite. a. benefit b. baseline c. tolerance d. residual ANSWER: c POINTS: 1 REFERENCES: p. 126 H1: The Risk Management Framework H2: Defining the Organization’s Risk Tolerance and Risk Appetite QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/5/2021 6:35 PM DATE MODIFIED: 5/5/2021 6:37 PM Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 4 Risk Management 47. The first phase of the risk management process is _____. a. risk identification b. forming the risk management planning team c. risk control d. risk evaluation ANSWER: a POINTS: 1 REFERENCES: p. 129 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:21 PM 48. Understanding the _____ context means understanding the impact of elements such as the business environment, the legal/regulatory/compliance environment, as well as the threat environment. a. external b. design c. internal d. risk evaluation ANSWER: a POINTS: 1 REFERENCES: H1: The Risk Management Process H2: RM Process Preparation—Establishing the Context p. 129 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 6:39 PM DATE MODIFIED: 5/5/2021 6:45 PM 49. Understanding the _____ context means understanding elements that could impact or influence the RM process such as the organization’s governance structure (or lack thereof), the organization’s internal stakeholders, as well as the organization’s culture. a. external b. design c. internal d. risk evaluation ANSWER: c POINTS: 1 REFERENCES: H1: The Risk Management Process H2: RM Process Preparation—Establishing the Context p. 129 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 6:42 PM DATE MODIFIED: 5/5/2021 6:44 PM Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 4 Risk Management 50. Which of the following is NOT one of the categories recommended for categorizing information assets? a. Firmware b. Procedures c. People d. Hardware ANSWER: a POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 131 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 6:49 PM DATE MODIFIED: 5/17/2021 7:21 PM 51. _____ addresses are sometimes called electronic serial numbers or hardware addresses. a. HTTP b. IP c. DHCP d. MAC ANSWER: d POINTS: 1 REFERENCES: p. 132 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:17 PM 52. A(n) _____ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment. a. IP b. FCO c. CTO d. HTTP ANSWER: b POINTS: 1 REFERENCES: p. 133 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:17 PM 53. A(n) _____ scheme is a formal access control methodology used to assign a level of confidentiality to an information Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 4 Risk Management asset and thus restrict the number of people who can access it. a. security clearance b. data recovery c. risk management d. data classification ANSWER: d POINTS: 1 REFERENCES: p. 134 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/5/2021 6:53 PM 54. As each information asset is identified, categorized, and classified, a(n) _____ value must be assigned to it. a. secondary b. significant c. positional d. relative ANSWER: d POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 135 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 6:54 PM DATE MODIFIED: 5/5/2021 6:56 PM 55. A threat _____ is an evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack. a. review b. search c. investigation d. assessment ANSWER: d POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 136 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 6:57 PM DATE MODIFIED: 5/17/2021 7:22 PM 56. In a _____, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 4 Risk Management score for each of the criteria, and then summing and ranking those scores. a. threat assessment b. risk management program c. weighted table analysis d. data classification scheme ANSWER: c POINTS: 1 REFERENCES: p. 139 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:23 PM 57. Flaws or weaknesses in an information asset, security procedure, design, or control that can be exploited accidentally or on purpose to breach security are known as _____. a. threats b. exploits c. vulnerabilities d. events ANSWER: c POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 140 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 7:02 PM DATE MODIFIED: 5/5/2021 7:04 PM 58. In the TVA worksheet, assets are placed into a matrix with threats and then the exposure of the assets to specific threats is explored by documenting _____. a. variables b. verifications c. vulnerabilities d. value ANSWER: c POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 141 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/5/2021 7:09 PM DATE MODIFIED: 5/17/2021 7:23 PM Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 4 Risk Management 59. Risk _____ is a determination of the extent to which an organization’s information assets are exposed to risk. a. interpretation b. analysis c. exploration d. declaration ANSWER: b POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Analysis p. 142 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. DATE CREATED: 5/5/2021 7:13 PM DATE MODIFIED: 5/5/2021 7:15 PM 60. The probability that a specific vulnerability within an organization will be attacked by a threat is known as _____ a. determinism b. likelihood c. externality d. potential ANSWER: b POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Analysis p. 144 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. DATE CREATED: 5/5/2021 7:16 PM DATE MODIFIED: 5/5/2021 7:18 PM 61. _____ equals the probability of a successful attack multiplied by the expected loss from a successful attack plus an element of uncertainty. a. Loss magnitude b. Risk c. Loss frequency d. Loss ANSWER: b POINTS: 1 REFERENCES: p. 147 H1: The Risk Management Process H2: Risk Assessment: Risk Analysis QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:17 PM 62. The _____ risk treatment strategy attempts to eliminate or reduce any remaining uncontrolled risk through the Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 4 Risk Management application of additional controls and safeguards. a. termination b. mitigation c. transference d. acceptance ANSWER: b POINTS: 1 REFERENCES: p. 152 H1: Risk Treatment/Risk Response H2: Risk Mitigation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.6 - Describe various options for a risk treatment strategy DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:24 PM 63. The _____ risk treatment strategy attempts to shift risk to other assets, other processes, or other organizations. a. transference b. defense c. acceptance d. mitigation ANSWER: a POINTS: 1 REFERENCES: p. 153 H1: Risk Treatment/Risk Response H2: Risk Transference QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.6 - Describe various options for a risk treatment strategy DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:26 PM 64. The _____ risk treatment strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation. a. defense b. transference c. mitigation d. acceptance ANSWER: d POINTS: 1 REFERENCES: p. 154 H1: Risk Treatment/Risk Response H2: Risk Acceptance QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.04.6 - Describe various options for a risk treatment strategy DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:27 PM 65. The formal decision-making process used when considering the economic feasibility of implementing information Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 4 Risk Management security controls and safeguards is called a(n) _____. a. ARO b. CBA c. ALE d. SLE ANSWER: b POINTS: 1 REFERENCES: p. 160 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 66. _____ is simply how often you expect a specific type of attack to occur. a. ARO b. CBA c. ALE d. SLE ANSWER: a POINTS: 1 REFERENCES: p. 163 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM Completion 67. _____ is the process of identifying risk, as represented by vulnerabilities, to an organization’s information assets and infrastructure, and taking steps to reduce this risk to an acceptable level. Risk management ANSWER: POINTS: 1 REFERENCES: p. 122 H1: Introduction To Risk Management H2: Sun Tzu and the Art of Risk Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 68. _____ include information and the systems that use, store, and transmit information. Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 4 Risk Management ANSWER: POINTS: REFERENCES:

Information assets 1 p. 122 H1: Introduction To Risk Management H2: Sun Tzu and the Art of Risk Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 69. _____ involves four major undertakings: risk identification, risk analysis, risk evaluation, and risk treatment/control. Risk management ANSWER: POINTS: 1 REFERENCES: p. 123 H1: The Risk Management Framework QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.2 - Explain the risk management framework and process model, including major components DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:29 PM 70. You can determine the relative risk for each of the organization's information assets using a process called risk _____, which combines risk identification, risk analysis and risk evaluation. assessment ANSWER: POINTS: 1 REFERENCES: p. 123 H1: The Risk Management Framework QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.2 - Explain the risk management framework and process model, including major components DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/17/2021 7:30 PM 71. Risk _____ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the tradeoff s between perfect security and unlimited accessibility. appetite ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Framework Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 4 Risk Management p. 126 H2: Defining the Organization’s Risk Tolerance and Risk Appetite QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/7/2021 3:40 PM DATE MODIFIED: 5/7/2021 3:42 PM 72. Risk _____ is the assessment of the amount of risk an organization is willing to accept for a particular information asset, typically synthesized into the organization’s overall risk appetite. tolerance ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Framework p. 126 H2: Defining the Organization’s Risk Tolerance and Risk Appetite QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.3 - Define risk appetite and explain how it relates to residual risk DATE CREATED: 5/7/2021 3:43 PM DATE MODIFIED: 5/7/2021 3:44 PM 73. When deciding which information assets to track, consider the following asset attributes: people, _____, data, software, and hardware. procedures ANSWER: POINTS: 1 REFERENCES: p. 130 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 74. A data _____ scheme is a formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it. classification ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Process Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 4 Risk Management H2: Risk Assessment: Risk Identification p. 134 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/7/2021 3:46 PM DATE MODIFIED: 5/17/2021 7:32 PM 75. A threat _____ is an evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack. assessment ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Identification p. 136 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/7/2021 3:48 PM DATE MODIFIED: 5/7/2021 3:49 PM 76. Once the inventory and value assessment are complete, you can prioritize each asset using a straightforward process known as _____ analysis. weighted factor ANSWER: weighted table POINTS: 1 REFERENCES: p. 139 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 77. After identifying and performing the preliminary classification of an organization’s information assets, the analysis phase moves on to an examination of the _____ facing the organization. threats ANSWER: POINTS: 1 REFERENCES: p. 140 H1: The Risk Management Process H2: Risk Assessment: Risk Identification Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 4 Risk Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 78. Flaws or weaknesses in an information asset, security procedure, design, or control that can be exploited accidentally or on purpose to breach security are known as _____. vulnerabilities ANSWER: POINTS: 1 REFERENCES: p. 140 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/7/2021 3:49 PM DATE MODIFIED: 5/7/2021 3:50 PM 79. Risk _____ is a determination of the extent to which an organization’s information assets are exposed to risk. analysis ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Analysis p. 142 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. DATE CREATED: 5/7/2021 4:02 PM DATE MODIFIED: 5/7/2021 4:03 PM 80. _____ is the probability that a specific vulnerability within an organization's assets will be successfully attacked. Likelihood ANSWER: POINTS: 1 REFERENCES: H1: The Risk Management Process H2: Risk Assessment: Risk Analysis p. 144 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 4 Risk Management DATE CREATED: DATE MODIFIED:

9/14/2016 10:43 AM 4/28/2021 7:16 PM

81. The _____ treatment strategy attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation. mitigation ANSWER: POINTS: 1 REFERENCES: p. 152 H1: Risk Treatment/Risk Response H2: Risk Mitigation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.5 - List the functions and structure of the endocrine system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/3/2021 8:30 PM 82. Cost _____ is the process of preventing the financial impact of an incident by implementing a control. avoidance ANSWER: POINTS: 1 REFERENCES: p. 160 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 83. _____ is the process of assigning financial value or worth to each information asset. Asset valuation ANSWER: Information asset valuation POINTS: 1 REFERENCES: p. 161 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM 84. A single loss _____ is the calculation of the value associated with the most likely loss from an attack. Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 4 Risk Management ANSWER: POINTS: REFERENCES:

expectancy 1 p. 163 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 4/28/2021 7:16 PM Subjective Short Answer 85. According to Sun Tzu, what two things must be achieved to secure information assets successfully? ANSWER:

To reduce risk in an organization, the organization must know itself (including its assets and processes used to protect them) and know its enemy (the nature of the threats it faces). POINTS: 1 REFERENCES: p. 122 H1: Introduction to Risk Management H2: Sun Tzu and the Art of Risk Management QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.1 - Define risk management and describe its importance DATE CREATED: 5/7/2021 4:06 PM DATE MODIFIED: 5/7/2021 4:06 PM 86. Describe the TVA worksheet. What is it used for? ANSWER:

The TVA worksheet combines a prioritized list of assets and their vulnerabilities and a list that prioritizes threats facing the organization. The resulting grid provides a convenient method of examining the “exposure” of assets, allowing a simple vulnerability assessment.

POINTS: REFERENCES:

1 p. 141 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 5/7/2021 4:07 PM DATE MODIFIED: 5/7/2021 4:07 PM Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 4 Risk Management 87. Describe residual risk. ANSWER:

Residual risk is the “leftover” risk that is not completely removed, shifted, or included in planning; it is the risk that remains after current controls are implemented.

POINTS: REFERENCES:

1 p. 157 H1: Managing Risk QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 5/7/2021 4:08 PM DATE MODIFIED: 5/7/2021 4:08 PM 88. What is the difference between intrinsic value and acquired value? ANSWER:

Intrinsic value is the essential worth of the asset under consideration; acquired value is the value beyond intrinsic value that some information assets acquire over time. POINTS: 1 REFERENCES: p. 161 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 5/7/2021 4:08 PM DATE MODIFIED: 5/7/2021 4:09 PM 89. Why do some argue that it is virtually impossible to accurately determine the true value of information and information-bearing assets? ANSWER:

POINTS: REFERENCES:

Some costs are easily determined but other costs are almost impossible to determine, such as the dollar value of the loss in market share if information on a firm’s new product offerings is released prematurely and the company loses its competitive edge. A further complication is that over time, some information assets acquire value that is beyond their essential or intrinsic value. This higher acquired value is the more appropriate value in most cases. 1 p. 161 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis

Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 4 Risk Management QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 5/17/2021 7:33 PM DATE MODIFIED: 5/17/2021 7:37 PM Essay 90. One of the first components of risk identification is identification, inventory, and categorization of assets, including all elements, or attributes, of an organization’s information system. List and describe these asset attributes. People comprise employees and nonemployees. ANSWER: Procedures fall into two categories: IT and business standard procedures, and IT and business-sensitive procedures. Data components account for the management of information in all its states: transmission, processing, and storage. Software components are assigned to one of three categories: applications, operating systems, or security components. Hardware is assigned to one of two categories: the usual systems devices and their peripherals, and the devices that are part of information security control systems. Hardware components are separated into two categories: devices and peripherals, and networks. POINTS: 1 REFERENCES: p. 130 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 3/8/2017 9:43 PM 91. When valuing information assets, what criteria could be considered in establishing or determining the value of the assets? Which information asset is most critical to the organization’s success? ANSWER: Which information asset generates the most revenue? Which of these assets plays the biggest role in generating revenue or delivering services? Which information asset would be the most expensive to replace? Which information asset would be the most expensive to protect? Which information asset would most expose the company to liability or embarrassment if revealed? POINTS:

1

Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 4 Risk Management REFERENCES:

p. 135 H1: The Risk Management Process H2: Risk Assessment: Risk Identification QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.04.4 - Describe how risk is identified and documented DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 9/14/2016 10:43 AM 92. What is a cost-benefit analysis (CBA) and how can it be calculated? In its simplest definition, CBA (or economic feasibility) determines whether a particular ANSWER: control is worth its cost. CBAs may be calculated before a control or safeguard is implemented to determine if the control is worth implementing. While many techniques exist, the CBA is most easily calculated using the ALE from earlier assessments before implementation of the proposed control, which is known as ALE(prior). Subtract the revised ALE, which is estimated based on the control being in place; this revised value is known as ALE(post). Complete the calculation by subtracting the annualized cost of a safeguard (ACS). CBA = ALE(prior) - ALE(post) - ACS where the annualized loss expectancy equals the single loss expectancy multiplied by the annualized rate of occurrence. ALE = SLE x ARO and the single loss expectancy equals the exposure factor multiplied by the asset value, SLE = EF x AV. POINTS: REFERENCES:

1 p. 160 H1: Managing Risk H2: Feasibility and Cost-Benefit Analysis QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.04.7 - List the functions and structure of the circulatory system. DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 3/8/2017 9:45 PM

Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning True / False 1. The business impact analysis is a preparatory activity common to both CP and risk management. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 177 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 4:56 PM DATE MODIFIED: 6/14/2021 5:28 PM 2. An external event is an event with negative consequences that could threaten the organization’s information assets or operations; also referred to as an incident candidate. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 177 H1: Fundamentals Of Contingency Planning QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:03 PM DATE MODIFIED: 5/19/2021 5:05 PM 3. The continuity planning management team (CPMT) is the group of senior managers and project members organized to conduct and lead all contingency planning efforts. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 177 H1: Fundamentals Of Contingency Planning QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:06 PM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE MODIFIED:

5/19/2021 5:08 PM

4. The disaster recovery planning team (DRPT) is the team responsible for designing and managing the DR plan by specifying the organization’s preparation, response, and recovery from disasters. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 179 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:09 PM DATE MODIFIED: 5/19/2021 5:10 PM 5. A business influence analysis (BIA) is an investigation and assessment of adverse events that can affect the organization. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 180 H2: Business Impact Analysis QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:20 PM DATE MODIFIED: 5/19/2021 5:21 PM 6. A business process is a task performed by an organization or one of its units in support of the organization’s overall mission and operations. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 181 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning

DATE CREATED: DATE MODIFIED:

disaster recovery, and business continuity 5/19/2021 5:22 PM 5/19/2021 5:23 PM

7. A business process is a task performed by an organization or one of its units in support of the organization’s overall mission and operations. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 181 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:24 PM DATE MODIFIED: 5/19/2021 5:24 PM 8. A recovery time objective (RTO) is the total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 182 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:30 PM DATE MODIFIED: 6/3/2021 3:34 PM 9. The work recovery time (WRT) is the amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 183 Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:33 PM DATE MODIFIED: 5/19/2021 5:34 PM 10. The total time needed to place the business function back in service must be longer than the maximum tolerable downtime. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 184 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:36 PM DATE MODIFIED: 5/19/2021 5:37 PM 11. Prior to the development of each of the types of contingency planning documents, the CP team should work to develop the policy environment. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Contingency Planning Policies p. 185 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 5:40 PM DATE MODIFIED: 5/19/2021 5:43 PM 12. The computer security incident response team is composed solely of technical IT professionals who are prepared to detect, react to, and recover from an incident. a. True b. False ANSWER: False POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning REFERENCES:

H1: Incident Response p. 186 H2: Getting Started QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:11 PM DATE MODIFIED: 6/3/2021 3:34 PM 13. An incident is an adverse event that could result in a loss of information assets and threatens the viability of the entire organization. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 186 H1: Incident Response QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:07 PM DATE MODIFIED: 5/19/2021 6:08 PM 14. Incident response is an organization’s set of planning and preparation efforts for detecting, reacting to, and recovering from an incident. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 186 H1: Incident Response QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:10 PM DATE MODIFIED: 5/19/2021 6:11 PM 15. Procedures are planned for each identified incident scenario with incident handling procedures established for before and during the incident. a. True b. False ANSWER: False Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning POINTS: REFERENCES:

1 H1: Incident Response H2: Incident Response Planning p. 188 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:21 PM DATE MODIFIED: 5/19/2021 6:24 PM 16. Database shadowing duplicates data in real-time data storage, but does not back up the databases at the remote site. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 189 H1: Incident Response H2: Incident Response Planning QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:30 PM 17. Incident classification is the process of examining an adverse event or incident candidate and determining whether it constitutes an actual incident. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Incident Response H2: Detecting Incidents p. 191 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:26 PM DATE MODIFIED: 6/3/2021 3:35 PM 18. Use of dormant accounts is a probable indicator of an actual incident. a. True b. False Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning ANSWER: POINTS: REFERENCES:

False 1 H1: Incident Response H2: Detecting Incidents p. 191 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:30 PM DATE MODIFIED: 5/19/2021 6:32 PM 19. Changes to systems logs are a possible indicator of an actual incident. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Incident Response H2: Detecting Incidents p. 191 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:32 PM DATE MODIFIED: 5/19/2021 6:35 PM 20. Reported attacks are a probable indicator of an actual incident. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Incident Response H2: Detecting Incidents p. 192 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:35 PM DATE MODIFIED: 6/3/2021 3:35 PM 21. Two ways to activate an alert roster are simultaneously and in parallel. a. True Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning b. False ANSWER: POINTS: REFERENCES:

False 1 H1: Incident Response H2: Reacting to Incidents p. 193 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:38 PM DATE MODIFIED: 6/3/2021 3:36 PM 22. An alert message is a description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Incident Response H2: Reacting to Incidents p. 194 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:41 PM DATE MODIFIED: 6/3/2021 3:37 PM 23. Incident damage assessment is used to determine the impact from a breach of confidentiality, integrity, and availability on information and information assets. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Incident Response H2: Recovering from Incidents p. 195 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:45 PM DATE MODIFIED: 5/19/2021 6:46 PM Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning 24. An after-action review is an opportunity for everyone who was involved in planning for an incident or disaster to sit down and discuss what will happen when the plan is implemented. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Incident Response H2: Recovering from Incidents p. 196 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:48 PM DATE MODIFIED: 6/3/2021 3:40 PM 25. The organization must choose one of two philosophies that will affect its approach to IR and DR as well as subsequent involvement of digital forensics and law enforcement: the two approaches are protect and forget, and apprehend and prosecute. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Incident Response H2: Recovering from Incidents p. 199 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 6:50 PM DATE MODIFIED: 6/3/2021 3:40 PM 26. Forensics can provide a determination of the source or origin of an event, problem, or issue like an incident. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Digital Forensics p. 200 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/19/2021 6:53 PM Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE MODIFIED:

6/3/2021 3:41 PM

27. An attack, breach of policy, or other incident always constitutes a violation of law, requiring notification of law enforcement. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 28. Evidentiary material is any information that could potentially support an organization’s legal or policy-based case against a suspect. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/19/2021 6:55 PM DATE MODIFIED: 5/19/2021 6:55 PM 29. Root cause analysis is the coherent application of methodical investigatory techniques to present evidence of crimes in a court or similar setting. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE CREATED: DATE MODIFIED:

5/19/2021 6:56 PM 6/3/2021 3:41 PM

30. An affidavit is permission to search for evidentiary material at a specified location or to seize items to return to an investigator’s lab for examination. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Digital Forensics p. 201 H2: Affidavits and Search Warrants QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/19/2021 6:57 PM DATE MODIFIED: 6/3/2021 3:42 PM 31. An affidavit is a sworn testimony that certain facts are in the possession of an investigating officer and that they warrant the examination of specific items located at a specific place. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Digital Forensics p. 201 H2: Affidavits and Search Warrants QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/19/2021 7:00 PM DATE MODIFIED: 6/3/2021 3:42 PM 32. The chain of evidence is the detailed documentation of the collection, storage, transfer, and ownership of evidentiary material from the crime scene through its presentation in court and its eventual disposition. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Digital Forensics H2: Digital Forensics Methodology p. 204 QUESTION TYPE: True / False Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/19/2021 7:02 PM DATE MODIFIED: 5/19/2021 7:03 PM 33. A disaster recovery plan shows the organization’s intended efforts to establish operations at an alternate site in the aftermath of a disaster. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Disaster Recovery p. 206 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 6/3/2021 3:43 PM 34. Disaster classification is the process of examining an adverse event or incident and determining whether it constitutes an actual disaster. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Disaster Recovery p. 209 H2: Disaster Classification QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:05 PM DATE MODIFIED: 5/19/2021 7:07 PM 35. A rapid-onset disaster is one that gradually degrades the capacity of an organization to withstand their effects. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Disaster Recovery p. 209 H2: Disaster Classification Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:08 PM DATE MODIFIED: 6/3/2021 3:44 PM 36. A cold site provides many of the same services and options of a hot site, but at a lower cost. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 37. Using a service bureau is a BC strategy in which an organization contracts with a service agency to provide a facility for a fee. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:09 PM DATE MODIFIED: 5/19/2021 7:10 PM 38. Crisis response is an organization’s set of planning and preparation efforts for dealing with potential human injury, emotional trauma, or loss of life as a result of a disaster. a. True b. False ANSWER: False POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning REFERENCES:

H1: Crisis Management p. 217 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.4 - Define the components of crisis management DATE CREATED: 6/3/2021 5:25 PM DATE MODIFIED: 6/3/2021 5:28 PM Modified True / False 39. The business impact analysis is a preparatory activity common to both CP and risk management, ANSWER: True POINTS: 1 REFERENCES: p. 177 H1: Fundamentals Of Contingency Planning QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:42 PM DATE MODIFIED: 5/19/2021 7:43 PM 40. A(n) alarming event is an event with negative consequences that could threaten the organization’s information assets or operations._____ ANSWER: False - adverse POINTS: 1 REFERENCES: p. 177 H1: Fundamentals Of Contingency Planning QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 7:47 PM 41. The disaster recovery preparation team (DRPT) is the team responsible for designing and managing the DR plan by specifying the organization’s preparation, response, and recovery from disasters. _____ ANSWER: False - planning POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 179 QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:48 PM DATE MODIFIED: 6/3/2021 3:45 PM 42. A business policy is a task performed by an organization or one of its units in support of the organization’s overall mission and operations. _____ ANSWER: False - process POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 181 H2: Business Impact Analysis QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:51 PM DATE MODIFIED: 5/19/2021 7:53 PM 43. The work response time (WRT) is the amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered. _____ ANSWER: False - recovery POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 181 H2: Business Impact Analysis QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:55 PM DATE MODIFIED: 5/19/2021 7:56 PM 44. A(n) disaster is any adverse event that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization. _____ ANSWER: False - incident POINTS: 1 REFERENCES: p. 186 H1: Incident Response H2: Getting Started QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 7:46 PM 45. A(n) DR plan ensures that critical business functions continue if a catastrophic incident or disaster occurs. _____ False - business continuity (BC) ANSWER: False - business continuity False - BC POINTS: 1 REFERENCES: p. 212 H1: Business Continuity QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 7:46 PM 46. The recovery point objective (RPO) is the point in time prior to a disruption or system outage to which mission/business process data can be recovered after an outage. _____ ANSWER: True POINTS: 1 REFERENCES: p. 182 H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 7:46 PM 47. Prior to the development of each of the types of contingency planning documents, the CP team should work to develop the policy environment. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Contingency Planning Policies p. 185 QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:57 PM DATE MODIFIED: 6/3/2021 3:46 PM 48. The process of examining an incident candidate and determining whether it constitutes an actual incident is called incident classification. _____ ANSWER: True POINTS: 1 REFERENCES: p. 191 H1: Incident Response H2: Detecting Incidents QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 7:46 PM 49. Reported attacks are a definite indicator of an actual incident. _____ ANSWER: False - probable POINTS: 1 REFERENCES: H1: Incident Response H2: Detecting Incidents p. 192 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 8:00 PM DATE MODIFIED: 5/19/2021 8:01 PM 50. A(n) sequential roster is activated as the first person calls a few people on the roster, who in turn call a few other people. _____ ANSWER: False - hierarchical POINTS: 1 REFERENCES: p. 193 H1: Incident Response H2: Reacting To Incidents QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 7:46 PM 51. Incident detail assessment is used to determine the impact from a breach of confidentiality, integrity, and availability on information and information assets. _____ False - damage ANSWER: POINTS: 1 REFERENCES: H1: Incident Response H2: Recovering from Incidents p. 195 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 8:02 PM DATE MODIFIED: 5/19/2021 8:04 PM 52. The organization must choose one of two philosophies that will affect its approach to IR and DR as well as subsequent involvement of digital forensics and law enforcement: protect and forget or apprehend and prosecute _____ ANSWER: True POINTS: 1 REFERENCES: p. 199 H1: Incident Response H2: Recovering from Incidents QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 6/3/2021 3:49 PM 53. A service bureau is an agency that provides a service for a fee. _____ ANSWER: True POINTS: 1 REFERENCES: p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning

DATE CREATED: DATE MODIFIED:

disaster recovery, and business continuity 9/14/2016 10:38 AM 5/19/2021 7:46 PM

54. A(n) disaster recovery plan includes the steps necessary to ensure the continuation of the organization when a disaster’s scope or scale exceeds the ability of the organization to restore operations, usually through relocation of critical business functions to an alternate location. _____ False - business continuity (BC) ANSWER: False - business continuity False - BC POINTS: 1 REFERENCES: p. 212 H1: Business Continuity QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/19/2021 7:46 PM 55. An after-action re-assessment is an opportunity for everyone who was involved in an incident or disaster to sit down and discuss what happened. _____ ANSWER: False - review POINTS: 1 REFERENCES: H1: Incident Response H2: Recovering from Incidents p. 196 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 8:05 PM DATE MODIFIED: 5/19/2021 8:07 PM 56. A planning check is a testing strategy in which copies of the appropriate plans are distributed to all individuals who will be assigned roles during an actual incident or disaster. _____ ANSWER: False - desk POINTS: 1 REFERENCES: p. 217 H1: Crisis Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning LEARNING OBJECTIVES: POIS.WHMA.22.05.4 - Define the components of crisis management DATE CREATED: 6/3/2021 5:30 PM DATE MODIFIED: 6/3/2021 5:31 PM Multiple Choice 57. Which type of organizations should prepare for the unexpected? a. Organizations of every size and purpose should also prepare for the unexpected. b. Large organizations which have many assets at risk. c. Small organizations that can easily recover. d. Only those without good insurance. ANSWER: a POINTS: 1 REFERENCES: H1: Introduction To Incident Response And Contingency Planning p. 176 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.1 - Discuss the need for contingency planning DATE CREATED: 5/20/2021 10:44 AM DATE MODIFIED: 6/3/2021 3:50 PM 58. Ideally, the _____, systems administrators, the chief information security officer (CISO), and key IT and business managers should be actively involved during the creation and development of all CP components a. chief information officer (CIO) b. chief executive officer (CEO) c. chief financial officer (CFO) d. senior auditor ANSWER: a POINTS: 1 REFERENCES: p. 177 H1: Fundamentals Of Contingency Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/20/2021 10:41 AM DATE MODIFIED: 5/20/2021 10:43 AM 59. The CPMT should include a _____ who is a high-level manager to support, promote, and endorse the findings of the project and could be the COO or (ideally) the CEO/president. a. champion b. executive-in-charge c. project manager d. project instigator ANSWER: a POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 178 Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/20/2021 10:48 AM DATE MODIFIED: 5/20/2021 10:51 AM 60. Which if these is the primary reason contingency response teams should not have overlapping membership with one person on multiple teams? a. To spread the work out among b. So individuals don't find themselves with different responsibilities in more people. different locations at the same time. c. To allow people to specialize d. To avoid cross-division rivalries. in one area. ANSWER: b POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning p. 179 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/20/2021 10:53 AM DATE MODIFIED: 6/3/2021 3:50 PM 61. The CPMT conducts the BIA in three stages. Which of the following is NOT one of those stages? a. Determine mission/business processes and recovery b. Identify recovery priorities for system criticality resources c. Identify resource requirements d. All of these are BIA stages ANSWER: d POINTS: 1 REFERENCES: p. 181 H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/20/2021 10:38 AM 62. A fundamental difference between a BIA and risk management is that risk management focuses on identifying threats, vulnerabilities, and attacks to determine which controls can protect information, while the BIA assumes _____. a. controls have been bypassed b. controls have proven ineffective c. controls have failed d. All of the above ANSWER: d Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning POINTS: REFERENCES:

1 p. 181 H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 63. The point in time before a disruption or system outage to which business process data can be recovered after an outage is ____. a. recovery time objective (RTO) b. recovery point objective (RPO) c. work recovery time (WRT) d. maximum tolerable downtime (MTD) ANSWER: b POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 182 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/20/2021 5:56 PM DATE MODIFIED: 5/20/2021 5:57 PM 64. The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources is ____. a. recovery time objective (RTO) b. recovery point objective (RPO) c. work recovery time (WRT) d. maximum tolerable downtime (MTD) ANSWER: a POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 182 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE CREATED: DATE MODIFIED:

5/20/2021 5:58 PM 5/20/2021 5:59 PM

65. The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption is _____. a. recovery time objective (RTO) b. recovery point objective (RPO) c. work recovery time (WRT) d. maximum tolerable downtime (MTD) ANSWER: d POINTS: 1 REFERENCES: H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis p. 183 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/20/2021 5:53 PM DATE MODIFIED: 5/20/2021 5:57 PM 66. The transfer of large batches of data to an off-site facility, usually through leased lines or services, is called ____. a. off-site storage b. remote journaling c. electronic vaulting d. database shadowing ANSWER: c POINTS: 1 REFERENCES: p. 189 H1: Incident Response H2: Incident Response Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 67. Most common data backup schemes involve ______. a. RAID b. disk-to-disk-to-cloud c. neither RAID nor disk-to-disk-to-cloud d. both RAID and disk-to-disk-to-cloud ANSWER: d POINTS: 1 REFERENCES: H1: Incident Response Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning H2: Incident Response Policy p. 189 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/3/2020 6:52 PM DATE MODIFIED: 1/21/2023 4:35 PM 68. The transfer of transaction data in real time to an off-site facility is called ____. a. off-site storage b. remote journaling c. electronic vaulting d. database shadowing ANSWER: b POINTS: 1 REFERENCES: p. 189 H1: Incident Response H2: Incident Response Planning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 1/2/2017 2:36 PM DATE MODIFIED: 3/8/2017 6:39 PM 69. The storage of duplicate online transaction data, along with the duplication of the databases, at a remote site on a redundant server is called _____. a. application recovery b. electronic vaulting c. remote journaling d. database shadowing ANSWER: d POINTS: 1 REFERENCES: H1: Incident Response H2: Incident Response Planning p. 189 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/3/2020 7:13 PM DATE MODIFIED: 5/20/2021 10:25 AM 70. An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor with a ____ backup strategy. a. disk-to-disk-to-tape b. differential c. RAID d. disk-to-disk-to-cloud ANSWER: d Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning POINTS: REFERENCES:

1 H1: Incident Response H2: Incident Response Planning p. 189 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 5/20/2021 10:26 AM 71. ____ uses a number of hard drives to store information across multiple drive units. a. Legacy backup b. RAID c. Continuous database protection d. Virtualization ANSWER: b POINTS: 1 REFERENCES: H1: Incident Response H2: Incident Response Planning p. 189 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 5/20/2021 10:26 AM 72. The most common schedule for tape-based backup is a _____ backup, either incremental or differential, with a weekly off-site full backup. a. daily on-site b. hourly off-site c. 12-hour on-site d. daily off-site ANSWER: a POINTS: 1 REFERENCES: H1: Incident Response H2: Incident Response Planning p. 190 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/3/2020 7:04 PM DATE MODIFIED: 5/20/2021 10:22 AM 73. A(n) _____ is a document containing contact information for the people to be notified in the event of an incident. a. emergency notification system b. alert roster c. phone list d. call registry Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning ANSWER: POINTS: REFERENCES:

b 1 p. 193 H1: Incident Response H2: Reacting To Incidents QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 6/3/2021 3:54 PM 74. _____ is the rapid determination of the scope of the breach in the confidentiality, integrity, and availability of information and information assets during or just following an incident. a. Damage assessment b. Containment development c. Incident response d. Disaster assessment ANSWER: a POINTS: 1 REFERENCES: p. 195 H1: Incident Response H2: Recovering from Incidents QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:21 PM 75. Data backup should be based on a(n) ____ policy that specifies how long log data should be maintained. a. replication b. business resumption c. incident response d. retention ANSWER: d POINTS: 1 REFERENCES: H1: Incident Response H2: Recovering from Incidents p. 197 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 5/20/2021 10:23 AM 76. A crime involving digital media, computer technology, or related components may best be called an act of _____. a. computer theft Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning b. digital abuse c. computer trespass d. digital malfeasance ANSWER: POINTS: REFERENCES:

d 1 p. 200 H1: Digital Forensics QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/20/2021 6:05 PM DATE MODIFIED: 6/14/2021 5:28 PM 77. The sworn testimony that certain facts are in the possession of an investigating officer and that they warrant the examination of specific items located at a specific place is called a(n) _____. a. writ of habeus corpus b. search warrant c. sworn warrant d. affidavit ANSWER: d POINTS: 1 REFERENCES: H1: Digital Forensics p. 201 H2: Affidavits and Search Warrants QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/20/2021 6:08 PM DATE MODIFIED: 5/20/2021 6:09 PM 78. Digital forensics involves the _____, identification, extraction, documentation, and interpretation of digital media. a. investigation b. determination c. confiscation d. preservation ANSWER: d POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning

DATE CREATED: DATE MODIFIED:

investigations 5/20/2021 6:03 PM 6/3/2021 3:56 PM

79. The detailed documentation of the collection, storage, transfer, and ownership of evidentiary material from the crime scene through its presentation in court and its eventual disposition. is called a(n) _____. a. chain of evidence b. search warrant c. audit trail d. evidence affidavit ANSWER: a POINTS: 1 REFERENCES: H1: Digital Forensics H2: Digital Forensics Methodology p. 204 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/20/2021 6:11 PM DATE MODIFIED: 5/20/2021 6:12 PM 80. The process of examining an adverse event or incident and determining whether it constitutes an actual disaster is known as _____. a. disaster indication b. incident review c. disaster classification d. event escalation ANSWER: c POINTS: 1 REFERENCES: p. 209 H1: Disaster Recovery H2: Disaster Classification QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/20/2021 6:13 PM DATE MODIFIED: 5/20/2021 6:15 PM 81. A ____ site provides only rudimentary services and facilities. a. commercial b. warm c. hot d. cold ANSWER: d Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning POINTS: REFERENCES:

1 p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 9/14/2016 10:38 AM 82. A resumption location known as a ____ is a fully configured computer facility capable of establishing operations at a moment’s notice. a. mobile site b. cold site c. service bureau d. hot site ANSWER: d POINTS: 1 REFERENCES: 214 H1: Digital Forensics H2: Continuity Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 1/6/2021 3:00 PM 83. A potential disadvantage of a timeshare site-resumption strategy is: a. more than one organization might need the facility

b. more expensive than other options d. all of the above

c. requires additional investment in time and technology to get up to speed in the event of a disaster ANSWER: a POINTS: 1 REFERENCES: H1: Business Continuity H2: Continuity Strategies p. 214 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 6/3/2021 3:58 PM Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning 84. A ____ is an agency that provides physical facilities in the event of a disaster for a fee. a. time-share b. service bureau c. cold site d. mobile site ANSWER: b POINTS: 1 REFERENCES: H1: Business Continuity H2: Continuity Strategies p. 214 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 5/20/2021 10:33 AM 85. A ____ is a contractual document guaranteeing certain minimal levels of service provided by a vendor. a. memorandum of understanding b. mutual agreement c. service agreement d. time-share agreement ANSWER: c POINTS: 1 REFERENCES: H1: Business Continuity H2: Continuity Strategies p. 215 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 4/16/2020 9:59 AM DATE MODIFIED: 5/20/2021 10:35 AM 86. Each of the following is a role for the crisis management response team EXCEPT: a. Informing local emergency services to respond to the crisis b. Keeping the public informed about the event c. Communicating with major customers and other stakeholders d. Supporting personnel and their loved ones during the crisis ANSWER: a POINTS: 1 REFERENCES: p. 217 H1: Crisis Management QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.05.4 - Define the components of crisis management DATE CREATED: 6/3/2021 5:32 PM Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE MODIFIED:

6/3/2021 5:35 PM

Completion 87. The business _____ analysis is a preparatory activity common to both CP and risk management, impact ANSWER: POINTS: 1 REFERENCES: p. 177 H1: Fundamentals Of Contingency Planning QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/25/2021 8:09 PM DATE MODIFIED: 5/25/2021 8:10 PM 88. A business _____ is a task performed by an organization or one of its units in support of the organization’s overall mission and operations. process ANSWER: POINTS: 1 REFERENCES: p. 181 H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/25/2021 8:11 PM DATE MODIFIED: 5/25/2021 8:12 PM 89. The _____ recovery time is the amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered. work ANSWER: POINTS: 1 REFERENCES: p. 183 H1: Fundamentals Of Contingency Planning H2: Business Impact Analysis QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/25/2021 8:13 PM Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE MODIFIED:

6/3/2021 3:59 PM

90. Prior to the development of each of the types of contingency planning documents, the CP team should work to develop the corresponding _____ environment. policy ANSWER: POINTS: 1 REFERENCES: p. 185 H1: Fundamentals Of Contingency Planning H2: Contingency Planning Policies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/25/2021 8:15 PM DATE MODIFIED: 5/25/2021 8:16 PM 91. A(n) _____ is an adverse event that could result in loss of an information asset or assets, but does not currently threaten the viability of the entire organization. incident ANSWER: POINTS: 1 REFERENCES: p. 186 H1: Incident Response QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 92. Incident _____ is the set of activities taken to plan for, detect, and correct the impact of an incident on information assets. response ANSWER: POINTS: 1 REFERENCES: p. 186 H1: Incident Response QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning 93. The transfer of live transactions in real time to an off-site facility is called _____. remote journaling ANSWER: POINTS: 1 REFERENCES: p. 189 H1: Incident Response H2: Incident Response Planning QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 94. Incident _____ is the process of examining a potential incident, or incident candidate, and determining whether the candidate constitutes an actual incident. classification ANSWER: POINTS: 1 REFERENCES: p. 191 H1: Incident Response H2: Detecting Incidents QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 95. As they are a definite indicator of an incident, many organizations have policies that prohibit the installation of _____ tools without the written permission of the CISO. hacker ANSWER: hacking POINTS: 1 REFERENCES: p. 192 H1: Incident Response H2: Detecting Incidents QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 6/3/2021 4:00 PM Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning 96. A(n) _____ is a scripted description of an incident—usually just enough information so that each individual knows what portion of the IRP to implement, and not enough to slow down the notification process. alert message ANSWER: POINTS: 1 REFERENCES: p. 194 H1: Incident Response H2: Reacting to Incidents QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 97. Incident _____ assessment is used to determine the impact from a breach of confidentiality, integrity, and availability on information and information assets. damage ANSWER: POINTS: 1 REFERENCES: p. 195 H1: Incident Response H2: Recovering from Incidents QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/25/2021 8:18 PM DATE MODIFIED: 5/25/2021 8:18 PM 98. A(n) _____ is a detailed examination of the events that occurred during an incident or disaster, from first detection to final recovery. AAR ANSWER: after-action review AAR (after-action review) after-action review (AAR) POINTS: 1 REFERENCES: p. 196 H1: Incident Response H2: Recovering from Incidents QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE CREATED: DATE MODIFIED:

9/14/2016 10:38 AM 6/3/2021 4:01 PM

99. Digital _____ is the process of collecting, analyzing, and preserving computer-related evidence. forensics ANSWER: POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 5/19/2021 4:43 PM 100. Of the three types of mitigation plans, the _____ plan is the most strategic and long-term, as it focuses on the steps to ensure the continuation of the organization. BC ANSWER: Business Continuity BC (business continuity) business continuity (BC) POINTS: 1 REFERENCES: p. 212 H1: Business Continuity QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 5/19/2021 7:47 PM 101. A(n) _____ plan ensures that critical business functions continue if a catastrophic incident or disaster occurs. business continuity ANSWER: business continuity (BC) BC POINTS: 1 REFERENCES: p. 212 H1: Business Continuity QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning DATE CREATED: DATE MODIFIED:

9/14/2016 10:38 AM 4/17/2021 2:20 PM

102. A(n) _____ site is a fully configured computer facility with all services, communications links, and physical plant operations provided, including heating and air conditioning. hot ANSWER: POINTS: 1 REFERENCES: p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 103. A(n) _____ is a contract between two or more organizations that specifies how each will assist the other in the event of a disaster. mutual agreement ANSWER: POINTS: 1 REFERENCES: p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM 104. _____ management is an organization’s set of planning and preparation efforts for dealing with potential human injury, emotional trauma, or loss of life as a result of a disaster. Crisis ANSWER: POINTS: 1 REFERENCES: H1: Crisis Management p. 217 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.4 - Define the components of crisis management DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 4/17/2021 2:20 PM Copyright Cengage Learning. Powered by Cognero.

Page 36

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning 105. _____ material is any information that could potentially support an organization’s legal or policy-based case against a suspect. Evidentiary ANSWER: POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/25/2021 8:20 PM DATE MODIFIED: 5/25/2021 8:21 PM 106. Disaster _____ is the process of examining an adverse event or incident and determining whether it constitutes an actual disaster. classification ANSWER: POINTS: 1 REFERENCES: H1: Disaster Recovery H2: Disaster Classification p. 209 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/25/2021 8:22 PM DATE MODIFIED: 5/25/2021 8:22 PM 107. The CMPT should include individuals from all functional areas of the organization in order to _____ communications and cooperation. facilitate ANSWER: POINTS: 1 REFERENCES: p. 217 H1: Crisis Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.4 - Define the components of crisis management DATE CREATED: 6/3/2021 5:36 PM DATE MODIFIED: 6/3/2021 5:37 PM Essay Copyright Cengage Learning. Powered by Cognero.

Page 37

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning 108. Compare electronic vaulting and remote journaling. The transfer of large batches of data to an off-site facility is called electronic vaulting. The ANSWER: transfer of live transactions to an off-site facility is called remote journaling. It differs from electronic vaulting in that 1) only transactions are transferred, not archived data, and 2) the transfer is in real time. Electronic vaulting is much like a traditional backup, with a dump of data to the off-site storage, but remote journaling involves activities on a systems level, much like server fault tolerance, with the data written to two locations simultaneously. POINTS: 1 REFERENCES: p. 189 H1: Incident Response H2: Incident Response Planning QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 9/14/2016 10:38 AM DATE MODIFIED: 3/8/2017 6:46 PM 109. Summarize the strategies that can be chosen by an organization when planning for business continuity. The determining factor when selecting a strategy is usually cost. In general, ANSWER: organizations have three exclusive options: hot sites, warm sites, and cold sites. Options are also available for three shared functions: time-shares, service bureaus, and mutual agreements. POINTS: REFERENCES:

1 p. 214 H1: Business Continuity H2: Continuity Strategies QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 1/2/2017 3:33 PM DATE MODIFIED: 1/2/2017 3:35 PM Subjective Short Answer 110. Which two communities of interest are usually associated with contingency planning? Which community must give authority to ensure broad support for the plans? ANSWER:

POINTS:

Most often, the information technology and information security communities are involved in contingency planning. The general business community must give authority to ensure broad support for the plans. 1

Copyright Cengage Learning. Powered by Cognero.

Page 38

Name:

Class:

Date:

Mod 5 Incident Response and Contingency Planning REFERENCES:

p. 176 H1: Introduction To Incident Response And Contingency Planning QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.1 - Discuss the need for contingency planning DATE CREATED: 5/19/2021 7:13 PM DATE MODIFIED: 5/19/2021 7:15 PM 111. List and describe the criteria used to determine whether an actual incident is occurring. An actual incident is occurring if information assets are the targets of attack, if there is a ANSWER: good chance that the attack will succeed, and if the attack threatens the confidentiality, integrity, or availability of information resources. POINTS: 1 REFERENCES: p. 191 H1: Incident Response H2: Detecting Incidents QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.2 - Describe the major components of incident response, disaster recovery, and business continuity DATE CREATED: 5/19/2021 7:17 PM DATE MODIFIED: 5/19/2021 7:18 PM 112. When is digital forensics used in a business setting? ANSWER: Digital forensics is used in a business setting to investigate policy or legal violations by an employee, contractor, or outsider, and to investigate attacks on a physical asset or information asset. POINTS: 1 REFERENCES: p. 200 H1: Digital Forensics QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.05.3 - Identify the processes used in digital forensics investigations DATE CREATED: 5/19/2021 7:22 PM DATE MODIFIED: 5/19/2021 7:22 PM

Copyright Cengage Learning. Powered by Cognero.

Page 39

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security True / False 1. The key difference between laws and ethics is that ethics carry the authority of a governing body and laws do not. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security p. 224 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 2. A key difference between a policy and a law is that ignorance of a law is an acceptable defense. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security H2: Policy Versus Law p. 225 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 5:41 PM 3. For policy to become enforceable, it only needs to be distributed, read, understood, and agreed to. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security H2: Policy Versus Law p. 225 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:46 PM 4. Due care and due diligence require that an organization make a valid effort to protect others and continually maintain Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security this level of effort, ensuring these actions are effective. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security H2: Organizational Liability and the Need for Counsel p. 225 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 5. Criminal laws address activities and conduct harmful to society and are categorized as public law. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security H2: Types of Law p. 226 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 5:42 PM 6. The Computer Security Act of 1987, the cornerstone of many computer-related federal laws and enforcement effort, was originally written as an extension and clarification of the Comprehensive Crime Control Act of 1984. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: General Computer Crime Laws p. 226 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 5:43 PM Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security 7. In the context of information security, confidentiality is the right of individuals or groups to protect themselves and their information from unauthorized access. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: Privacy p. 227 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:47 PM 8. The FTC recommends that people place an initial fraud alert (among other things) when they suspect they are victims of identity theft. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 236 H1: Relevant U.S. Laws H2: Identity Theft QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 12/28/2016 3:05 PM DATE MODIFIED: 12/28/2016 3:06 PM 9. The Council of Europe Convention on Cybercrime has not been well received by advocates of intellectual property rights because it de-emphasizes prosecution for copyright infringement. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: International Laws And Legal Bodies H2: Council of Europe Convention on Cybercrime p. 241 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security

DATE CREATED: DATE MODIFIED:

for personnel management security 9/14/2016 10:35 AM 5/10/2021 7:39 PM

10. The United States has implemented a version of the DMCA law called the Database Right, in order to comply with Directive 95/46/EC. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 242 H1: International Laws And Legal Bodies H2: Digital Millennium Copyright Act QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations for personnel management security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 11. Studies on ethics and computer use reveal that people of different nationalities have different perspectives; difficulties arise when one nationality’s ethical behavior violates the ethics of another national group. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 243 H1: Ethics And Information Security H2: Ethical Differences Across Cultures QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 12. Cultural differences can make it difficult to determine what is ethical and not ethical between cultures, except when it comes to the use of computers, where ethics are considered universal. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 243 H1: Ethics And Information Security H2: Ethical Differences Across Cultures Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:50 PM 13. Unethical and illegal behavior is generally caused by ignorance (of policy and/or the law), by accident, and by inadequate protection mechanisms. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 246 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 14. Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 246 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 15. Laws, policies, and their associated penalties only provide deterrence if offenders fear the penalty, expect to be caught, and expect the penalty to be applied if they are caught. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security p. 247 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:50 PM 16. Employees are not deterred by the potential loss of certification or professional accreditation resulting from a breach of a code of conduct, because this loss has no effect on employees' marketability and earning power. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 247 H1: Codes Of Ethics Of Professional Organizations QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:51 PM 17. The Department of Homeland Security is the only U.S. federal agency charged with the protection of American information resources and the investigation of threats to, or attacks on, those resources. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Key U.S. Federal Agencies p. 249 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:51 PM 18. The Department of Homeland Security works with academic campuses nationally, focusing on resilience, recruitment, internationalization, growing academic maturity, and academic research. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 249 H1: Key U.S. Federal Agencies Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security H2: Department of Homeland Security QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:51 PM 19. The Secret Service is charged with safeguarding the nation’s financial infrastructure and payments systems to preserve the integrity of the economy. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 252 H1: Key U.S. Federal Agencies H2: U.S. Secret Service QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 20. Since it was established in January 2001, every FBI field office has started an InfraGard program to collaborate with public and private organizations and the academic community. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Key U.S. Federal Agencies H2: Federal Bureau of Investigation (FBI) p. 255 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:52 PM 21. The NSA is responsible for signal intelligence, information assurance products and services, and enabling computer network operations to gain a decision advantage for the United States and its allies. a. True b. False ANSWER: True Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security POINTS: REFERENCES:

1 p. 255 H1: Key U.S. Federal Agencies H2: National Security Agency (NSA) QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:06 PM Modified True / False 22. Ethics are the moral attitudes or customs of a particular group. _____ ANSWER: False - Cultural mores False - Mores POINTS: 1 REFERENCES: p. 224 H1: Introduction To Law And Ethics In Information Security QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:07 PM 23. Civil law addresses activities and conduct harmful to society and is actively enforced by the state. _____ ANSWER: False - Criminal POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security H2: Types of Law p. 226 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 24. Privacy is the right of individuals or groups to protect themselves and their information from unauthorized access, providing confidentiality._____ ANSWER: True POINTS: 1 REFERENCES: p. 227 H1: Relevant U.S. Laws Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security H2: Privacy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 25. Information denigration refers to pieces of nonprivate data that, when combined, may create information that violates privacy. _____ ANSWER: False - aggregation POINTS: 1 REFERENCES: p. 228 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 5/25/2021 8:33 PM DATE MODIFIED: 5/25/2021 8:35 PM 26. The Economic Espionage Act of 1996 protects American ingenuity, intellectual property, and competitive advantage. _____ ANSWER: True POINTS: 1 REFERENCES: p. 236 H1: Relevant U.S. Laws H2: Export and Espionage Laws QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 27. Intellectual privacy is recognized as a protected asset in the United States. _____ False - property ANSWER: POINTS: 1 REFERENCES: p. 237 H1: Relevant U.S. Laws H2: U.S. Copyright Law Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 28. The Graham-Leach-Bliley Act is a critical piece of legislation that affects the executive management of publicly traded corporations and public accounting firms. _____ ANSWER: False - Sarbanes-Oxley False - Public Company Accounting Reform and Investor Protection False - SOX POINTS: 1 REFERENCES: p. 237 H1: Relevant U.S. Laws H2: Financial Reporting QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:07 PM 29. The Digital Millennium Copyright Act is the American law created in response to Directive 95/46/EC, adopted in 1995 by the European Union. _____ ANSWER: True POINTS: 1 REFERENCES: p. 241 H1: International Laws And Legal Bodies H2: Digital Millennium Copyright Act QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations for personnel management security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 30. In a study on software license infringement, licenses from the United States were significantly more permissive than those from the Netherlands and other countries. _____ False - less ANSWER: POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security REFERENCES:

p. 244 H1: Ethics And Information Security H2: Ethical Differences Across Cultures QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 31. Laws, policies, and their associated penalties only provide deterrence if, among other things, potential offenders fear the probability of a penalty being applied. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior p. 247 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 32. The code of ethics put forth by (ISC)2 focuses on four mandatory canons: “Protect society, the commonwealth, and the infrastructure; act honorably, honestly, justly, responsibly, and legally; provide diligent and competent service to principals; and advance and protect the profession.” _____ ANSWER: True POINTS: 1 REFERENCES: p. 248 H1: Codes Of Ethics Of Professional Organizations H2: Major IT and InfoSec Professional Organizations QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:08 PM 33. The Department of Homeland Security was created in 2003 by the 9/11 Memorial Act of 2002. _____ ANSWER: False - Homeland Security POINTS: 1 REFERENCES: p. 249 H1: Key U.S. Federal Agencies H2: Department of Homeland Security Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 34. The U.S. Secret Service is currently within the Department of the Treasury. _____ ANSWER: False - Homeland Security POINTS: 1 REFERENCES: p. 252 H1: Key U.S. Federal Agencies H2: U.S. Secret Service QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 35. The communications networks of the United States carry(ies) more funds than all of the armored cars in the world combined. _____ ANSWER: True POINTS: 1 REFERENCES: p. 252 H1: Key U.S. Federal Agencies H2: U.S. Secret Service QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 36. The Federal Bureau of Investigation’s National InfraGard Program serves its members in four basic ways: Maintains an intrusion alert network using encrypted e-mail; maintains a secure Web site for communication about suspicious activity or intrusions; sponsors local chapter activities; and operates a help desk for questions. _____ ANSWER: True POINTS: 1 REFERENCES: p. 255 H1: Key U.S. Federal Agencies H2: Federal Bureau of Investigation (FBI) Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.5 - Explain the roles of some U.S. law enforcement agencies with an interest in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:50 PM 37. The Health Insurance Portability and Accountability Act of 1996 (HIPAA), also known as the Kennedy– Kassebaum Act, protects the confidentiality and security of healthcare data. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: Privacy p. 229 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 5/25/2021 8:37 PM DATE MODIFIED: 6/21/2021 6:09 PM Multiple Choice 38. _____ law comprises a wide variety of laws pertaining to relationships among individuals and organizations. a. Criminal b. Civil c. Statutory d. Constitutional ANSWER: b POINTS: 1 REFERENCES: p. 226 H1: Introduction To Law And Ethics In Information Security H2: Types of Law QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:10 PM 39. _____ law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments. a. Public b. Private c. Civil d. Criminal ANSWER: a Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security POINTS: REFERENCES:

1 p. 226 H1: Introduction To Law And Ethics In Information Security H2: Types of Law QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 40. The Computer _____ and Abuse Act of 1986 is the cornerstone of many computer-related federal laws and enforcement efforts. a. Violence b. Fraud c. Theft d. Usage ANSWER: b POINTS: 1 REFERENCES: p. 226 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 41. According to the National Information Infrastructure Protection Act of 1996, the severity of the penalty for computer crimes depends on the value of the information obtained and whether the offense is judged to have been committed for each of the following except _____. a. for purposes of commercial advantage b. for private financial gain c. to harass d. in furtherance of a criminal act ANSWER: c POINTS: 1 REFERENCES: p. 226 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 42. The _____ defines stiffer penalties for prosecution of terrorism-related activities. Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security a. USA PATRIOT Act b. Sarbanes-Oxley Act c. Gramm-Leach-Bliley Act d. Economic Espionage Act ANSWER: a POINTS: 1 REFERENCES: p. 226 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:11 PM 43. The National Information Infrastructure Protection Act of 1996 modified which act? a. USA PATRIOT Act b. USA PATRIOT Improvement and Reauthorization Act c. Computer Security Act d. Computer Fraud and Abuse Act ANSWER: d POINTS: 1 REFERENCES: p. 226 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:57 PM 44. Which of the following acts defines and formalizes laws to counter threats from computer-related acts and offenses? a. Electronic Communications Privacy Act of 1986 b. Freedom of Information Act (FOIA) of 1966 c. Computer Fraud and Abuse Act of 1986 d. All of the other answers are correct ANSWER: c POINTS: 1 REFERENCES: p. 226 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security

DATE CREATED: DATE MODIFIED:

organizations of importance to information security 9/14/2016 10:35 AM 6/21/2021 6:17 PM

45. In 2002, Congress passed the Federal Information Security Management Act (FISMA), which mandates that all federal agencies _____. a. provide security awareness training b. periodic assessment of risk c. develop policies and procedures based on risk assessments d. all of the other answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 227 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 12/28/2016 2:59 PM DATE MODIFIED: 6/21/2021 6:14 PM 46. What is the subject of the Computer Security Act of 1987? a. Federal agency information security b. Telecommunications common carriers c. Cryptography software vendors d. All of the other answers are correct ANSWER: a POINTS: 1 REFERENCES: p. 227 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:15 PM 47. The Privacy of Customer Information Section of the common carrier regulation states that any proprietary information shall be used explicitly for providing services, and not for any _____ purposes. a. troubleshooting b. billing c. customer service d. marketing ANSWER: d Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security POINTS: REFERENCES:

1 p. 228 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 48. The Health Insurance Portability and Accountability Act of 1996, also known as the _____ Act, protects the confidentiality and security of health-care data by establishing and enforcing standards and by standardizing electronic data interchange. a. Gramm-Leach-Bliley b. Kennedy-Kessebaum c. Privacy d. HITECH ANSWER: b POINTS: 1 REFERENCES: p. 229 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 49. Which of the following acts is a collection of statutes that regulate the interception of wire, electronic, and oral communications? a. Electronic Communications Privacy Act b. Financial Services Modernization Act c. Sarbanes-Oxley Act d. Economic Espionage Act ANSWER: a POINTS: 1 REFERENCES: p. 229 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:58 PM Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security 50. Which of the following acts is also widely known as the Gramm-Leach-Bliley Act? a. Financial Services Modernization Act b. Communications Act c. Computer Security Act d. Health Insurance Portability and Accountability Act ANSWER: a POINTS: 1 REFERENCES: p. 230 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 51. Information about a person’s history, background, and attributes that can be used to commit identity theft is known as _____ information. a. virtually interpreted b. privately held c. personally identifiable d. identity defined ANSWER: c POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: Identity Theft p. 234 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 5/25/2021 8:41 PM DATE MODIFIED: 5/25/2021 8:43 PM 52. The unauthorized taking of person information with the intent of committing fraud and abuse of a person’s financial and personal reputation, purchasing goods and services without authorization, and generally impersonating the victim for illegal or unethical purposes.is known as _____. a. non-criminal fraud b. ransoming c. identity theft d. identity extortion ANSWER: c Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security POINTS: REFERENCES:

1 H1: Relevant U.S. Laws H2: Identity Theft p. 234 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 5/25/2021 8:45 PM DATE MODIFIED: 5/25/2021 8:47 PM 53. The _____ attempts to prevent trade secrets from being illegally shared. a. Electronic Communications Privacy Act b. Sarbanes-Oxley Act c. Financial Services Modernization Act d. Economic Espionage Act ANSWER: d POINTS: 1 REFERENCES: p. 236 H1: Relevant U.S. Laws H2: Export and Espionage Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 54. The _____ of 1999 provides guidance on the use of encryption and provides protection from government intervention. a. Prepper Act b. Economic Espionage Act c. USA PATRIOT Act d. Security and Freedom through Encryption Act ANSWER: d POINTS: 1 REFERENCES: p. 236 H1: Relevant U.S. Laws H2: Export and Espionage Laws QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security 55. _____ use allows copyrighted materials to be used to support news reporting, teaching, scholarship, and similar activities, if the use is for educational or library purposes, is not for profit, and is not excessive. a. Justified b. Fair c. Personal d. Limited ANSWER: b POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: U.S. Copyright Law p. 237 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 5/25/2021 8:49 PM DATE MODIFIED: 6/21/2021 6:18 PM 56. What is the subject of the Sarbanes-Oxley Act? a. Banking b. Financial reporting c. Privacy d. Trade secrets ANSWER: b POINTS: 1 REFERENCES: p. 237 H1: Relevant U.S. Laws H2: Financial Reporting QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 5:59 PM 57. Payment Card Industry _____ Standards are designed to enhance the security of customers’ payment card account data. a. Data Safety b. Data Security c. Data Practices d. Account Security ANSWER: b POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: Payment Card Industry Data Security Standards (PCI DSS) p. 238 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security

DATE CREATED: DATE MODIFIED:

organizations of importance to information security 5/25/2021 8:52 PM 6/21/2021 6:18 PM

58. In 2001, the Council of Europe drafted the European Council Cybercrime Convention, which empowers an international task force to oversee a range of security functions associated with _____ activities. a. online terrorist b. electronic commerce c. cyberactivist d. Internet ANSWER: d POINTS: 1 REFERENCES: p. 240 H1: International Laws And Legal Bodies H2: Council of Europe Convention on Cybercrime QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations for personnel management security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:19 PM 59. The Digital _____ Copyright Act is the American contribution to an international effort by the World Intellectual Properties Organization (WIPO) to reduce the impact of copyright, trademark, and privacy infringement. a. Management b. Master c. Information d. Millennium ANSWER: d POINTS: 1 REFERENCES: H1: International Laws And Legal Bodies H2: Digital Millennium Copyright Act p. 241 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations for personnel management security DATE CREATED: 5/25/2021 8:57 PM DATE MODIFIED: 5/25/2021 8:58 PM 60. In the 1999 study of computer use-ethics, which of the following countries reported the least tolerant attitudes toward misuse of organizational computing resources? a. Australia b. United States c. Singapore d. Sweden ANSWER: c POINTS: 1 REFERENCES: p. 244 Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security H1: Ethics And Information Security H2: Ethical Differences Across Cultures QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:20 PM 61. Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage _____. a. with intent b. by accident and/or through unintentional negligence c. with malice d. none of the other answers are correct ANSWER: b POINTS: 1 REFERENCES: p. 246 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:21 PM 62. There are three general causes of unethical and illegal behavior: _____, Accident, and Intent. a. Curiosity b. Ignorance c. Revenge d. None of the other answers are correct ANSWER: b POINTS: 1 REFERENCES: p. 246 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 5/25/2021 9:00 PM DATE MODIFIED: 6/21/2021 6:22 PM 63. Criminal or unethical _____ goes to the state of mind of the individual performing the act. a. ignorance b. intent c. accident d. all of the other answers are correct ANSWER: b POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security REFERENCES:

p. 246 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:23 PM 64. Laws, policies, and their associated penalties only provide deterrence if which of the following conditions is present? a. Fear of penalty b. Probability of being caught c. Probability of penalty being administered d. All of the other answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 247 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:24 PM 65. _____ is a professional association that focuses on auditing, control, and security. The membership comprises both technical and managerial professionals. a. ISACA b. Information Systems Security Association (ISSA) c. EC-Council d. SANS ANSWER: a POINTS: 1 REFERENCES: p. 249 H1: Codes Of Ethics Of Professional Organizations H2: Major IT and InfoSec Professional Organizations QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 5/25/2021 9:06 PM DATE MODIFIED: 5/25/2021 9:09 PM 66. The _____ is a respected professional society that was established in 1947. Today it is “the world’s largest educational and scientific computing society. a. Association for Computing Machinery b. Information Systems Security Association (ISSA) Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security c. International Information Systems Security Certification d. EC-Council Consortium, Inc. ANSWER: a POINTS: 1 REFERENCES: H1: Codes Of Ethics Of Professional Organizations H2: Major IT and InfoSec Professional Organizations p. 248 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 5/25/2021 9:03 PM DATE MODIFIED: 5/25/2021 9:04 PM Completion 67. _____ are rules that mandate or prohibit certain behavior and are enforced by the government. Laws ANSWER: POINTS: 1 REFERENCES: p. 224 H1: Introduction To Law And Ethics In Information Security QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 68. _____ are the fixed moral attitudes or customs of a particular group. Cultural mores ANSWER: Mores POINTS: 1 REFERENCES: H1: Introduction To Law And Ethics In Information Security p. 224 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:25 PM 69. _____ is the legal obligation of an entity that extends beyond criminal or contract law. Liability ANSWER: POINTS: 1 REFERENCES: p. 224 Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security H1: Introduction To Law And Ethics In Information Security H2: Organizational Liability and the Need for Counsel QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 70. “Long arm _____” refers to the long arm of the law reaching across the country or around the world to draw an accused individual into its court systems whenever it can establish jurisdiction. jurisdiction ANSWER: POINTS: 1 REFERENCES: p. 225 H1: Introduction To Law And Ethics In Information Security H2: Organizational Liability and the Need for Counsel QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 71. Managerial statements that dictate certain behavior within an organization are known as _____. policies ANSWER: POINTS: 1 REFERENCES: p. 225 H1: Introduction To Law And Ethics In Information Security H2: Policy Versus Law QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:26 PM 72. Family law, commercial law, and labor law are all encompassed by _____ law. private ANSWER: POINTS: 1 REFERENCES: p. 226 H1: Introduction To Law And Ethics In Information Security H2: Types of Law Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 73. The _____ Act of 2001 provides law enforcement agencies with broader latitude in order to combat terrorism-related activities. U.S.A. PATRIOT ANSWER: USA PATRIOT POINTS: 1 REFERENCES: p. 226 H1: Relevant U.S. Laws H2: General Computer Crime Laws QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 74. _____ information is a form of collective data that relates to a group or category of people and that has been altered to remove characteristics or components that make it possible to identify individuals within the group. Aggregate ANSWER: POINTS: 1 REFERENCES: p. 228 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:25 PM 75. The _____ Act of 1986 is a collection of statutes that regulates the interception of wire, electronic, and oral communications. Electronic Communications Privacy ANSWER: POINTS: 1 REFERENCES: H1: Relevant U.S. Laws H2: Privacy Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security p. 229 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 76. The _____ Act of 1999 contains a number of provisions focusing on facilitating affiliation among banks, securities firms, and insurance companies. Financial Services Modernization ANSWER: Gramm-Leach-Bliley GLB POINTS: 1 REFERENCES: p. 230 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 77. _____ theft is the unauthorized taking of personal information with the intent of committing fraud or another illegal or unethical purpose. Identity ANSWER: ID POINTS: 1 REFERENCES: p. 234 H1: Relevant U.S. Laws H2: Identity Theft QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 12/28/2016 3:03 PM DATE MODIFIED: 6/21/2021 6:27 PM 78. The _____ Act of 1996 attempts to prevent trade secrets from being illegally shared. Economic Espionage ANSWER: POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security REFERENCES:

p. 236 H1: Relevant U.S. Laws H2: Export and Espionage Laws QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 79. The _____ Act seeks to improve the reliability and accuracy of financial reporting, as well as increase the accountability of corporate governance, in publicly traded companies. Sarbanes-Oxley ANSWER: Sarbanes Oxley Corporate and Auditing Accountability and Responsibility SOX POINTS: 1 REFERENCES: p. 237 H1: Relevant U.S. Laws H2: Financial Reporting QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:28 PM 80. The _____ of 1966 allows any person to request access to federal agency records or information not determined to be a matter of national security. Freedom of Information Act ANSWER: FOIA POINTS: 1 REFERENCES: p. 238 H1: Relevant U.S. Laws H2: Freedom of Information Act of 1966 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:28 PM 81. The _____ Card Industry Data Security Standards are designed to enhance the security of customers’ account data. Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security ANSWER: POINTS: REFERENCES:

Payment 1 p. 238 H1: Relevant U.S. Laws H2: Payment Card Industry Data Security Standards (PCI DSS) QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 12/28/2016 3:08 PM DATE MODIFIED: 6/21/2021 6:29 PM 82. The _____ is the American contribution to an international effort to reduce the impact of copyright, trademark, and privacy infringement, especially when accomplished via the removal of technological copyright protection measures. Digital Millennium Copyright Act (DMCA) ANSWER: Digital Millennium Copyright Act DMCA POINTS: 1 REFERENCES: p. 241 H1: International Laws And Legal Bodies H2: Digital Millennium Copyright Act QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations for personnel management security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 83. Software license infringement is also often called software _____. piracy ANSWER: POINTS: 1 REFERENCES: p. 244 H1: Ethics And Information Security H2: Ethical Differences Across Cultures QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 84. According to the 1999 international study of computer-use ethics, many people from many cultural backgrounds Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security indicated that unless an organization explicitly forbids _____ use of its computing resources, such use is acceptable personal ANSWER: POINTS: 1 REFERENCES: p. 244 H1: Ethics And Information Security H2: Ethical Differences Across Cultures QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 6/21/2021 6:32 PM 85. Key studies reveal that the overriding factor in leveling the ethical perceptions within a small population is _____. education ANSWER: POINTS: 1 REFERENCES: p. 244 H1: Ethics And Information Security H2: Ethics and Education QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 86. The _____ is a respected professional society that was established in 1947 as “the world’s first educational and scientific computing society.” Association of Computing Machinery ANSWER: ACM POINTS: 1 REFERENCES: H1: Codes Of Ethics Of Professional Organizations H2: Major IT and InfoSec Professional Organizations p. 248 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 87. The _____ is a nonprofit organization that focuses on the development and implementation of information security certifications and credentials. International Information Systems Security Certification Consortium, Inc. (ISC)2 ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security International Information Systems Security Certification Consortium, Inc. (ISC)2 International Information Systems Security Certification Consortium, Inc. (ISC)2 (ISC)2 ISC2

POINTS: 1 REFERENCES: p. 248 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM 88. The _____ is a professional association that focuses on auditing, control, and security and whose membership comprises both technical and managerial professionals. Information Systems Audit and Control Association (ISACA) ANSWER: Information Systems Audit and Control Association ISACA POINTS: 1 REFERENCES: p. 249 H1: Codes Of Ethics Of Professional Organizations H2: Major IT and InfoSec Professional Organizations QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 5/11/2021 6:49 PM Essay 89. What are the requirements for a policy to become enforceable? For a policy to become enforceable, it must have: ANSWER: Dissemination (distribution) - The organization must be able to demonstrate that the relevant policy has been made readily available for review by the employee. Review (reading) - The organization must be able to demonstrate that it disseminated the document in an intelligible form, including versions for illiterate, non-English reading, and reading-impaired employees. Comprehension (understanding) - The organization must be able to demonstrate that the employee understood the requirements and content of the policy. Compliance (agreement) - The organization must be able to demonstrate that the employee Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security agrees to comply with the policy, through act or affirmation. Uniform enforcement - The organization must be able to demonstrate that the policy has been uniformly enforced, regardless of employee status or assignment. POINTS: 1 REFERENCES: p. 225 H1: Introduction To Law And Ethics In Information Security H2: Policy Versus Law QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 3/8/2017 6:05 PM 90. List the five fundamental principles of HIPAA. 1. Consumer control of medical information ANSWER: 2. Boundaries on the use of medical information 3. Accountability for the privacy of private information 4. Balance of public responsibility for the use of medical information for the greater good measured against impact to the individual 5. Security of health information POINTS: 1 REFERENCES: p. 229 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM 91. What are the provisions of the Digital Millennium Copyright Act (DMCA)? The DMCA includes the following provisions: ANSWER: • • •

Prohibits the circumvention of protections and countermeasures implemented by copyright owners to control access to protected content Prohibits the manufacture of devices to circumvent protections and countermeasures that control access to protected content Bans trafficking in devices manufactured to circumvent protections and countermeasures that control access to protected content

Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security • •

Prohibits the altering of information attached or embedded into copyrighted material Excludes Internet service providers from certain forms of contributory copyright infringement

POINTS: REFERENCES:

1 p. 242 H1: International Laws And Legal Bodies H2: Digital Millennium Copyright Act QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.3 - Identify major national and international laws that affect the practice of information Identify special security controls and privacy considerations for personnel management security DATE CREATED: 12/28/2016 3:10 PM DATE MODIFIED: 12/28/2016 3:11 PM 92. Laws, policies, and their associated penalties only provide deterrence if three conditions are present. List and describe them. Fear of penalty: Potential offenders must fear the penalty. ANSWER: Probability of being apprehended: Potential offenders must believe there is a strong possibility of being caught. Probability of penalty being applied: Potential offenders must believe that the penalty will be administered. POINTS: 1 REFERENCES: p. 247 H1: Ethics And Information Security H2: Deterring Unethical and Illegal Behavior QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 9/14/2016 10:35 AM DATE MODIFIED: 9/14/2016 10:35 AM Subjective Short Answer 93. What is civil law, and what does it accomplish? ANSWER: Civil law represents a wide variety of laws that govern a nation or state and deal with the relationships and conflicts between organizations and people. Civil law encompasses family law, commercial law, and labor law. POINTS: REFERENCES:

1 p. 226

Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security H1: Introduction to Law And Ethics In Information Security H2: Types of Law QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.2 - Describe the relevant laws, regulations, and professional organizations of importance to information security DATE CREATED: 5/25/2021 9:16 PM DATE MODIFIED: 5/25/2021 9:16 PM 94. If you work for a financial services organization such as a bank or credit union, which 1999 law affects your use of customer data? What other effects does it have? ANSWER: The law that affects the use of customer data by financial institutions is the Financial Services Modernization Act or Gramm-Leach-Bliley Act of 1999. Specifically, this act requires all financial institutions to disclose their privacy policies on the sharing of nonpublic personal information. It also requires due notice to customers so they can request that their information not be shared with third parties. In addition, the act ensures that an organization’s privacy policies are fully disclosed when a customer initiates a business relationship and then distributed at least annually for the duration of the professional association. POINTS: REFERENCES:

1 p. 230 H1: Relevant U.S. Laws H2: Privacy QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.4 - Discuss the role of privacy as it applies to law and ethics in information security DATE CREATED: 5/25/2021 9:19 PM DATE MODIFIED: 5/25/2021 9:19 PM 95. What is the difference between law and ethics? ANSWER: Laws are rules that mandate or prohibit certain behavior in society; they are drawn from ethics, which define socially acceptable behavior. The key difference between laws and ethics is that laws carry the sanctions of a governing authority and ethics do not. Ethics are based on cultural mores: the fixed moral attitudes or customs of a particular group. POINTS: REFERENCES: QUESTION TYPE: HAS VARIABLES:

1 p. 242 H1: Ethics and Information Security Subjective Short Answer False

Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 6 Legal, Ethical, and Professional Issues in Information Security STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.06.1 - Explain the differences between laws and ethics DATE CREATED: 5/25/2021 9:13 PM DATE MODIFIED: 5/25/2021 9:13 PM

Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 7 Security and Personnel True / False 1. The general management community of interest must work with information security professionals to integrate solid information security concepts into the personnel management practices of the organization. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction To Security And Personnel p. 262 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 3/10/2017 9:58 AM 2. The information security function cannot be placed within physical security, as a peer of physical security or protective services. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Positioning The Security Function p. 263 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.1 - Describe where and how the information security function should be positioned within organizations DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:12 AM 3. In many organizations, information security teams lack established roles and responsibilities. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 266 H1: Staffing The Information Security Function H2: Qualifications and Requirements QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 7 Security and Personnel DATE MODIFIED:

3/10/2017 9:59 AM

4. In many cases, organizations look for a technically qualified information security generalist who has a solid understanding of how an organization operates. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 266 H1: Staffing The Information Security Function H2: Qualifications and Requirements QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:12 AM 5. The use of standardized job descriptions can increase the degree of professionalism in the information security field. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:23 AM 6. "Builders" in the field of information security provide day-to-day systems monitoring and are used to support an organization’s goals and objectives. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 268 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 7 Security and Personnel

DATE CREATED: DATE MODIFIED:

information security function 9/14/2016 10:49 AM 6/23/2021 11:24 AM

7. The security manager position is much more general than that of the CISO. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Staffing The Information Security Function H2: Information Security Positions p. 271 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 3/10/2017 9:59 AM 8. Security administrators provide day-to-day systems monitoring to support an organization’s goals and objectives. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Staffing The Information Security Function H2: Information Security Positions p. 268 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:24 AM 9. The position of security analyst can be an entry-level position. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 272 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 7 Security and Personnel LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:24 AM 10. Existing information security-related certifications are typically well understood by those responsible for hiring in organizations. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 273 H1: Credentials For Information Security Professionals QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 3/10/2017 9:59 AM 11. The (ISC)2 CISSP concentrations are available for currently certified CISSP professionals to demonstrate knowledge that is part of the CISSP common body of knowledge. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 273 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:27 AM 12. The (ISC)2 CISSP-ISSEP concentrationfocuses on the knowledge area including systems lifecycle management, threat intelligence and incident managements. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications p. 274 Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 7 Security and Personnel QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:28 AM 13. The SSCP examination is much more rigorous than the CISSP examination. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 274 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 3/10/2017 9:59 AM 14. CompTIA offers a vendor-specific certification program called the Security+ certification. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 280 H1: Credentials For Information Security Professionals H2: CompTIA Certifications QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 9/14/2016 10:49 AM 15. The advice "Know more than you say, and be more skillful than you let on" for information security professionals indicates that an information security professional should avoid speaking to users in technical jargon. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 283 Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 7 Security and Personnel H1: Credentials For Information Security Professionals H2: Advice for Information Security Professionals QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:29 AM 16. The process of integrating information security perspectives into the hiring process includes with reviewing and updating all job descriptions. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Employment Policies And Practices H2: Job Descriptions p. 284 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:29 AM 17. A background check must always be conducted to determine the level of trust the business can place in a candidate for an information security position. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 284 H1: Employment Policies And Practices H2: Background Check QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/15/2021 5:41 PM 18. An organization should integrate security awareness education into a new hire’s ongoing job orientation and make it a part of every employee’s on-the-job security training. a. True b. False Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 7 Security and Personnel ANSWER: POINTS: REFERENCES:

True 1 p. 285 H1: Employment Policies And Practices H2: On-the-Job Security Training QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 3/10/2017 10:01 AM 19. To maintain a secure facility, all contract employees should be escorted from room to room, as well as into and out of the facility. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Employment Policies And Practices H2: Security Considerations for Temporary Employees, Consultants, and Other Workers p. 290 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 9/14/2016 10:49 AM 20. Organizations are not required by law to protect employee information that is sensitive or personal. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Personnel Control Strategies H2: Privacy and the Security of Personnel Data p. 289 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 9/14/2016 10:49 AM Modified True / False Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 7 Security and Personnel 21. The general management community of interest must plan for the proper staffing of the information security function. _____ ANSWER: False - information security POINTS: 1 REFERENCES: p. 262 H1: Introduction To Security And Personnel QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM 22. Upper management should learn more about the budgetary needs of the information security function and the positions within it. _____ ANSWER: True POINTS: 1 REFERENCES: p. 266 H1: Staffing The Information Security Function H2: Qualifications and Requirements QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:54 AM 23. Many hiring managers in information security prefer to recruit a security professional who already has proven HR skills and professional experience, since qualified candidates with information security experience are scarce. _____ False - IT ANSWER: POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Entry into the Information Security Profession QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 7 Security and Personnel 24. "Administrators" provide the policies, guidelines, and standards in the Schwartz classification. _____ ANSWER: False - Definers POINTS: 1 REFERENCES: p. 268 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:55 AM 25. Security managers accomplish objectives identified by the CISO and resolve issues identified by technicians. _____ ANSWER: True POINTS: 1 REFERENCES: p. 271 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM 26. The most common credential for a CISO-level position is the Security+ certification. _____ False - CISM ANSWER: False - Certified Information Security Manager POINTS: 1 REFERENCES: H1: Staffing The Information Security Function H2: Staffing The Information Security Function p. 268 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/15/2021 5:44 PM 27. ISSEP stands for Information Systems Security Experienced Professional. _____ ANSWER: False - Engineering Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 7 Security and Personnel POINTS: REFERENCES:

1 p. 274 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM 28. ISSAP stands for Information Systems Security Architecture Professional. _____ ANSWER: True POINTS: 1 REFERENCES: p. 274 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM 29. ISSMP stands for Information Systems Security Monitoring Professional. _____ ANSWER: False - Management POINTS: 1 REFERENCES: p. 274 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM 30. The CISA credential is geared toward experienced information security managers and others who may have similar management responsibilities. _____ ANSWER: False - CISM POINTS: 1 REFERENCES: p. 276 Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 7 Security and Personnel H1: Credentials For Information Security Professionals H2: ISACA Certifications QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 5/26/2021 10:42 AM 31. ISACA promotes the CISA certification as being appropriate for accounting, networking, and security professionals. _____ ANSWER: False - auditing POINTS: 1 REFERENCES: p. 276 H1: Credentials For Information Security Professionals H2: ISACA Certifications QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/23/2021 11:56 AM 32. GIAC stands for Global Information Architecture Certification. _____ ANSWER: False - Assurance POINTS: 1 REFERENCES: p. 277 H1: Credentials For Information Security Professionals H2: SANS Certifications QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 33. Friendly departures include termination for cause, permanent downsizing, temporary lay-off, or some instances of quitting. _____ ANSWER: False - Hostile POINTS: 1 REFERENCES: p. 286 H1: Employment Policies And Practices Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 7 Security and Personnel H2: Termination QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 34. Mandatory training provides the organization with the ability to audit the work of an individual. _____ ANSWER: False - vacation POINTS: 1 REFERENCES: p. 288 H1: Personnel Control Strategies QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 11:57 AM 35. In many organizations, information security teams lack established _____ and responsibilities. _____ ANSWER: False - roles POINTS: 1 REFERENCES: p. 266 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:30 PM DATE MODIFIED: 5/26/2021 2:31 PM 36. Security administrators are accountable to provide day-to-day systems monitoring to support an organization’s goals and objectives. ANSWER: True POINTS: 1 REFERENCES: H1: Staffing The Information Security Function H2: Information Security Positions p. 268 QUESTION TYPE: Modified True / False Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 7 Security and Personnel HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:34 PM DATE MODIFIED: 5/26/2021 2:34 PM Multiple Choice 37. To assess the effect that changes will have on the organization’s personnel management practices, the organization should conduct a behavioral feasibility study before the program is _____. a. considered b. planned c. budgeted d. implemented ANSWER: d POINTS: 1 REFERENCES: p. 262 H1: Introduction To Security And Personnel QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:37 PM DATE MODIFIED: 6/23/2021 11:57 AM 38. The model commonly used by large organizations places the information security department within the _____ department. a. management b. information technology c. physical security d. production ANSWER: b POINTS: 1 REFERENCES: p. 263 H1: Positioning The Security Function QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 11:58 AM 39. The latest forecasts for information security-related positions expect _____ openings than in many previous years.. a. the same number of b. more c. many fewer d. fewer ANSWER: b POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 7 Security and Personnel REFERENCES:

H1: Staffing The Information Security Function p. 264 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:42 PM DATE MODIFIED: 6/23/2021 11:59 AM 40. Many who move to business-oriented information security were formerly_____ who were often involved in national security or cybersecurity. a. marketing managers b. military personnel c. business analysts d. lawyers ANSWER: b POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Entry into the Information Security Profession QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:00 PM 41. The information security function can be placed within the _____. a. insurance and risk management function b. administrative services function c. legal department d. All of the other answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 263 H1: Positioning The Security Function QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:01 PM 42. In most cases, organizations look for a technically qualified information security _____ who has a solid understanding of how an organization operates. a. generalist b. specialist Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 7 Security and Personnel c. internist ANSWER: POINTS: REFERENCES:

d. expert

a 1 p. 266 H1: Staffing The Information Security Function H2: Qualifications and Requirements QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:45 PM DATE MODIFIED: 5/26/2021 2:46 PM 43. Many who enter the field of information security are technical professionals such as _____ who find themselves working on information security applications and processes more often than traditional IT assignments. a. networking experts or systems administrators b. database administrators c. programmers d. All of the other answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Entry into the Information Security Profession QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:02 PM 44. Which of the following is not one of the categories of positions defined by Schwartz? a. Definer b. User c. Builder d. Administrator ANSWER: b POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:02 PM 45. _____ are the technically qualified individuals tasked to configure firewalls, deploy IDSs, implement security Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 7 Security and Personnel software, diagnose and troubleshoot problems, and coordinate with systems and network administrators to ensure that an organization’s security technology is properly implemented. a. CSOs b. CISOs c. Security managers d. Security analysts ANSWER: d POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:03 PM 46. According to Schwartz, "_____" are the real techies who create and install security solutions. a. Builders b. Administrators c. Engineers d. Definers ANSWER: a POINTS: 1 REFERENCES: p. 268 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:03 PM 47. The _____ is the title most commonly associated with the top information security officer in the organization. a. CISO b. CFO c. CTO d. CEO ANSWER: a POINTS: 1 REFERENCES: p. 268 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 7 Security and Personnel DATE MODIFIED:

6/23/2021 12:26 PM

48. In some organizations, the CISO’s position may be combined with physical security responsibilities or may even report to a security manager who is responsible for both logical (information) security and physical security and such a position is generally referred to as a _____. a. CSO b. CPSO c. CTO d. CNSO ANSWER: a POINTS: 1 REFERENCES: H1: Staffing The Information Security Function H2: Information Security Positions p. 270 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:50 PM DATE MODIFIED: 5/26/2021 2:51 PM 49. Security managers accomplish _____ identified by the CISO and resolve issues identified by technicians a. strategies b. tactics c. objectives d. tasks ANSWER: c POINTS: 1 REFERENCES: H1: Staffing The Information Security Function H2: Information Security Positions p. 271 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 5/26/2021 2:55 PM DATE MODIFIED: 5/26/2021 2:58 PM 50. The breadth and depth covered in each of the domains makes the _____ one of the most difficult-to-attain certifications on the market. a. Security+ b. CISA c. CISSP d. ISEP ANSWER: c POINTS: 1 REFERENCES: p. 273 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 7 Security and Personnel LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:27 PM 51. The (ISC)2 _____ certification program has added a number of concentrations that can demonstrate advanced knowledge beyond the basic certification's common body of knowledge. a. CISA b. C|CISO c. CISM d. CISSP ANSWER: d POINTS: 1 REFERENCES: p. 273 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:29 PM 52. The ISSEP concentration allows CISSP certificate holders to demonstrate expert knowledge of all of the following except _____. a. systems security engineering b. technical management c. international laws d. certification and accreditation/risk management framework ANSWER: c POINTS: 1 REFERENCES: p. 274 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:30 PM 53. The ISSMP concentration examination is designed to provide CISSPs with a mechanism to demonstrate competence in _____. a. enterprise security management practices b. security management practices c. business continuity planning and disaster recovery planning d. All of these answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 274 H1: Credentials For Information Security Professionals Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 7 Security and Personnel H2: (ISC)-2 Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:31 PM 54. Like the CISSP, the SSCP certification is more applicable to the security_____ than to the security _____. a. technician, manager b. manager, engineer c. manager, technician d. technician, executive ANSWER: c POINTS: 1 REFERENCES: p. 274 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 55. The CISA credential is promoted by ISACA as the certification that is appropriate for all but which type of professionals? a. accounting b. security c. networking d. auditing ANSWER: a POINTS: 1 REFERENCES: p. 276 H1: Credentials For Information Security Professionals H2: ISACA Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:31 PM 56. The former System Administration, Networking, and Security Organization is now better known as _____. a. SANO b. SAN c. SANS d. SANSO ANSWER: c POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 7 Security and Personnel REFERENCES:

p. 277 H1: Credentials For Information Security Professionals H2: SANS Certifications QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 57. The Cybersecurity Analyst+ certification from _____ is an intermediate certification with both knowledge-based and performance-based assessment. a. SANS b. ISACA c. CompTIA d. ACM ANSWER: c POINTS: 1 REFERENCES: H1: Credentials For Information Security Professionals H2: CompTIA Certifications p. 280 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 5/26/2021 3:01 PM DATE MODIFIED: 5/26/2021 3:03 PM 58. Many organizations use a(n) _____ interview to remind the employee of contractual obligations, such as nondisclosure agreements, and to obtain feedback on the employee’s tenure in the organization. a. hostile b. departure c. exit d. termination ANSWER: c POINTS: 1 REFERENCES: p. 286 H1: Employment Policies And Practices H2: Termination QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 59. _____ are hired by the organization to serve in a temporary position or to supplement the existing workforce. a. Temporary employees b. Consultants c. Contractors d. Self-employees Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 7 Security and Personnel ANSWER: POINTS: REFERENCES:

a 1 p. 289 H1: Personnel Control Strategies H2: Security Considerations for Temporary Employees, Consultants, and Other Workers QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 60. _____ is a cornerstone in the protection of information assets and in the prevention of financial loss. a. Fire suppression b. Business separation c. Separation of duties d. Collusion ANSWER: c POINTS: 1 REFERENCES: p. 287 H1: Personnel Control Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 61. _____ is the requirement that every employee be able to perform the work of another employee. a. Two-man control b. Collusion c. Duty exchange d. Task rotation ANSWER: d POINTS: 1 REFERENCES: p. 288 H1: Personnel Control Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM Completion 62. To assess the effect that changes will have on the organization’s personnel management practices, the organization should conduct a _____feasibility study before the program is implemented. Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 7 Security and Personnel ANSWER: POINTS: REFERENCES:

behavioral 1 p. 262 H1: Introduction To Security And Personnel QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:32 PM 63. It is important to gather employee _____ early about the information security program and respond to it quickly. feedback ANSWER: POINTS: 1 REFERENCES: p. 262 H1: Introduction To Security And Personnel QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 64. Because the goals and objectives of _____ and CISOs tend to contradict each other, InformationWeek recommends: “The people who do and the people who watch shouldn't report to a common manager.” ANSWER: POINTS: REFERENCES:

CIOs 1 p. 263 H2: Information Security Positions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:33 PM 65. The _____ acts as the spokesperson for the information security team. CSO ANSWER: Chief Security Officer Chief Security Officer (CSO) Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 7 Security and Personnel CISO Chief Information Security Officer Chief Information Security Officer (CISO) CISO or CSO CSO or CISO POINTS: 1 REFERENCES: p. 267 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:35 PM 66. Though CISOs are business managers first and technologists second, they must be conversant in all areas of information security, including the technical, planning, and _____ areas. policy ANSWER: POINTS: 1 REFERENCES: p. 268 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 67. Security _____ are accountable for the day-to-day operation of the information security program. managers ANSWER: POINTS: 1 REFERENCES: p. 271 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 7 Security and Personnel 68. The CISSP certification requires both the successful completion of the examination and a(n) _____ by a qualified third party, typically another similarly certified professional, the candidate’s employer, or a licensed, certified, or commissioned professional. endorsement ANSWER: POINTS: 1 REFERENCES: p. 273 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:36 PM 69. The Associate of (ISC)2 program is geared toward those who want to take the CISSP or SSCP exam before obtaining the requisite _____ for certification. experience ANSWER: POINTS: 1 REFERENCES: p. 276 H1: Credentials For Information Security Professionals H2: (ISC)-2 Certifications QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:37 PM 70. ISACA offers the CGEIT as well as the CISA and _____ certifications. CISM ANSWER: POINTS: 1 REFERENCES: p. 276 H1: Credentials For Information Security Professionals H2: ISACA Certifications QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 7 Security and Personnel 71. SANS developed a series of technical security certifications in 1999 that are known as the Global Information _____ Certification or GIAC family of certifications. Assurance ANSWER: POINTS: 1 REFERENCES: p. 277 H1: Credentials For Information Security Professionals H2: SANS Certifications QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 72. _____ are designed to recognize experts in their respective fields. Certifications ANSWER: POINTS: 1 REFERENCES: p. 281 H1: Credentials For Information Security Professionals H2: Certification Costs QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.3 - List and describe the credentials that information security professionals can earn to gain recognition in the field DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:37 PM 73. Once a candidate has accepted a job offer, the employment _____ becomes an important security instrument. contract ANSWER: POINTS: 1 REFERENCES: p. 285 H1: Employment Policies And Practices H2: Employee Contracts QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 74. When new employees are introduced into the organization’s culture and workflow, they should receive an extensive Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 7 Security and Personnel information security briefing as part of their employee _____. orientation ANSWER: POINTS: 1 REFERENCES: p. 285 H1: Employment Policies And Practices H2: New Hire Orientation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 75. _____ departures include resignation, retirement, promotion, or relocation. Friendly ANSWER: POINTS: 1 REFERENCES: p. 286 H1: Employment Policies And Practices H2: Termination QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:41 AM 76. Separation of _____ is used to reduce the chance of an individual violating information security and breaching the confidentiality, integrity, or availability of information. duties ANSWER: POINTS: 1 REFERENCES: p. 287 H1: Personnel Control Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 77. Related to the concept of separation of duties is that of _____, the requirement that two individuals review and approve each other’s work before the task is categorized as finished. two-person control ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 7 Security and Personnel two person control POINTS: 1 REFERENCES: p. 287 H1: Personnel Control Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 1:54 PM 78. Job _____ can greatly increase the chance that an employee’s misuse of the system or abuse of information will be detected by another employee. rotation ANSWER: POINTS: 1 REFERENCES: p. 288 H1: Personnel Control Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 79. A(n) _____ agency provides specifically qualified individuals at the paid request of another company. temp ANSWER: temporary POINTS: 1 REFERENCES: p. 289 H1: Personnel Control Strategies H2: Security Considerations for Temporary Employees, Consultants, and Other Workers QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 80. The process of ensuring that no unnecessary access to data exists and that employees are able to perform only the minimum operations necessary on a set of data is referred to as the principle of _____. least privilege ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 7 Security and Personnel POINTS: REFERENCES:

1 p. 289 H1: Personnel Control Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 5/26/2021 10:42 AM 81. _____________ are contracted workers hired for a specific one-time purpose, commonly to provide expertise the organization does not have internally. consultants ANSWER: POINTS: 1 REFERENCES: p. 290 H1: Personnel Control Strategies H2: Security Considerations for Temporary Employees, Consultants, and Other Workers QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 6/23/2021 12:38 PM Essay 82. What functions does the CISO perform? The CISO performs the following functions: ANSWER: - Manages the overall information security program for the organization - Drafts or approves information security policies - Works with the CIO on strategic plans, develops tactical plans, and works with security managers on operational plans - Develops information security budgets based on available funding - Sets priorities for the purchase and implementation of information security projects and technology - Makes decisions or recommendations on the recruiting, hiring, and firing of security staff - Acts as the spokesperson for the information security team POINTS: 1 REFERENCES: p. 268 H1: Staffing The Information Security Function H2: Information Security Positions QUESTION TYPE: Essay HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 7 Security and Personnel STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.2 - Explain the issues and concerns related to staffing the information security function DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 9/14/2016 10:50 AM 83. What tasks must be performed when an employee prepares to leave an organization? When an employee prepares to leave an organization, the following tasks must be ANSWER: performed: - Access to the organization’s systems must be disabled. - Removable media must be returned. - Hard drives must be secured. - File cabinet locks must be changed. - The office door lock must be changed. - Keycard access must be revoked. - Personal effects must be removed from the organization’s premises. POINTS: 1 REFERENCES: p. 286 H1: Employment Policies And Practices H2: Termination QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 9/14/2016 10:50 AM DATE MODIFIED: 3/10/2017 10:08 AM 84. Describe the concept of separation of duties. Among several internal control strategies, separation of duties is a cornerstone in the ANSWER: protection of information assets and in the prevention of financial loss. Separation of duties is used to reduce the chance of an individual violating information security and breaching the confidentiality, integrity, or availability of information. The control stipulates that the completion of a significant task that involves sensitive information should require at least two people. The idea behind this separation is that if only one person has the authorization to access a particular set of information, there may be nothing the organization can do to prevent this individual from copying the information and removing it from the premises. Separation of duties is especially important, and thus commonly implemented, when the information in question is financial. POINTS: 1 REFERENCES: p. 287 H1: Personnel Control Strategies QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.07.5 - Discuss the role of the pharyngeal arches in the development of the structures of the face. Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 7 Security and Personnel DATE CREATED: DATE MODIFIED:

9/14/2016 10:50 AM 3/10/2017 10:08 AM

Subjective Short Answer 85. Why is it important to use specific and clearly defined job descriptions for hiring information security professionals? ANSWER:

Using standard job descriptions is important because they can increase the degree of professionalism in the information security field and improve the consistency of roles and responsibilities among organizations. POINTS: 1 REFERENCES: H1: Employment Policies and Practices H2: Job Descriptions p. 267 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 5/26/2021 3:10 PM DATE MODIFIED: 5/26/2021 3:10 PM 86. Why shouldn’t an organization give a job candidate a tour of secure areas during an interview? Candidates who are shown around can retain enough information about operations or ANSWER: information security functions to represent a potential threat. POINTS: 1 REFERENCES: p. 284 H1: Employment Policies and Practices H2: Interviews QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 5/26/2021 3:15 PM DATE MODIFIED: 5/26/2021 3:16 PM 87. How do security considerations for temporary or contract employees differ from those for regular full-time employees? Temporary employees typically provide secretarial or administrative support and may be ANSWER: exposed to a wide range of information. From a security standpoint, temporary employees should have only as much information access as they need to perform their duties. Although organizations often want temporary employees to sign nondisclosure agreements and fair use policies to avoid security breaches, this procedure can create a situation that is awkward and potentially dangerous. Therefore, the temporary employee’s supervisor should restrict the information to which the temp has access and ensure adherence to good Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 7 Security and Personnel security practices, especially clean desk policies and those for the security of classified data. Typical contract employees include groundskeepers, maintenance workers, electrical contractors, mechanical service contractors, and other service and repair workers. Although some contract employees may require access to virtually all areas of the organization to do their jobs, they seldom need access to information or information resources. Contract workers may need access to various facilities, but such access should not be allowed automatically. POINTS: 1 REFERENCES: H1: Employment Policies and Practices H2: Termination p. 285 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.07.4 - Discuss how an organization’s employment policies and practices can support the information security effort DATE CREATED: 5/26/2021 3:07 PM DATE MODIFIED: 5/26/2021 3:07 PM

Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs True / False 1. Discretionary access control is an approach whereby the organization specifies use of resources based on the assignment of data classification schemes to resources and clearance levels to users. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction to Access Controls p. 296 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 3/8/2017 9:46 PM 2. Lattice-based access control is a form of access control in which users are assigned a matrix of authorizations for particular areas of access. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 296 H1: Introduction to Access Controls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 12/2/2017 1:50 PM 3. Task-based controls are associated with the assigned role a user performs in an organization, such as a position or temporary assignment like project manager. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 297 H1: Introduction to Access Controls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:43 AM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs DATE MODIFIED:

9/14/2016 10:43 AM

4. Authentication is the process of validating and verifying an unauthenticated entity’s purported identity. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction to Access Controls H2: Access Control Mechanisms p. 298 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.2 - Define authentication and explain the three commonly used authentication factors DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 3/8/2017 4:57 PM 5. Accountability is the matching of an authenticated entity to a list of information assets and corresponding access levels. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 301 H2: Access Control Mechanisms H1: Introduction to Access Controls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 9/14/2016 10:43 AM 6. Firewalls fall into several major categories of processing modes: packet-filtering firewalls, application layer proxy firewalls, media access control layer firewalls, and hybrids. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Firewall Technologies p. 308 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs DATE CREATED: DATE MODIFIED:

9/14/2016 10:43 AM 6/24/2021 9:31 AM

7. A firewall cannot be deployed as a separate network containing a number of supporting devices. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 308 H1: Firewall Technologies QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 9/14/2016 10:43 AM 8. Packet-filtering firewalls scan network data packets looking for compliance with the rules of the firewall’s database or violations of those rules. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 309 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 9/14/2016 10:43 AM 9. The ability of a router to restrict traffic to a specific service is an advanced capability and not considered a standard feature for most routers. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 9/14/2016 10:43 AM 10. The application layer proxy firewall is capable of functioning both as a firewall and an application layer proxy server. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 312 H2: Firewall Processing Modes H1: Firewall Technologies QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 3/8/2017 9:47 PM 11. Using an application layer firewall means the associated Web server must be exposed to a higher level of risk by placing it in the DMZ. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 6/24/2021 9:32 AM 12. All organizations with a router at the boundary between the organization’s internal networks and the

external service provider will experience improved network performance due to the complexity of the ACLs used to filter the packets. a. True b. False ANSWER: POINTS: REFERENCES:

False 1 p. 314

Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:43 AM DATE MODIFIED: 9/14/2016 10:43 AM 13. The DMZ can be a dedicated port on the firewall device linking a single bastion host. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 316 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 14. The screened subnet protects the DMZ systems and information from outside threats by providing a network with intermediate security, which means the network is less secure than the general-public networks but more secure than the internal network. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 317 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 9:50 PM 15. An extranet is a segment of the DMZ where no authentication and authorization controls are put into place. a. True b. False ANSWER: False Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs POINTS: REFERENCES:

1 p. 317 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 9:50 PM 16. Good policy and practice dictates that each firewall device, whether a filtering router, bastion host, or other firewall implementation, must have its own set of configuration rules. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 318 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 17. Syntax errors in firewall policies are usually difficult to identify. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Firewall Technologies H2: Configuring and Managing Firewalls p. 318 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 9:50 PM 18. When Web services are offered outside the firewall, HTTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture. a. True b. False Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs ANSWER: POINTS: REFERENCES:

True 1 p. 318 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 19. Good firewall rules include denying all data that is not verifiably authentic. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 319 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 9:51 PM 20. Firewalls can only filter packets by port number. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 319 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 9:32 AM 21. It is important that e-mail traffic reach your e-mail server and only your e-mail server. a. True b. False ANSWER: True POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs REFERENCES:

H1: Firewall Technologies H2: Configuring and Managing Firewalls p. 321 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 22. Though not used as much in Windows environments, terminal emulation is still useful to systems administrators on Unix/Linux systems. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 321 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 9:52 PM 23. A content filter, also known as a reverse firewall, is a network device that allows administrators to restrict access to internal content from external users. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 324 H1: Firewall Technologies H2: Content Filters QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 9:34 AM 24. A content filter is essentially a set of scripts or programs that restricts user access to certain networking protocols and Internet locations. a. True b. False ANSWER: True Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs POINTS: REFERENCES:

1 p. 324 H1: Firewall Technologies H2: Content Filters QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 25. Internet connections via dial-up lines are regaining popularity due to recent technological developments. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Protecting Remote Connections H2: Remote Access p. 325 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 26. A RADIUS system decentralizes the responsibility for authenticating each user by validating the user's credentials on the network accessserver. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 326 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 9:34 AM 27. Even if Kerberos servers are subjected to denial-of-service attacks, a client can still request additional services. a. True b. False ANSWER: False POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs REFERENCES:

p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 28. A VPN, used properly, allows communication across the Internet as if it were a private network. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) p. 329 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 9:36 AM 29. Most current operating systems require specialized software to connect to VPN servers, as support for VPN services is no longer built into the clients. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) p. 329 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM Modified True / False 30. Access control is the method by which systems determine whether and how to admit a user into a trusted area of the organization, whether systems or physical locations. _____ ANSWER: True POINTS: 1 REFERENCES: p. 296 Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H1: Introduction to Access Controls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:01 AM 31. Authentication is a mechanism whereby unverified entities who seek access to a resource provide a label by which they are known to the system. _____ ANSWER: False - Identification POINTS: 1 REFERENCES: H1: Introduction to Access Controls H2: Access Control Mechanisms p. 298 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.2 - Define authentication and explain the three commonly used authentication factors DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 32. The false reject rate describes the number of legitimate users who are denied access because of a failure in the biometric device. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Introduction to Access Controls H2: Biometrics p. 302 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.2 - Define authentication and explain the three commonly used authentication factors DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 33. One of the biggest challenges in the use of the trusted computer base (TCB) is the existence of explicit channels. _____ ANSWER: False - covert POINTS: 1 REFERENCES: p. 305 H1: Introduction to Access Controls Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H2: Access Control Architecture Models QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 34. In static filtering, configuration rules must be manually created, sequenced, and modified within the firewall. _____ ANSWER: True POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 35. A routing table tracks the state and context of each packet in a conversation by recording which station sent which packet and when. _____ False - state ANSWER: POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:02 AM 36. The primary disadvantage of stateful packet inspection firewalls is the additional processing required to manage and verify packets against the state table. _____ ANSWER: True POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 37. The static packet filtering firewall can react to an emergent event and update or create rules to deal with that event. _____ ANSWER: False - dynamic POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 38. Port Address Translation assigns non-routing local addresses to computer systems in the local area network and uses ISP-assigned addresses on a one-to-one basis. _____ ANSWER: False - Network POINTS: 1 REFERENCES: p. 314 H1: Firewall Technologies H2: Firewall Architectures QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:03 AM 39. When a bastion host approach is used, the host contains two CPUs, forcing all traffic to go through the device. _____ False - NICs ANSWER: False - Network Interface Cards False - Network-Interface-Cards False - Network Cards False - Network Interfaces POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs REFERENCES:

p. 314 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:04 AM 40. A common DMZ arrangement is a subnet firewall that consists of two or more internal bastion hosts behind a packetfiltering router, with each host protecting the trusted network. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Firewall Technologies H2: Firewall Architectures p. 316 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 41. Firewalls operate by examining a data packet and performing a comparison with some predetermined logical rules. _____ ANSWER: True POINTS: 1 REFERENCES: p. 319 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:05 AM 42. A(n) intranet is a segment of the DMZ where additional authentication and authorization controls are put into place to provide services that are not available to the general public. _____ ANSWER: False - extranet POINTS: 1 REFERENCES: p. 317 Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H1: Firewall Technologies H2: Firewall Architectures QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 43. When Web services are offered outside the firewall, SMTP traffic should be blocked from internal networks through the use of some form of proxy access or DMZ architecture. _____ ANSWER: False - HTTP False - Hypertext Transfer Protocol False - Hypertext Transfer Protocol (HTTP) POINTS: 1 REFERENCES: p. 318 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:05 AM 44. Most firewalls use packet header information to determine whether a specific packet should be allowed to pass through or should be dropped. _____ ANSWER: True POINTS: 1 REFERENCES: p. 319 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 45. Best practices in firewall rule set configuration state that the firewall device never allows administrative access directly from the public network. _____ ANSWER: True POINTS: 1 REFERENCES: p. 318 Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:06 AM 46. Traceroute, formally known as an ICMP Echo request, is used by internal systems administrators to ensure that clients and servers can communicate. _____ ANSWER: False - Pings False - Ping POINTS: 1 REFERENCES: p. 321 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 47. The presence of external requests for Telnet services can indicate a potential attack. _____ ANSWER: True POINTS: 1 REFERENCES: p. 321 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 48. In order to keep the Web server inside the internal network, direct all HTTP requests to the internal filtering firewall and configure the internal filtering router/firewall to allow only that device to access the internal Web server. _____ ANSWER: False - proxy server False - proxy POINTS: 1 REFERENCES: p. 322 H1: Firewall Technologies Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H2: Configuring and Managing Firewalls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 49. A content filter, also known as a proxy server, is essentially a set of scripts or programs that restricts user access to certain networking protocols and Internet locations.. _____ ANSWER: False - reverse firewall POINTS: 1 REFERENCES: p. 324 H1: Firewall Technologies H2: Content Filters QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:07 AM 50. An attacker who suspects that an organization has dial-up lines can use a device called a(n) war dialer to locate the connection points. _____ ANSWER: True POINTS: 1 REFERENCES: p. 326 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 51. Kerberos uses asymmetric key encryption to validate an individual user to various network resources. _____ ANSWER: False - symmetric POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 52. RADIUS, as described in RFC 4120, keeps a database containing the private keys of clients and servers—in the case of a client, this key is simply the client’s encrypted password. _____ False - Kerberos ANSWER: POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:08 AM 53. Secure VPNs use security protocols and encrypt traffic transmitted across unsecured public networks like the Internet. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) p. 329 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 54. A popular use for tunnel mode VPNs is the end-to-end transport of encrypted data. _____ ANSWER: False - transport POINTS: 1 REFERENCES: p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs DATE MODIFIED:

6/24/2021 10:08 AM

Multiple Choice 55. _____ access control is a form of _____ access control in which users are assigned a matrix of authorizations for particular areas of access. a. task-based, discretionary b. role-based, nondiscretionary c. mandatory, discretionary d. lattice-based, nondiscretionary ANSWER: d POINTS: 1 REFERENCES: p. 296 H1: Introduction to Access Controls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:10 AM 56. Which of the following is not a major processing mode category for firewalls? a. Packet-filtering b. Application Layer Proxy c. Media Access Control Layer d. Router Passthrough ANSWER: POINTS: REFERENCES:

d 1 p. 309 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/15/2021 5:38 PM 57. _____ firewalls examine every incoming packet header and can selectively filter packets based on header information such as destination address, source address, packet type, and other key information. a. Packet-filtering b. Application gateway c. Circuit gateway d. MAC layer ANSWER: a POINTS: 1 REFERENCES: p. 309 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 58. The restrictions most commonly implemented in packet-filtering firewalls are based on _____. a. IP source and destination address b. Direction (inbound or outbound) c. TCP or UDP source and destination port requests d. All of these answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 309 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:10 AM 59. _____ filtering requires that the firewall's filtering rules for allowing and denying packets are manually developed and installed with the firewall. a. Dynamic b. Static c. Stateful d. Stateless ANSWER: b POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:11 AM 60. A _____ filtering firewall can react to an emergent event and update or create rules to deal with the event. a. dynamic b. static c. stateful d. stateless ANSWER: a POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs REFERENCES:

p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 61. _____ inspection firewalls keep track of each network connection between internal and external systems. a. Static b. Dynamic c. Stateful d. Stateless ANSWER: c POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 62. The application layer proxy firewall is also known as a(n) _____. a. application firewall b. client firewall c. proxy firewall d. All of these are correct ANSWER: a POINTS: 1 REFERENCES: p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:12 AM 63. The proxy server is often placed in an unsecured area of the network or is placed in the _____ zone. a. fully trusted b. hot c. demilitarized d. cold ANSWER: c Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs POINTS: REFERENCES:

1 p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 64. The _____ is an intermediate area between a trusted network and an untrusted network. a. perimeter b. DMZ c. domain d. firewall ANSWER: b POINTS: 1 REFERENCES: p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 65. __________ make filtering decisions based on the specific host computer’s identity, as represented by its network interface card (NIC) address, and operate at the data link layer of the OSI model or the subnet layer of the TCP/IP model. a. Media Access Control Layer b. Circuit gateway c. Application gateway d. Packet-filtering ANSWER: a POINTS: 1 REFERENCES: p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:12 AM 66. Because the _____ host stands as a sole defender on the network perimeter, it is commonly referred to as the sacrificial host. a. trusted b. domain Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs c. DMZ d. bastion ANSWER: POINTS: REFERENCES:

d 1 p. 314 H1: Firewall Technologies H2: Firewall Architectures QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:13 AM 67. The dominant architecture used to secure network access today is the _____ firewall. a. static b. bastion c. unlimited d. screened subnet ANSWER: d POINTS: 1 REFERENCES: p. 316 H1: Firewall Technologies H2: Firewall Architectures QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 68. Configuring firewall _____ is viewed as much an art as it is a science. a. policies b. subnets c. VPNs d. protocols ANSWER: a POINTS: 1 REFERENCES: p. 318 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:15 AM 69. Telnet protocol packets usually go to TCP port _____, whereas SMTP packets go to port _____. a. 23, 52 b. 80, 52 Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs c. 80, 25 d. 23, 25 ANSWER: POINTS: REFERENCES:

d 1 p. 319 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 70. Known as the ping service, _____is a common method for hacker reconnaissance and should be turned off to prevent snooping. a. RADIUS b. ICMP c. telnet d. DNS ANSWER: b POINTS: 1 REFERENCES: p. 318 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:16 AM 71. In most common implementation models, the content filter has two components: _____. a. allow and deny b. filtering and encoding c. rating and decryption d. rating and filtering ANSWER: d POINTS: 1 REFERENCES: p. 324 H1: Firewall Technologies H2: Content Filters QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:17 AM 72. _____ and TACACS are systems that authenticate the credentials of users who are trying to access an organization’s network via a dial-up connection. a. RADIUS b. RADIAL Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs c. TUNMAN ANSWER: POINTS: REFERENCES:

d. IPSEC a 1 p. 326 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 73. Which of the following versions of TACACS is still in use? a. TACACS v2 b. Extended TACACS c. TACACS+ d. All of these are correct ANSWER: c POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:17 AM 74. The service within Kerberos that generates and issues session keys is known as _____. a. VPN b. KDC c. AS d. TGS ANSWER: b POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 75. Kerberos _____ provides tickets to clients who request services. a. KDS b. TGS c. AS d. VPN ANSWER: b Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs POINTS: REFERENCES:

1 p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 76. In SESAME, the user is first authenticated to an authentication server and receives a token. The token is then presented to a privilege attribute server as proof of identity to gain a(n) _____. a. VPN b. ECMA c. ticket d. PAC ANSWER: d POINTS: 1 REFERENCES: p. 328 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 77. A(n) _____ is a private data network that makes use of the public telecommunication infrastructure, maintaining privacy through the use of a tunneling protocol and security procedures. a. SVPN b. VPN c. SESAME d. KERBES ANSWER: b POINTS: 1 REFERENCES: p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 78. In _____ mode, the data within an IP packet is encrypted, but the header information is not. a. tunnel b. transport c. public d. symmetric ANSWER: b Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs POINTS: REFERENCES:

1 p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:57 PM 79. The primary benefit of a VPN that uses _____ is that an intercepted packet reveals nothing about the true destination system. a. intermediate mode b. tunnel mode c. reversion mode d. transport mode ANSWER: b POINTS: 1 REFERENCES: p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM Completion 80. A(n) _____ contains a computer chip that can verify and validate several pieces of information instead of just a PIN. smart card ANSWER: POINTS: 1 REFERENCES: p. 300 H1: Introduction to Access Controls H2: Access Control Mechanisms QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 81. The _____ describes the number of legitimate users who are denied access because of a failure in the biometric device. This failure is known as a Type I error. false reject rate ANSWER: POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs REFERENCES:

p. 302 H1: Introduction to Access Controls H2: Biometrics QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.2 - Define authentication and explain the three commonly used authentication factors DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 8:15 PM 82. A(n) _____ is a combination of hardware and software that filters or prevents specific information from moving between the outside world and the inside world. firewall ANSWER: POINTS: 1 REFERENCES: p. 308 H1: Firewall Technologies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 83. A packet-_____ firewall installed on a TCP/IP-based network typically functions at the IP level and determines whether to drop a packet (deny) or forward it to the next network connection (allow) based on the rules programmed into the firewall. filtering ANSWER: POINTS: 1 REFERENCES: p. 309 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 84. _____ is a firewall type that keeps track of each network connection between internal and external systems using a table and that expedites the processing of those communications. Stateful packet inspection (SPI) ANSWER: Stateful packet inspection Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs SPI Stateful inspection firewall POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 85. The _____ packet-filtering firewall can react to an emergent event and update or create rules to deal with that event. dynamic ANSWER: POINTS: 1 REFERENCES: p. 311 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 86. The application firewall is also known as a(n) application layer _____ server. proxy ANSWER: POINTS: 1 REFERENCES: p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:19 AM 87. _____ firewalls combine the elements of other types of firewalls—that is, the elements of packet filtering and proxy services, or of packet filtering and circuit gateways. Hybrid ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs POINTS: REFERENCES:

1 p. 312 H1: Firewall Technologies H2: Firewall Processing Modes QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 88. Because the bastion host stands as a sole defender on the network perimeter, it is commonly referred to as a(n) _____ host. sacrificial ANSWER: POINTS: 1 REFERENCES: p. 314 H1: Firewall Technologies H2: Firewall Architectures QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:20 AM 89. The architecture of a(n) _____ firewall protects a DMZ. screened subnet ANSWER: POINTS: 1 REFERENCES: p. 316 H1: Firewall Technologies H2: Firewall Architectures QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/15/2021 5:39 PM 90. Both _____ and Next Generation Firewalls (NGFW) are hybrid firewalls categorized by their ability to perform the work of an SPI firewall, network IDPS, content filter, spam filter, and malware scanner and filter. UTM ANSWER: Unified Threat Management Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs Unified Threat Management (UTM) POINTS: 1 REFERENCES: H1: Firewall Technologies H2: Firewall Processing Modes p. 313 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:21 AM 91. At the very least, _____ access to the organization’s Domain Name System (DNS) server should be blocked to prevent illegal zone transfers and to prevent attackers from taking down the organization’s entire network. telnet ANSWER: terminal emulation terminal remote desktop POINTS: 1 REFERENCES: H1: Firewall Technologies H2: Configuring and Managing Firewalls p. 318 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:22 AM 92. A firewall device must never be accessible directly from the _____ network. public ANSWER: untrusted unprotected POINTS: 1 REFERENCES: p. 319 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:23 AM Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs 93. A(n) _____ filter is a software filter—technically not a firewall—that allows administrators to restrict access to content from within a network. content ANSWER: POINTS: 1 REFERENCES: p. 324 H1: Firewall Technologies H2: Content Filters QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 94. Content filters are often called _____ firewalls. reverse ANSWER: POINTS: 1 REFERENCES: p. 324 H1: Firewall Technologies H2: Content Filters QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 95. A(n) _____ dialer is an automatic phone-dialing program that dials every number in a configured range and checks to see if a person, answering machine, or modem picks up. war ANSWER: POINTS: 1 REFERENCES: p. 326 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 96. The Remote _____ Dial-In User Service system centralizes the management of user authentication by placing the responsibility for authenticating each user in the central RADIUS server. Authentication ANSWER: POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs REFERENCES:

p. 326 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 97. The _____ Access Controller Access Control System contains a centralized database, and it validates the user’s credentials at the TACACS server. Terminal ANSWER: POINTS: 1 REFERENCES: p. 326 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 98. The _____ authentication system is named after the three-headed dog of Greek mythology that guards the gates to the underworld. Kerberos ANSWER: POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 99. In Kerberos, a(n) _____ is an identification card for a particular client that verifies to the server that the client is requesting services and that the client is a valid member of the Kerberos system and therefore authorized to receive services. ticket ANSWER: POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 100. Kerberos is based on the principle that the _____ knows the secret keys of all clients and servers on the network. Key Distribution Center (KDC) ANSWER: Key Distribution Center KDC POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 101. SESAME uses _____ key encryption to distribute secret keys. public ANSWER: POINTS: 1 REFERENCES: p. 328 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 102. A(n) _____ private network is a secure network connection between systems that uses the data communication capability of an unsecured and public network. virtual ANSWER: POINTS: 1 REFERENCES: p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Completion Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 5/27/2021 3:58 PM 103. A trusted _____ uses leased circuits from a service provider who gives contractual assurance that no one else is allowed to use these circuits and that they are properly maintained and protected. VPN ANSWER: POINTS: 1 REFERENCES: p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:24 AM 104. A _____ mode VPN establishes two perimeter servers to encrypt all traffic that will traverse an unsecured network. The entire client packet is encrypted and added as the data portion of a packet addressed from one perimeter server to another. tunnel ANSWER: POINTS: 1 REFERENCES: p. 330 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 10:25 AM Essay 105. Briefly describe the best practice rules for firewall use. 1. All traffic from the trusted network is allowed out. ANSWER: 2. The firewall device is never directly accessible from the public network for configuration or management purposes. 3. Simple Mail Transport Protocol (SMTP) data is allowed to pass through the firewall, but it should all be routed to a well-configured SMTP gateway to filter and route messaging traffic securely. 4. All Internet Control Message Protocol (ICMP) data should be denied. 5. Telnet (terminal emulation) access to all internal servers from the public networks Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs should be blocked. 6. When Web services are offered outside the firewall, HTTP traffic should be denied from reaching your internal networks through the use of some form of proxy access or DMZ architecture. 7. All data that is not verifiably authentic should be denied. POINTS: 1 REFERENCES: p. 318 H1: Firewall Technologies H2: Configuring and Managing Firewalls QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.4 - Explain the various approaches to firewall implementation DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:15 PM 106. List and describe the interacting services of the Kerberos system. Kerberos consists of three interacting services, all of which use a database library: ANSWER: 1. Authentication server (AS), which is a Kerberos server that authenticates clients and servers. 2. Key Distribution Center (KDC), which generates and issues session keys. 3. Kerberos ticket granting service (TGS), which provides tickets to clients who request services. In Kerberos a ticket is an identification card for a particular client that verifies to the server that the client is requesting services and that the client is a valid member of the Kerberos system and therefore authorized to receive services. The ticket consists of the client’s name and network address, a ticket validation starting and ending time, and the session key, all encrypted in the private key of the server from which the client is requesting services. POINTS: 1 REFERENCES: p. 327 H1: Protecting Remote Connections H2: Remote Access QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.5 - Locate the surfaces of each tooth. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 1/30/2017 2:50 PM 107. What must a VPN accomplish to offer a secure and reliable capability while relying on public networks? - Encapsulation of incoming and outgoing data, wherein the native protocol of the client is ANSWER: embedded within the frames of a protocol that can be routed over the public network as well as be usable by the server network environment. - Encryption of incoming and outgoing data to keep the data contents private while in transit over the public network but usable by the client and server computers and/or the local networks on both ends of the VPN connection. - Authentication of the remote computer and, perhaps, the remote user as well. Copyright Cengage Learning. Powered by Cognero.

Page 36

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs Authentication and the subsequent authorization of the user to perform specific actions are predicated on accurate and reliable identification of the remote system and/or user. POINTS: 1 REFERENCES: p. 329 H1: Protecting Remote Connections H2: Virtual Private Networks (VPNs) QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.08.6 - Identify line angles, point angles, and divisions into thirds. DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:16 PM Subjective Short Answer 108. What is the typical relationship among the untrusted network, the firewall, and the trusted network? The untrusted network is usually the Internet or another segment of a public access ANSWER: network, while the trusted network is typically a privately owned network. The firewall serves as a mechanism to filter traffic from the untrusted network into the trusted network and foster assurance that the traffic is legitimate. POINTS: 1 REFERENCES: p. 308 H1: Firewall Technologies QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.3 - Describe firewall technologies and the various categories of firewalls DATE CREATED: 5/27/2021 8:37 PM DATE MODIFIED: 5/27/2021 8:38 PM 109. What is biometric access control? What are the four truly unique human characteristics used in biometrics? Biometric access control is the use of physiological characteristics to provide ANSWER: authentication for a provided identification.

POINTS: REFERENCES:

The human characteristics usually considered truly unique for use in biometrics are: • Fingerprints • Retina of the eye (blood vessel pattern) • Iris of the eye (random pattern of features found in the iris, including freckles, pits, striations, vasculature, coronas, and crypts) • DNA 1 p. 301 H1: Introduction to Access Controls H2: Biometrics

Copyright Cengage Learning. Powered by Cognero.

Page 37

Name:

Class:

Date:

Mod 8 Security Technology: Access Controls, Firewalls, and VPNs QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.2 - Define authentication and explain the three commonly used authentication factors DATE CREATED: 5/27/2021 8:41 PM DATE MODIFIED: 5/27/2021 8:43 PM 110. What is deperimeterization? Deperimeterization is the recognition that there is no clear information security ANSWER: boundary between an organization and the outside world, meaning that the organization must be prepared to protect its information both inside and outside its digital walls. POINTS: 1 REFERENCES: p. 331 H1: Final Thoughts On Remote Access And Access Controls H2: Deperimeterization QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.08.1 - Discuss the role of access control in information systems, and identify and discuss the four fundamental functions of access control systems DATE CREATED: 5/27/2021 8:45 PM DATE MODIFIED: 5/27/2021 8:47 PM

Copyright Cengage Learning. Powered by Cognero.

Page 38

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools True / False 1. Intrusion detection consists of procedures and systems that identify system intrusions and take steps to limit the intrusion and return operations to a normal state when an intrusion is detected. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Intrusion Detection And Prevention Systems p. 339 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:30 PM 2. An IDPS can be configured to call a phone number or perform another type of signal or message. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 339 H1: Introduction To Intrusion Detection And Prevention Systems QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:31 PM 3. A false positive is the failure of an IDPS system to react to an actual attack event. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology p. 340 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE MODIFIED:

9/14/2016 10:44 AM

4. The process by which attackers change the format and/or timing of their activities to avoid being detected by the IDPS is known as a false attack stimulus. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 5. In DNS cache poisoning, valid packets exploit poorly configured DNS servers to inject false information and corrupt the servers’ answers to routine DNS queries from other systems on the network. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 345 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:25 PM 6. NIDPSs can reliably ascertain whether an attack was successful. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 345 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools

DATE CREATED: DATE MODIFIED:

intrusion detection and prevention systems 9/14/2016 10:44 AM 3/8/2017 10:25 PM

7. HIDPSs are also known as system integrity verifiers. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 8. An HIDPS can monitor system logs for predefined events. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:25 PM 9. An HIDPS can detect local events on host systems and detect attacks that may elude a network-based IDPS. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:26 PM 10. An HIDPS is optimized to detect multihost scanning, and it is able to detect the scanning of non-host network devices, such as routers or switches. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:26 PM 11. The anomaly-based IDPS collects statistical summaries by observing traffic that is known to be normal. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Detection Methods p. 350 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 12. IDPS responses can be classified as active or passive. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 354 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Response Behavior QUESTION TYPE: True / False Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 13. A passive IDPS response is a definitive action automatically initiated when certain types of alerts are triggered. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 354 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Response Behavior QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 14. The Simple Network Management Protocol contains trap functions, which allow a device to send a message to the SNMP management console indicating that a certain threshold has been crossed, either positively or negatively. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 355 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Response Behavior QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 15. In order to determine which IDPS best meets an organization’s needs to consider the system environment, security goals and objectives and the existing security policy. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 358 H1: Introduction To Intrusion Detection And Prevention Systems Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools H2: Selecting IDPS Approaches and Products QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:32 PM 16. Your organization’s operational goals, constraints, and culture should not affect the selection of the IDPS and other security tools and technologies to protect your systems. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Intrusion Detection And Prevention Systems H2: Selecting IDPS Approaches and Products p. 357 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 17. Among the considerations in evaluating an IDPS are the product's scalability, testing, support provisions, and ability to provide information on the source of attacks. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 359 H1: Introduction To Intrusion Detection And Prevention Systems H2: Selecting IDPS Approaches and Products QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:32 PM 18. Intrusion detection and prevention systems perform monitoring and analysis of system events and user behaviors. a. True b. False ANSWER: True Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools POINTS: REFERENCES:

1 p. 360 H1: Introduction To Intrusion Detection And Prevention Systems H2: Strengths and Limitations of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 19. Intrusion detection and prevention systems can deal effectively with newly published attacks or variants of existing attacks. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 360 H1: Introduction To Intrusion Detection And Prevention Systems H2: Strengths and Limitations of IDPSs QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:32 PM 20. A fully distributed IDPS control strategy is an IDPS implementation approach in which all control functions are applied at the physical location of each IDPS component. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 362 H1: Introduction To Intrusion Detection And Prevention Systems H2: Deployment and Implementation of an IDPS QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 2/6/2017 9:26 PM 21. Security tools that provide decoy systems designed to lure potential attackers away from critical systems include honeypots, honeynets, and padded cell systems. Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools a. True b. False ANSWER: POINTS: REFERENCES:

True 1 H1: Honeypots, Honeynets, And Padded Cell Systems p. 367 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:33 PM 22. An IDS helps to secure networks by identifying where the network needs securing. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Scanning And Analysis Tools p. 370 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:36 PM 23. To assist in footprint intelligence collection, attackers may use an enhanced Web scanner that, among other things, can scan entire Web sites for valuable pieces of information, such as server names and e-mail addresses. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 371 H1: Scanning And Analysis Tools QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 3/8/2017 10:28 PM 24. TCP/IP services can run only on their commonly used port number as specified in their original Internet standard. a. True Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools b. False ANSWER: POINTS: REFERENCES:

False 1 H1: Scanning And Analysis Tools H2: Port Scanners p. 372 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:37 PM 25. Administrators should encourage users to experiment with hackerware tools as they assist the organization in detecting potential vulnerabilities in the systems. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 373 H1: Scanning And Analysis Tools H2: Firewall Analysis Tools QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:38 PM 26. Once the OS is known, the vulnerabilities to which a system is susceptible can more easily be determined. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 373 H1: Scanning And Analysis Tools H2: Operating System Detection Tools QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:38 PM 27. The Metasploit Framework is a collection of exploits coupled with an interface that allows the penetration tester to Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools automate the custom exploitation of vulnerable systems. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 375 H1: Scanning And Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 9/14/2016 10:44 AM 28. A passive vulnerability scanner is one that initiates traffic on the network in order to determine security holes. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 376 H1: Scanning And Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 1/30/2017 6:33 PM 29. Passive scanners are advantageous in that they can find client-side vulnerabilities that are typically not found by active scanners. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 376 H1: Scanning And Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE MODIFIED:

6/24/2021 4:40 PM

30. To use a packet sniffer legally, the administrator only needs to be on a network that the organization owns, and have authorization of the network’s owners. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 378 H1: Scanning And Analysis Tools H2: Packet Sniffer QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:40 PM Modified True / False 31. Alarm filtering and compaction is the process of grouping almost identical alarms that occur nearly at the same time into a single higher-level alarm. _____ ANSWER: False - clustering POINTS: 1 REFERENCES: p. 339 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:41 PM 32. A(n) event is an indication that a system has just been attacked or is under attack. _____ False - alert ANSWER: False - alarm POINTS: 1 REFERENCES: p. 339 vH1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/3/2021 6:44 PM 33. Alarm events that are accurate and noteworthy but do not pose significant threats to information security are called noise. _____ ANSWER: True POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/3/2021 6:44 PM 34. Avoidance is the process by which an attacker changes the format and/or timing of activities to avoid being detected by an IDPS. _____ ANSWER: False - evasion POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:42 PM 35. The integrity value, which is based upon fuzzy logic, helps an administrator determine how likely it is that an IDPS alert or alarm indicates an actual attack in progress. _____ ANSWER: False - confidence POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/3/2021 6:44 PM 36. A(n) known vulnerability is a published weakness or fault in an information asset or its protective systems that may be exploited and result in loss. _____ ANSWER: True POINTS: 1 REFERENCES: p. 341 H1: Introduction To Intrusion Detection And Prevention Systems H2: Why Use an IDPS? QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/3/2021 6:44 PM 37. The activities that gather public information about the organization and its network activities and assets is called fingerprinting. _____ ANSWER: False - footprinting POINTS: 1 REFERENCES: p. 341 H1: Introduction To Intrusion Detection And Prevention Systems H2: Why Use an IDPS? QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/3/2021 6:44 PM 38. In the process of protocol application verification, the NIDPSs look for invalid data packets. _____ ANSWER: False - stack POINTS: 1 REFERENCES: p. 344 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools

DATE CREATED: DATE MODIFIED:

intrusion detection and prevention systems 9/14/2016 10:44 AM 6/3/2021 6:44 PM

39. A HIDPS is also known as a system validity verifier. _____ ANSWER: False - integrity POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:44 AM DATE MODIFIED: 6/24/2021 4:43 PM 40. A(n) NIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. _____ ANSWER: False - HIDPS POINTS: 1 REFERENCES: p. 349 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 41. Preconfigured, predetermined attack patterns are called signatures. _____ ANSWER: True POINTS: 1 REFERENCES: p. 350 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Detection Methods QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE MODIFIED:

6/3/2021 6:44 PM

42. A(n) log file monitor is similar to an NIDPS. _____ ANSWER: True POINTS: 1 REFERENCES: p. 351 H1: Introduction To Intrusion Detection And Prevention Systems H2: Log File Monitors QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 43. The centralized IDPS implementation approach occurs when all detection functions are managed in a central location. _____ False - control ANSWER: POINTS: 1 REFERENCES: p. 361 H1: Introduction To Intrusion Detection And Prevention Systems H2: Deployment and Implementation of an IDPS QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:45 PM 44. A(n) partially distributed IDPS control strategy combines the best of other IDPS strategies. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Introduction To Intrusion Detection And Prevention Systems H2: Deployment and Implementation of an IDPS p. 362 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 45. When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) honeynet. _____ ANSWER: True Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools POINTS: REFERENCES:

1 p. 367 H1: Honeypots, Honeynets, And Padded Cell Systems QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 46. A hardened honeypot is also known as a protected cell system. _____ ANSWER: False - padded POINTS: 1 REFERENCES: p. 367 H1: Honeypots, Honeynets, And Padded Cell Systems QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:46 PM 47. The disadvantages of using the honeypot or padded cell approach include the fact that the technical implications of using such devices are not well understood. _____ ANSWER: False - legal POINTS: 1 REFERENCES: p. 368 H1: Honeypots, Honeynets, And Padded Cell Systems H2: Trap-and-Trace Systems QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 48. When using trap-and-trace, the trap usually consists of a honeypot or padded cell and a(n) packet sniffer. _____ ANSWER: False - alarm False - alert POINTS: 1 REFERENCES: p. 368 H1: Honeypots, Honeynets, And Padded Cell Systems Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools H2: Trap-and-Trace Systems QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:48 PM 49. Enticement is the illegal and unethical action of luring an individual into committing a crime to get a conviction. _____ ANSWER: False - Entrapment POINTS: 1 REFERENCES: p. 368 H1: Honeypots, Honeynets, And Padded Cell Systems H2: Trap-and-Trace Systems QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:49 PM 50. Fingerprinting is the organized research of the Internet addresses owned or controlled by a target organization. _____ ANSWER: False - Footprinting POINTS: 1 REFERENCES: p. 370 H1: Scanning And Analysis Tools QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 51. For Linux or BSD systems, a tool called “Sam Spade” allows a remote individual to “mirror” entire Web sites. _____ ANSWER: False - wget POINTS: 1 REFERENCES: p. 371 H1: Scanning And Analysis Tools QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:49 PM 52. Port scanners are tools used both by attackers and defenders to identify (or footprint) the computers that are active on a network, as well as the ports and services active on those computers, the functions and roles the machines are fulfilling, and other useful information. _____ ANSWER: False - fingerprint POINTS: 1 REFERENCES: p. 372 H1: Scanning And Analysis Tools H2: Port Scanners QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:50 PM 53. A(n) port is the equivalent of a network channel or connection point in a data communications system. _____ ANSWER: True POINTS: 1 REFERENCES: p. 372 H1: Scanning And Analysis Tools H2: Port Scanners QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 54. A(n) monitoring vulnerability scanner is one that listens in on the network and determines vulnerable versions of both server and client software. _____ ANSWER: False - passive POINTS: 1 REFERENCES: p. 376 H1: Scanning And Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 55. For 802.11 wireless networks, a wireless security toolkit should include the ability to sniff wireless traffic, and scan wireless hosts. _____ ANSWER: True POINTS: 1 REFERENCES: H1: Scanning And Analysis Tools H2: Wireless Security Tools p. 379 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:52 PM Multiple Choice 56. A(n) _____ works like a burglar alarm in that it detects a violation (some system activities analogous to an opened or broken window) and activates an alarm. a. IDPS b. WiFi c. UDP d. DoS ANSWER: a POINTS: 1 REFERENCES: p. 339 H1: Introduction To Intrusion Detection And Prevention Systems QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 57. Intrusion _____ activities finalize the restoration of operations to a normal state and seek to identify the source and method of the intrusion in order to ensure that the same type of attack cannot occur again. a. prevention b. reaction c. detection d. correction ANSWER: d POINTS: 1 REFERENCES: p. 339 Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools H1: Introduction To Intrusion Detection And Prevention Systems QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 58. A(n) _____ is an event that triggers an alarm when no actual attack is in progress. a. false neutral b. false attack stimulus c. false negative d. noise ANSWER: b POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 59. _____ is the process of classifying IDPS alerts so that they can be more effectively managed. a. Alarm filtering b. Alarm clustering c. Alarm compaction d. Alarm attenuation ANSWER: a POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 60. Activities that scan networks for active systems and then identify the network services offered by the host systems are known as _____. a. port knocking b. doorknob rattling c. footprinting d. fingerprinting ANSWER: d POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools REFERENCES:

p. 341 H1: Introduction To Intrusion Detection And Prevention Systems H2: Why Use an IDPS? QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:53 PM 61. A(n) _____ IDPS is focused on protecting network information assets. a. network-based b. host-based c. application-based d. server-based ANSWER: a POINTS: 1 REFERENCES: p. 343 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 62. _____ are usually passive devices, but cannot analyze encrypted packets, making some traffic invisible to the process. a. NIDPSs b. HIDPSs c. AppIDPSs d. SIDPSs ANSWER: a POINTS: 1 REFERENCES: p. 343 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:54 PM 63. A(n) _____ port, also known as a monitoring port, is a specially configured connection on a network device that is capable of viewing all of the traffic that moves through the entire device. a. NIDPS b. SPAN c. DPS d. IDSE ANSWER: b Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools POINTS: REFERENCES:

1 p. 344 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 64. To determine whether an attack has occurred or is underway, NIDPSs compare measured activity to known _____ in their knowledge base. a. vulnerabilities b. fingerprints c. signatures d. footprints ANSWER: c POINTS: 1 REFERENCES: p. 344 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 65. Most network behavior analysis system sensors can be deployed in _____ mode only, using the same connection methods as network-based IDPSs. a. passive b. active c. reactive d. dynamic ANSWER: a POINTS: 1 REFERENCES: p. 347 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 66. Network behavior analysis system _____ sensors are typically intended for network perimeter use, so they are deployed in close proximity to the perimeter firewalls, often between the firewall and the Internet border router to limit Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools incoming attacks that could overwhelm the firewall. a. inline b. offline c. passive d. bypass ANSWER: a POINTS: 1 REFERENCES: p. 347 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 67. _____ benchmark and monitor the status of key system files and detect when an intruder creates, modifies, or deletes monitored files. a. NIDPSs b. HIDPSs c. AppIDPSs d. SIDPSs ANSWER: b POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Log File Monitors QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 68. A(n) _____ reviews the log files generated by servers, network devices, and even other IDPSs looking for patterns and signatures that may indicate an attack or intrusion is in process or has already occurred. a. LFM b. stat IDPS c. AppIDPS d. HIDPS ANSWER: a POINTS: 1 REFERENCES: p. 351 H1: Introduction To Intrusion Detection And Prevention Systems H2: Log File Monitors QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE MODIFIED:

6/24/2021 4:55 PM

69. Which of the following is NOT a described IDPS control strategy? a. centralized b. fully distributed c. partially distributed d. decentralized ANSWER: d POINTS: 1 REFERENCES: p. 361 H1: Introduction To Intrusion Detection And Prevention Systems H2: Deployment and Implementation of an IDPS QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 4:58 PM 70. _____ are decoy systems designed to lure potential attackers away from critical systems. a. Honeypots b. Bastion hosts c. Wasp nests d. Designated targets ANSWER: a POINTS: 1 REFERENCES: p. 367 H1: Honeypots, Honeynets, And Padded Cell Systems QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 71. _____ applications use a combination of techniques to detect an intrusion and then follow it back to its source. a. Honeynet b. Trap-and-trace c. HIDPS d. Packet sniffer ANSWER: b POINTS: 1 REFERENCES: p. 368 H1: Honeypots, Honeynets, And Padded Cell Systems H2: Trap-and-Trace Systems QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE MODIFIED:

6/24/2021 4:58 PM

72. _____ is the action of luring an individual into committing a crime to get a conviction. a. Entrapment b. Enticement c. Intrusion d. Padding ANSWER: a POINTS: 1 REFERENCES: p. 369 H1: Honeypots, Honeynets, And Padded Cell Systems H2: Trap-and-Trace Systems QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 73. In TCP/IP networking, port _____ is not used. a. 0 b. 1 c. 13 d. 1023 ANSWER: a POINTS: 1 REFERENCES: p. 372 H1: Scanning and Analysis Tools H2: Port Scanners QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 74. Which of the following ports is commonly used for the HTTP protocol? a. 20 b. 25 c. 53 d. 80 ANSWER: d POINTS: 1 REFERENCES: p. 372 H1: Scanning and Analysis Tools H2: Port Scanners QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE CREATED: DATE MODIFIED:

9/14/2016 10:45 AM 9/14/2016 10:45 AM

75. The ability to detect a target computer’s _____ is very valuable to an attacker. a. manufacturer b. operating system c. peripherals d. BIOS ANSWER: b POINTS: 1 REFERENCES: p. 373 H1: Scanning and Analysis Tools H2: Operating System Detection Tools QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 76. _____ testing is a straightforward testing technique that looks for vulnerabilities in a program or protocol by feeding random input to the program or a network running the protocol. a. Buzz b. Fuzz c. Spike d. Black ANSWER: b POINTS: 1 REFERENCES: p. 374 H1: Scanning and Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 77. Some vulnerability scanners feature a class of attacks called _____, that are so dangerous they should only be used in a lab environment. a. aggressive b. divisive c. destructive d. disruptive ANSWER: c POINTS: 1 REFERENCES: p. 375 H1: Scanning and Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: Multiple Choice HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:43 PM 78. A _____ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software. a. passive b. aggressive c. active d. secret ANSWER: a POINTS: 1 REFERENCES: p. 376 H1: Scanning and Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 79. A(n) _____ is a software program or hardware appliance that can intercept, copy, and interpret network traffic. a. port scanner b. packet sniffer c. honeypot d. honey packet ANSWER: b POINTS: 1 REFERENCES: p. 377 H1: Scanning and Analysis Tools H2: Packet Sniffer QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:00 PM 80. To use a packet sniffer legally, the administrator must _____. a. be on a network that the organization owns b. be under direct authorization of the network’s owners c. have knowledge and consent of the content’s d. All of these are correct creators ANSWER: d POINTS: 1 REFERENCES: p. 378 H1: Scanning and Analysis Tools Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools H2: Packet Sniffer QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:01 PM Completion 81. A(n) _____ occurs when an attacker attempts to gain entry or disrupt the normal operations of an information system, almost always with the intent to do harm. intrusion ANSWER: POINTS: 1 REFERENCES: p. 338 H1: Introduction To Intrusion Detection And Prevention Systems QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 82. Alarm _____ and compaction is a consolidation of almost identical alarms that happen at close to the same time into a single higher-level alarm. clustering ANSWER: POINTS: 1 REFERENCES: p. 339 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 83. The ongoing activity from alarm events that are accurate and noteworthy but not necessarily significant as potentially successful attacks is called _____. noise ANSWER: POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools H2: IDPS Terminology QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 84. Site _____ awareness is an IDPS’s ability to dynamically modify its configuration in response to environmental activity. policy ANSWER: POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Terminology QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:02 PM 85. IDPSs can also help administrators detect the preambles to attacks; this is known as attack _____. reconnaissance ANSWER: POINTS: 1 REFERENCES: p. 341 H1: Introduction To Intrusion Detection And Prevention Systems H2: Why Use an IDPS? QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:03 PM 86. The _____ port is also known as a switched port analysis (SPAN) port or mirror port. monitoring ANSWER: POINTS: 1 REFERENCES: p. 344 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Completion Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 87. In _____ protocol verification, the higher-order protocols are examined for unexpected packet behavior or improper use. application ANSWER: POINTS: 1 REFERENCES: p. 344 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 88. HIDPSs are also known as system _____ verifiers. integrity ANSWER: POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 89. A(n) _____-based IDPS resides on a particular computer or server and monitors activity only on that system. host ANSWER: POINTS: 1 REFERENCES: p. 348 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 90. Three methods dominate IDPS detection methods: the _____-based approach,(sometimes called knowledge-based detection or misuse detection), the statistical anomaly-based approach, and the stateful packet inspection approach. signature ANSWER: POINTS: 1 REFERENCES: p. 350 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Detection Methods QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:09 PM 91. A signature-based IDPS is sometimes called a(n) _____-based IDPS or misuse detection. knowledge ANSWER: POINTS: 1 REFERENCES: p. 350 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Detection Methods QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:09 PM 92. When the measured activity is outside the baseline parameters, it is said to exceed the _____ level. clipping ANSWER: POINTS: 1 REFERENCES: p. 350 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Detection Methods QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE CREATED: DATE MODIFIED:

9/14/2016 10:45 AM 6/3/2021 6:44 PM

93. The IDPS __________ includes the management software, which collects information from the remote sensors, analyzes the systems or networks, and determines whether the current situation has deviated from the preconfigured baseline. console ANSWER: POINTS: 1 REFERENCES: p. 361 H1: Introduction To Intrusion Detection And Prevention Systems H2: Deployment and Implementation of an IDPS QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:10 PM 94. A(n) _____ system contains pseudo-services that emulate well-known services, but is configured in ways that make it look vulnerable to attacks, in order to lure potential attackers away from critical systems. honeypot ANSWER: POINTS: 1 REFERENCES: p. 367 H1: Honeypots, Honeynets, And Padded Cell Systems QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:11 PM 95. When a collection of honeypots connects several honeypot systems on a subnet, it may be called a(n) _____. honeynet ANSWER: POINTS: 1 REFERENCES: p. 367 H1: Honeypots, Honeynets, And Padded Cell Systems QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools 96. A(n) _____ is a honeypot that has been protected so that it cannot be easily compromised. padded cell ANSWER: POINTS: 1 REFERENCES: p. 367 H1: Honeypots, Honeynets, And Padded Cell Systems QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 97. __________ are applications that record information about outbound communications and are similar to trap-and-trace systems. Pen registers ANSWER: POINTS: 1 REFERENCES: p. 369 H1: Honeypots, Honeynets, And Padded Cell Systems H2: Trap-and-Trace Systems QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:11 PM 98. _____ is the process of attracting attention to a system by placing tantalizing bits of information in key locations. Enticement ANSWER: POINTS: 1 REFERENCES: p. 369 H1: Honeypots, Honeynets, And Padded Cell Systems H2: Trap-and-Trace Systems QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.3 - Define and describe honeypots, honeynets, and padded cell systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 99. The _____ is a series of steps or processes used by an attacker, in a logical sequence, to launch an attack against a target system or network. Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools ANSWER: POINTS: REFERENCES:

attack protocol 1 p. 370 H1: Scanning and Analysis Tools QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:12 PM 100. _____ is a systematic survey of all of the target organization’s Internet addresses to identify the network services offered by the hosts in that range.. Fingerprinting ANSWER: POINTS: 1 REFERENCES: p. 371 H1: Scanning and Analysis Tools QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/24/2021 5:13 PM 101. _____ scanning will allow an Nmap user to bounce a scan across a firewall by using one of the idle DMZ hosts as the initiator of the scan. Idle ANSWER: POINTS: 1 REFERENCES: p. 373 H1: Scanning and Analysis Tools H2: Firewall Analysis Tools QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 102. A(n) _____ vulnerability scanner is one that initiates traffic on the network in order to determine security holes. active ANSWER: POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools REFERENCES:

p. 374 H1: Scanning and Analysis Tools H2: Vulnerability Scanners QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 103. A(n) _____ vulnerability scanner listens in on the network and identifies vulnerable versions of both server and client software. passive ANSWER: POINTS: 1 REFERENCES: H1: Scanning and Analysis Tools H2: Vulnerability Scanners p. 376 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/6/2021 3:43 PM 104. A packet _____ is a software program or hardware appliance that can intercept, copy, and interpret network traffic. sniffer ANSWER: POINTS: 1 REFERENCES: p. 377 H1: Scanning and Analysis Tools H2: Packet Sniffers QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM 105. To secure data in transit across any network, organizations must use _____ to be assured of content privacy. encryption ANSWER: POINTS: 1 REFERENCES: p. 378 H1: Scanning and Analysis Tools Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools H2: Packet Sniffers QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/3/2021 6:44 PM Essay 106. List and describe at least four reasons to acquire and use an IDPS. 1. To prevent problem behaviors by increasing the perceived risk of discovery and ANSWER: punishment for those who would attack or otherwise abuse the system 2. To detect attacks and other security violations that are not prevented by other security measures 3. To detect and deal with the preambles to attacks (commonly experienced as network probes and other "doorknob rattling" activities) 4. To document the existing threat to an organization 5. To act as quality control for security design and administration, especially of large and complex enterprises 6. To provide useful information about intrusions that do take place, allowing improved diagnosis, recovery, and correction of causative factors POINTS: 1 REFERENCES: p. 340 H1: Introduction To Intrusion Detection And Prevention Systems H2: Why Use an IDPS? QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 3/8/2017 10:46 PM 107. List and describe the three advantages of NIDPSs. 1. Good network design and placement of NIDPS devices can enable an organization to ANSWER: use a few devices to monitor a large network. 2. NIDPSs are usually passive devices and can be deployed into existing networks with little or no disruption to normal network operations. 3. NIDPSs are not usually susceptible to direct attack and may not be detectable by attackers. POINTS: 1 REFERENCES: p. 345 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Essay Copyright Cengage Learning. Powered by Cognero.

Page 36

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 3/8/2017 10:46 PM 108. List and describe the four advantages of HIDPSs. 1. An HIDPS can detect local events on host systems and detect attacks that may elude a ANSWER: network-based IDS. 2. An HIDPS functions on the host system, where encrypted traffic will have been decrypted and is available for processing. 3. The use of switched network protocols does not affect an HIDPS. 4. An HIDPS can detect inconsistencies in how applications and systems programs were used by examining the records stored in audit logs. This can enable it to detect some types of attacks, including Trojan horse programs. POINTS: 1 REFERENCES: p. 349 H1: Introduction To Intrusion Detection And Prevention Systems H2: Types of IDPSs QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.1 - Identify and describe the categories and models of intrusion detection and prevention systems DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 3/8/2017 10:47 PM Subjective Short Answer 109. How does a signature-based IDPS differ from a behavior-based IDPS? ANSWER:

A signature-based system looks for patterns of behavior that match a library of known behaviors. A behavior-based system watches for activities that suggest an alert-level activity is occurring, based on sequences of actions or the timing between otherwise unrelated events. POINTS: 1 REFERENCES: p. 350 H1: Introduction To Intrusion Detection And Prevention Systems H2: IDPS Detection Methods QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 6/7/2021 1:54 PM Copyright Cengage Learning. Powered by Cognero.

Page 37

Name:

Class:

Date:

Mod 9 Sec Tech: Intrusion Detec & Prevention Sys and Other Sec Tools DATE MODIFIED:

6/7/2021 1:57 PM

110. What is a SIEM and what is its primary purpose? A security information and event management (SIEM) system is an information ANSWER: management system specifically tasked to collect and correlate events and other log data from a number of servers or other network devices for the purpose of interpreting, filtering, correlating, analyzing, storing, reporting, and acting on the resulting information. A SIEM system supports threat detection and informs many aspects of threat intelligence. It is also instrumental in managing aspects of compliance vulnerability management. It often plays a pivotal role in an organization’s security incident management through data collection and analysis by enabling near real-time and historical analysis of security events. It integrates data from multiple sources, including local events and contextual data sources. POINTS: 1 REFERENCES: p. 352 H2: Security Information and Event Management (SIEM) H1: Introduction To Intrusion Detection And Prevention Systems QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.2 - Describe the detection approaches employed by modern intrusion detection and prevention systems DATE CREATED: 6/7/2021 1:54 PM DATE MODIFIED: 6/7/2021 3:12 PM 111. What is network footprinting and how is it related to network fingerprinting? ANSWER:

Footprinting is organized research of the Internet addresses owned or controlled by a target organization. The attacker uses public Internet data sources to perform keyword searches that identify the network addresses of the organization. This research is augmented by browsing the organization’s Web pages. Web pages usually contain information about internal systems, the people who develop the Web pages, and other tidbits that can be used for social engineering attacks. The fingerprinting phase uses the TCP/IP address ranges that were collected during the footprinting phase to identify the network services offered by the hosts in that range.

POINTS: REFERENCES:

1 p. 371 H1: Scanning And Analysis Tools QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.09.4 - List and define the major categories of scanning and analysis tools and describe the specific tools used within each category DATE CREATED: 6/7/2021 1:54 PM DATE MODIFIED: 6/27/2021 11:52 AM

Copyright Cengage Learning. Powered by Cognero.

Page 38

Name:

Class:

Date:

Mod 10 Cryptography True / False 1. In 1953, Giovan Batista Bellaso introduced the idea of the passphrase (password) as a key for encryption. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Introduction To Cryptography H2: The History of Cryptology P. 385 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 2. In 1917, Gilbert S. Vernam, an AT&T employee, invented a polyalphabetic cipher machine that used a non-repeating random key. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 385 H1: Introduction To Cryptography H2: The History of Cryptology QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 3/9/2017 11:11 PM 3. Sequence encryption is a series of encryptions and decryptions between a number of systems, wherein each system in a network decrypts the message sent to it and then reencrypts it using different keys and sends it to the next neighbor. This process continues until the message reaches the final destination. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 10 Cryptography LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 3/9/2017 11:12 PM 4. The permutation cipher simply rearranges the values within a block to create the ciphertext. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Encryption Methods H2: Transposition Cipher p. 390 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 5. In addition to being credited with inventing a substitution cipher, Julius Caesar was associated with an early version of the transposition cipher. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 391 H1: Encryption Methods H2: Transposition Cipher QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 6. You cannot combine the XOR operation with a block cipher operation. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 391 H1: Encryption Methods H2: Exclusive OR QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 10 Cryptography LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 7. To perform the Caesar cipher encryption operation, the pad values are added to numeric values that represent the plaintext that needs to be encrypted. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 392 H1: Encryption Methods H2: Vernam Cipher QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 8. One encryption method made popular by spy movies is the book cipher, which involves using the text in a book to encrypt and decrypt messages. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 393 H1: Encryption Methods H2: Book-Based Ciphers QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 6/27/2021 11:56 AM 9. Hashing functions require the use of keys. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 10 Cryptography LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 10. A cryptovariable is a value representing the application of a hash algorithm on a message. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 398 H1: Cryptographic Algorithms H2: Encryption Key Size QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 11. A brute force function is a mathematical algorithm that generates a message summary or digest (sometimes called a fingerprint) to confirm message identity and integrity. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 3/9/2017 11:14 PM 12. Popular cryptosystems use a hybrid combination of symmetric and asymmetric algorithms. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Cryptographic Tools H2: Hybrid Cryptography Systems p. 403 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 10 Cryptography

DATE CREATED: DATE MODIFIED:

cryptographic tools 9/14/2016 10:45 AM 9/14/2016 10:45 AM

13. Adopted by NIST in 1976 as a federal standard, DES uses a 64-bit block size and key. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 396 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:45 AM DATE MODIFIED: 9/14/2016 10:45 AM 14. 3DES was created to offer the same strength as the DES algorithm but ran three times as fast, thus saving time. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 396 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 9/14/2016 10:46 AM 15. The AES algorithm was the first public-key encryption algorithm to use a 256-bit key length. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 398 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 10 Cryptography DATE MODIFIED:

3/9/2017 11:15 PM

16. When an asymmetric cryptographic process uses the sender’s private key to encrypt a message, the sender’s public key must be used to decrypt the message. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 397 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 9/14/2016 10:46 AM 17. Asymmetric encryption systems use a single key to both encrypt and decrypt a message. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 397 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:15 PM 18. Usually, as the length of a cryptovariable increases, the number of random guesses that have to be made in order to break the code is reduced. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 399 H1: Cryptographic Algorithms H2: Encryption Key Size QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 10 Cryptography DATE MODIFIED:

3/9/2017 11:16 PM

19. PKI systems are based on public-key cryptosystems and include digital certificates and certificate authorities. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 401 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:21 PM 20. The registration authority (RA) is a third party that issues, manages, authenticates, signs, and revokes users’ digital certificates. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 401 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 11:56 AM 21. Nonrepudiation means that customers or partners can be held accountable for transactions, such as online purchases, which they cannot later deny. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 400 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 10 Cryptography

DATE CREATED: DATE MODIFIED:

cryptographic tools 9/14/2016 10:46 AM 9/14/2016 10:46 AM

22. The most common hybrid system is based on the Diffie-Hellman key exchange, which is a method for exchanging private keys using public-key encryption. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 403 H1: Cryptographic Tools H2: Hybrid Cryptography Systems QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:17 PM 23. Steganography is a data hiding method that involves embedding information within other files, such as digital pictures or other images. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 404 H1: Cryptographic Tools H2: Steganography QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 9/14/2016 10:46 AM 24. Standard HTTP (S-HTTP) is an extended version of the Hypertext Transfer Protocol that provides for the encryption of individual messages transmitted via the Internet between a client and server using AES over HTTP. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Protocols For Secure Communications H2: Securing Internet Communication with HTTPS and SSL p. 405 Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 10 Cryptography QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 11:57 AM 25. SSL builds on the encoding format of the digital encryption standard (DES) protocol and uses digital signatures based on public-key cryptosystems to secure e-mail. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 407 H1: Protocols For Secure Communications H2: Securing E-Mail with S/MIME, PEM, and PGP QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:03 PM 26. Bluetooth is a de facto industry standard for short-range wireless communications between devices. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 409 H1: Protocols For Secure Communications H2: Securing Wireless Networks with WPA and RSN QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 9/14/2016 10:46 AM 27. Secure Electronic Transactions was developed by MasterCard and Visa in 1997 to protect against electronic payment fraud. a. True b. False ANSWER: True POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 10 Cryptography REFERENCES:

p. 409 H1: Protocols For Secure Communications H2: Securing Web Transactions with SET, SSL, and HTTPS QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:26 PM 28. The encapsulating security payload protocol provides secrecy for the contents of network communications as well as system-to-system authentication and data integrity verification. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 9/14/2016 10:46 AM 29. The HTTPS security solution provides six services: authentication by digital signatures, message encryption, compression, e-mail compatibility, segmentation, and key management. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 412 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/14/2021 7:27 PM 30. Internet Protocol Security (IPSec) is an open-source protocol framework for security development within the TCP/IP family of protocols. a. True Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 10 Cryptography b. False ANSWER: POINTS: REFERENCES:

True 1 p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:27 PM Modified True / False 31. Encryption is the process of converting the ciphertext message back into plaintext so that it can be readily understood. _____ ANSWER: False - Decryption POINTS: 1 REFERENCES: P. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 32. A(n) key is the set of steps used to convert an unencrypted message into an encrypted sequence of bits that represent the message; it sometimes refers to the programs that enable the cryptographic processes. _____ ANSWER: False - algorithm POINTS: 1 REFERENCES: p. 385 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 10 Cryptography 33. To encipher means to decrypt, decode, or convert ciphertext into the equivalent plaintext. _____ ANSWER: False - decipher POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 34. Ciphertext or a cryptogram is an encoded message, or a message that has been successfully encrypted. _____ ANSWER: True POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 35. In a book cipher, the key consists of a list of codes representing the page number, line number, and word number of the plaintext word. _____ ANSWER: False - ciphertext False - cryptogram False - encrypted text POINTS: 1 REFERENCES: p. 393 H1: Encryption Methods H2: Book-Based Ciphers QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:04 PM 36. Hash algorithms are mathematical functions that create a message digest by converting variable-length messages into Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 10 Cryptography a single fixed-length value. _____ ANSWER: True POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Book-Based Ciphers QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:05 PM 37. A multipart authentication code (MAC) is a key-dependent, one-way hash function that allows only specific recipients (symmetric key holders) to access the message digest. _____ ANSWER: False - message POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Book-Based Ciphers QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 38. Encryption methodologies that require the same secret key to encipher and decipher the message are using public-key encryption. _____ False - private ANSWER: POINTS: 1 REFERENCES: p. 396 H1: Cryptography Algorithms H2: Symmetric Encryption QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:06 PM 39. PKI is the a federal information processing standard that specifies a cryptographic algorithm developed to replace both DES and 3DES. _____ ANSWER: False - AES False - Advanced Encryption Standard Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 10 Cryptography False - Advanced Encryption Standard (AES) POINTS: 1 REFERENCES: p. 396 H1: Cryptography Algorithms H2: Symmetric Encryption QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:07 PM 40. AES implements a block cipher called the Rijndael Block Cipher with a variable block length and a key length of 128, 192 or 256 bits. _____ ANSWER: True POINTS: 1 REFERENCES: p. 397 H1: Cryptography Algorithms H2: Symmetric Encryption QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:08 PM 41. Symmetric encryption uses two different but related keys, and either key can be used to encrypt or decrypt the message. _____ ANSWER: False - Asymmetric POINTS: 1 REFERENCES: p. 396 H1: Cryptography Algorithms H2: Asymmetric Encryption QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 42. Within a PKI, a(n) registration authority issues, manages, authenticates, signs, and revokes users’ digital certificates, which typically contain the user name, public key, and other identifying information. _____ ANSWER: False - certificate POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 10 Cryptography REFERENCES:

p. 401 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 43. The Digital Signature Standard established by NIST is used for electronic document authentication by federal information systems. It is based on a variant of the ElGamal algorithm. _____ ANSWER: True POINTS: 1 REFERENCES: p. 402 H1: Cryptographic Tools H2: Digital Signatures QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 44. A(n) distinguished name uniquely identifies a certificate entity to a user’s public key. _____ ANSWER: True POINTS: 1 REFERENCES: p. 403 H1: Cryptographic Tools H2: Digital Certificates QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 45. Diffie-Hellman key exchange uses asymmetric encryption to exchange session keys - limited use symmetric keys for temporary communications.. _____ ANSWER: True POINTS: 1 REFERENCES: p. 403 Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 10 Cryptography H1: Cryptographic Tools H2: Hybrid Cryptography Systems QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:09 PM 46. The number of horizontal and vertical pixels captured and recorded is known as an image’s contrast. _____ ANSWER: False - resolution POINTS: 1 REFERENCES: p. 403 H1: Cryptographic Tools H2: Steganography QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:09 PM 47. The most popular modern version of steganography involves hiding information within files that contain digital pictures or other images. _____ ANSWER: True POINTS: 1 REFERENCES: p. 403 H1: Cryptographic Tools H2: Steganography QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 48. HTTPS is an extended version of Hypertext Transfer Protocol that provides for the encryption of protected e-mail transmitted via the Internet between a client and server. _____ ANSWER: False - Web pages POINTS: 1 REFERENCES: p. 406 H1: Protocols For Secure Communications Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 10 Cryptography H2: Securing Internet Communication with HTTPS and SSL QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/14/2021 7:43 PM 49. Privacy Enhanced Mail was proposed by the Internet Engineering Task Force and is a standard that uses 3DES symmetric key encryption and RSA for key exchanges and digital signatures. _____ ANSWER: True POINTS: 1 REFERENCES: p. 407 H1: Protocols For Secure Communications H2: Securing E-Mail with S/MIME, PEM, and PGP QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 50. Secure Multipurpose Internet Mail Extensions builds on the encoding format of the MIME protocol and uses digital signatures based on public-key cryptosystems to secure e-mail. _____ ANSWER: True POINTS: 1 REFERENCES: p. 407 H1: Protocols For Secure Communications H2: Securing E-Mail with S/MIME, PEM, and PGP QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 51. PGP is a de facto industry standard for short-range wireless communications between devices. _____ ANSWER: False - Bluetooth POINTS: 1 REFERENCES: p. 409 H1: Protocols For Secure Communications H2: Securing Wireless Networks with WPA and RSN Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 10 Cryptography QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:10 PM 52. Internet Protocol Security is designed to protect data integrity, user confidentiality, and authenticity at the IP packet level. _____ ANSWER: True POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM 53. In transport mode IPSec the entire IP packet is encrypted and is then placed as the content portion of another IP packet. _____ False - tunnel ANSWER: POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:11 PM 54. The authentication header (AH) protocol provides secrecy for the contents of network communications as well as system-to-system authentication and data integrity verification. _____ False - encapsulating security payload (ESP) ANSWER: False - encapsulating security payload False - ESP POINTS: 1 REFERENCES: p. 410 Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 10 Cryptography H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:12 PM 55. Pretty Good Privacy (PGP) uses the freeware ZIP algorithm to compress the message after it has been digitally signed but before it is encrypted. _____ ANSWER: True POINTS: 1 REFERENCES: p. 412 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:00 PM Multiple Choice 56. _____ is the process of converting an original message into a form that is unreadable to unauthorized individuals. a. Encryption b. Decryption c. Cryptology d. Cryptography ANSWER: a POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 57. _____ is the entire range of values that can possibly be used to construct an individual key. a. Code b. Keyspace c. An algorithm d. A cryptogram Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 10 Cryptography ANSWER: POINTS: REFERENCES:

b 1 p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 58. _____ is the amount of effort (usually in hours) required to perform cryptanalysis to decode an encrypted message when the key or algorithm (or both) are unknown. a. Cryptology b. Decryption c. Cryptography d. Work factor ANSWER: d POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:13 PM 59. A _____ is the information used in conjunction with an algorithm to create the ciphertext from the plaintext or derive the plaintext from the ciphertext. a. password b. cipher c. key d. passphrase ANSWER: c POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 60. Bit stream methods commonly use algorithm functions like the _____ OR operation. Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 10 Cryptography a. exclusive c. extensive ANSWER: POINTS: REFERENCES:

b. extreme d. enhanced a 1 p. 386 H1: Encryption Methods QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:15 PM 61. More advanced substitution ciphers use two or more alphabets, and are referred to as _____ substitutions. a. pollysyllabic b. monoalphabetic c. polyalphabetic d. polynomic ANSWER: c POINTS: 1 REFERENCES: p. 387 H1: Encryption Methods H2: Substitution Cipher QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:15 PM 62. _____ functions are mathematical algorithms that generate a message summary or digest to confirm the identity of a specific message and to confirm that there have not been any changes to the content. a. Hash b. MAC c. Key d. Encryption ANSWER: a POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:16 PM 63. A _____ is a key-dependent, one-way hash function that allows only specific recipients (symmetric key holders) to access the message digest. a. signature b. MAC Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 10 Cryptography c. fingerprint ANSWER: POINTS: REFERENCES:

d. digest

b 1 p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 64. SHA-1 produces a(n) _____-bit message digest, which can then be used as an input to a digital signature algorithm. a. 48 b. 56 c. 160 d. 256 ANSWER: c POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:02 PM 65. Using a database of precomputed hashes from sequentially calculated passwords called a(n) _____, an attacker can simply look up a hashed password and read out the text version. a. hash matrix b. smurf list c. rainbow table d. hashapedia ANSWER: c POINTS: 1 REFERENCES: p. 395 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:17 PM 66. A method of encryption that requires the same secret key to encipher and decipher the message is known as _____ encryption. a. asymmetric b. symmetric Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 10 Cryptography c. public ANSWER: POINTS: REFERENCES:

d. hash

b 1 p. 396 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:18 PM 67. _____ is the current federal information processing standard that specifies a cryptographic algorithm used within the U.S. government to protect information in federal agencies that are not a part of the national defense infrastructure. a. DES b. 2DES c. AES d. 3DES ANSWER: c POINTS: 1 REFERENCES: p. 397 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 68. DES uses a(n) _____-bit block size. a. 32 b. 64 c. 128 d. 256 ANSWER: b POINTS: 1 REFERENCES: p. 396 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:02 PM 69. The _____ algorithm, developed in 1977, was the first public-key encryption algorithm published for commercial use. a. DES b. RSA c. MAC d. AES Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 10 Cryptography ANSWER: POINTS: REFERENCES:

b 1 p. 398 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 70. _____ is an integrated system of software, encryption methodologies, protocols, legal agreements, and third-party services that enables users to communicate securely. a. MAC b. PKI c. DES d. AES ANSWER: b POINTS: 1 REFERENCES: p. 400 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 71. In PKI, the CA periodically distributes a(n) _____ to all users that identifies all revoked certificates. a. CRL b. RA c. MAC d. RDL ANSWER: a POINTS: 1 REFERENCES: p. 401 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 72. _____ are encrypted message components that can be mathematically proven to be authentic. a. Digital signatures b. MACs Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 10 Cryptography c. Message certificates ANSWER: POINTS: REFERENCES:

d. Message digests a 1 p. 402 H1: Cryptographic Tools H2: Digital Signatures QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 73. Digital signatures should be created using processes and products that are based on the _____. a. DSS b. NIST c. SSL d. HTTPS ANSWER: a POINTS: 1 REFERENCES: p. 402 H1: Cryptographic Tools H2: Digital Signatures QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 74. An X.509 v3 certificate binds a _____, which uniquely identifies a certificate entity, to a user’s public key. a. message digest b. fingerprint c. distinguished name d. digital signature ANSWER: c POINTS: 1 REFERENCES: p. 403 H1: Cryptographic Tools H2: Digital Certificates QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:02 PM 75. The _____ is responsible for the fragmentation, compression, encryption, and attachment of an SSL header to the cleartext prior to transmission. Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 10 Cryptography a. Standard HTTP c. HTTPS ANSWER: POINTS: REFERENCES:

b. SFTP d. SSL Record Protocol d 1 p. 406 H1: Protocols For Secure Communications H2: Securing Internet Communication with HTTPS and SSL QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/14/2021 8:04 PM 76. At the World Championships in Athletics in Helsinki in August 2005, a virus called Cabir infected dozens of _____, the first time this occurred in a public setting. a. iPad tablets b. Bluetooth mobile phones c. WiFi routers d. hearing aids ANSWER: b POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing Wireless Networks with WPA and RSN QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:18 PM 77. _____ is an open-source protocol framework that can be used to secure communications across any IP-based network such as LANs, WANs, and the Internet. a. PEM b. SSH-2 c. IPSec d. SET ANSWER: c POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 10 Cryptography DATE MODIFIED:

6/27/2021 12:19 PM

78. The _____ protocol provides system-to-system authentication and data integrity verification, but does not provide secrecy for the content of a network communication. a. ESP b. AH c. HA d. SEP ANSWER: b POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 79. _____ was developed by Phil Zimmermann and uses the IDEA cipher for message encoding. a. PEM b. PGP c. S/MIME d. SSL ANSWER: b POINTS: 1 REFERENCES: p. 407 H1: Protocols For Secure Communications H2: Securing E-Mail with S/MIME, PEM, and PGP QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 80. _____ is a hybrid cryptosystem that combines some of the best available cryptographic algorithms and has become the open-source de facto standard for encryption and authentication of e-mail and file storage applications. a. PGP b. DES c. AH d. ESP ANSWER: a POINTS: 1 REFERENCES: p. 412 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 10 Cryptography

DATE CREATED: DATE MODIFIED:

communications 9/14/2016 10:46 AM 6/6/2021 4:01 PM

Completion 81. The process of obtaining the plaintext message from a ciphertext message without knowing the keys used to perform the encryption is called _____. cryptanalysis ANSWER: POINTS: 1 REFERENCES: H1: Introduction To Cryptography p. 384 QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 2/1/2017 6:50 PM DATE MODIFIED: 6/6/2021 4:02 PM 82. The science of encryption is known as _____. cryptology ANSWER: POINTS: 1 REFERENCES: p. 384 H1: Introduction To Cryptography QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 83. _____ is the process of making and using codes to secure the transmission of information. Cryptography ANSWER: POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 10 Cryptography DATE MODIFIED:

6/6/2021 4:01 PM

84. A(n) _____ or cryptosystem is an encryption method or process encompassing the algorithm, key(s) or cryptovariable(s), and procedures used to perform encryption and decryption. cipher ANSWER: POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 85. To _____ means to encrypt, encode, or convert plaintext into the equivalent ciphertext. encipher ANSWER: POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 86. The process of hiding messages within the digital encoding of a picture or graphic is called _____. steganography ANSWER: POINTS: 1 REFERENCES: p. 386 H1: Introduction To Cryptography H2: Key Cryptology Terms QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 10 Cryptography 87. In a(n) _____ cipher, you replace one value with another. substitution ANSWER: POINTS: 1 REFERENCES: p. 387 H1: Encryption Methods H2: Substitution Cipher QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:20 PM 88. A(n) _____ substitution uses one alphabet. monoalphabetic ANSWER: POINTS: 1 REFERENCES: p. 387 H1: Encryption Methods H2: Substitution Cipher QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 89. The _____ cipher simply rearranges the values within a block to create the ciphertext. transposition ANSWER: permutation POINTS: 1 REFERENCES: p. 390 H1: Encryption Methods H2: Transposition Cipher QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 90. The _____ operation is a function of Boolean algebra in which two bits are compared, and if the two bits are identical, the result is a binary 0. exclusive OR ANSWER: XOR exclusive OR (XOR) Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 10 Cryptography POINTS: REFERENCES:

1 p. 391 H1: Encryption Methods H2: Exclusive OR QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:21 PM 91. Also known as the one-time pad, the _____ cipher, which was developed at AT&T, uses a set of characters only one time for each encryption process. Vernam ANSWER: POINTS: 1 REFERENCES: p. 392 H1: Encryption Methods H2: Vernam Cipher QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 92. A message _____ is a fingerprint of the author’s message that is compared with the recipient’s locally calculated hash of the same message. digest ANSWER: POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 93. Hashing functions do not require the use of keys, but it is possible to attach a message _____ code to allow only specified recipients to access the message digest. authentication ANSWER: POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 10 Cryptography H2: Hash Functions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:22 PM 94. The Secure _____ Standard issued by the National Institute of Standards and Technology specifies secure algorithms, such as SHA-1, for computing a condensed representation of a message or data file. Hash ANSWER: POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 95. One of the most widely known cryptographic algorithms is the _____, which was developed by IBM and is based on the company’s Lucifer algorithm. DES ANSWER: Data Encryption Standard POINTS: 1 REFERENCES: p. 396 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 96. The successor to 3DES is the _____ Encryption Standard. Advanced ANSWER: POINTS: 1 REFERENCES: p. 397 H1: Cryptographic Algorithms H2: Symmetric Encryption QUESTION TYPE: Completion Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 10 Cryptography HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 97. The more common name for asymmetric encryption is _____-key encryption. public ANSWER: POINTS: 1 REFERENCES: p. 397 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 98. A mathematical _____ is a secret mechanism that enables you to easily accomplish the reverse function in a one-way function. trapdoor ANSWER: POINTS: 1 REFERENCES: p. 398 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 99. In the context of a PKI, a(n) _____ authority operates under the trusted collaboration of the certificate authority and can be delegated day-to-day certification functions, such as verifying registration information about new registrants, generating end-user keys, revoking certificates, and validating that users possess a valid certificate. registration ANSWER: POINTS: 1 REFERENCES: p. 401 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 10 Cryptography LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 100. Digital _____ are public-key container files that allow computer programs to validate the key and identify to whom it belongs. certificates ANSWER: POINTS: 1 REFERENCES: p. 400 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 101. Digital _____ are encrypted messages that can be mathematically proven to be authentic. signatures ANSWER: POINTS: 1 REFERENCES: p. 402 H1: Cryptographic Tools H1: Cryptographic Tools QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 102. A digital _____ is an electronic document or container file that contains a key value and identifying information about the entity that controls the key. certificate ANSWER: POINTS: 1 REFERENCES: p. 402 H1: Cryptographic Tools H2: Digital Certificates QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 10 Cryptography

DATE CREATED: DATE MODIFIED:

cryptographic tools 9/14/2016 10:46 AM 6/6/2021 4:01 PM

103. Netscape developed the _____ Layer protocol to use public-key encryption to secure a channel over the Internet, thus enabling secure communications. Secure Socket ANSWER: Secure Sockets POINTS: 1 REFERENCES: p. 405 H1: Protocols For Secure Communications H2: Securing Internet Communication with HTTPS and SSL QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 104. In IPSec _____ mode, only the IP data is encrypted, not the IP headers. transport ANSWER: POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/6/2021 4:01 PM 105. The encapsulating security _____ protocol provides secrecy for the contents of network communications as well as system-to-system authentication and data integrity verification. payload ANSWER: POINTS: 1 REFERENCES: p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 10 Cryptography

DATE CREATED: DATE MODIFIED:

communications 9/14/2016 10:46 AM 6/6/2021 4:01 PM

106. Originally released as freeware, _____ is a hybrid cryptosystem that combines some of the best available cryptographic algorithms as an open-source de facto standard for encryption and authentication of e-mail and file storage. Pretty Good Privacy ANSWER: PGP Pretty Good Privacy (PGP) POINTS: 1 REFERENCES: p. 412 H1: Protocols For Secure Communications H1: Protocols For Secure Communications QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 6/27/2021 12:23 PM Essay 107. Describe how hash functions work and what they are used for. Hash functions are mathematical algorithms that generate a message summary or digest to ANSWER: confirm the identity of a specific message and to confirm that there have not been any changes to the content. While they do not create ciphertext, hash functions confirm message identity and integrity, both of which are critical functions in e-commerce. Hashing functions do not require the use of keys, but it is possible to attach a message authentication code (MAC)—a key-dependent, one-way hash function—that allows only specific recipients (symmetric key holders) to access the message digest. POINTS: 1 REFERENCES: p. 394 H1: Encryption Methods H2: Hash Functions QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:41 PM 108. Describe symmetric and asymmetric encryption. Symmetric Encryption. Encryption methodologies that require the same secret key to ANSWER: encipher and decipher the message use what is called private-key encryption or symmetric Copyright Cengage Learning. Powered by Cognero.

Page 36

Name:

Class:

Date:

Mod 10 Cryptography encryption. Symmetric encryption methods use mathematical operations that can be programmed into extremely fast computing algorithms so that the encryption and decryption processes are executed quickly, even by small computers. The primary challenge of symmetric key encryption is getting the key to the receiver, a process that must be conducted out of band (meaning through a channel or band other than the one carrying the ciphertext) to avoid interception. Asymmetric Encryption. Another category of encryption techniques is asymmetric encryption. While symmetric encryption systems use a single key both to encrypt and decrypt a message, asymmetric encryption uses two different but related keys, and either key can be used to encrypt or decrypt the message. Asymmetric encryption can be used to provide elegant solutions to problems of secrecy and verification. This technique has its highest value when one key is used as a private key, which means that it is kept secret (much like the key of symmetric encryption), known only to the owner of the key pair, and the other key serves as a public key, which means that it is stored in a public location where anyone can use it. POINTS: 1 REFERENCES: p. 397 H1: Cryptographic Algorithms H2: Asymmetric Encryption QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.2 - Explain the basic principles of cryptography DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 3/9/2017 11:42 PM 109. Describe digital certificates. Digital certificates are public-key container files that allow computer programs to validate ANSWER: the key and identify to whom it belongs. The certificate is often issued and certified by a third party, usually a certificate authority. A digital signature attached to the certificate’s container file certifies the file’s origin and integrity. A certificate authority (CA) issues, manages, authenticates, signs, and revokes users’ digital certificates, which typically contain the user name, public key, and other identifying information. POINTS: 1 REFERENCES: p. 402 H1: Cryptographic Tools H2: Digital Certificates QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 9/14/2016 10:46 AM DATE MODIFIED: 9/14/2016 10:46 AM Subjective Short Answer Copyright Cengage Learning. Powered by Cognero.

Page 37

Name:

Class:

Date:

Mod 10 Cryptography 110. What are cryptography and cryptanalysis? ANSWER:

The science of encryption, known as cryptology, encompasses cryptography, and cryptanalysis. Cryptography is the process of making and using codes to secure information. Cryptanalysis is the process of obtaining the plaintext message from a ciphertext message without knowing the keys used to perform the encryption.

POINTS: REFERENCES:

1 p. 384 H1: Introduction To Cryptography QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.1 - Chronicle the most significant events and discoveries in the history of cryptology DATE CREATED: 6/15/2021 5:16 PM DATE MODIFIED: 6/27/2021 12:23 PM 111. What are the components and benefits of PKI? ANSWER:

Public key infrastructure (PKI) systems are based on public-key cryptosystems and include digital certificates and certificate authorities (CAs). Digital certificates allow the PKI components and their users to validate keys and identify key owners. Certificate authorities In PKI, are third parties that manages users’ digital certificates. PKI allows the implementation of several key characteristics of information security, including authentication, integrity, privacy, authorization, and nonrepudiation.

POINTS: REFERENCES:

1 p. 400 H1: Cryptographic Tools H2: Public Key Infrastructure (PKI) QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.3 - Describe the operating principles of the most popular cryptographic tools DATE CREATED: 6/15/2021 5:18 PM DATE MODIFIED: 6/27/2021 12:25 PM 112. What is IPSec and what are its two operating modes? IP Security (IPSec) is an open-source protocol framework for security development within ANSWER: the TCP/IP family of protocol standards. Copyright Cengage Learning. Powered by Cognero.

Page 38

Name:

Class:

Date:

Mod 10 Cryptography It is used to secure communications across IP-based networks such as LANs, WANs, and the Internet. IPSec operates in two modes: transport and tunnel. In transport mode, only the IP data is encrypted, not the IP headers. This allows intermediate nodes to read the source and destination addresses. In tunnel mode, the entire IP packet is encrypted and then placed into the content portion of another IP packet. This requires other systems at the beginning and end of the tunnel to act as proxies to send and receive the encrypted packets. These systems then transmit the decrypted packets to their true destinations. POINTS: REFERENCES:

1 p. 410 H1: Protocols For Secure Communications H2: Securing TCP/IP with IPSec and PGP QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.10.4 - List and explain the major protocols used for secure communications DATE CREATED: 6/15/2021 5:19 PM DATE MODIFIED: 6/27/2021 12:26 PM

Copyright Cengage Learning. Powered by Cognero.

Page 39

Name:

Class:

Date:

Mod 11 Implementing Information Security True / False 1. The implementation phase is the longest and most expensive phase of the systems development life cycle (SDLC). a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The Systems Development Life Cycle H2: Traditional Development Methods p. 421 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 9/14/2016 10:29 AM 2. The investigation phase of the SDLC involves specification of the objectives, constraints, and scope of the project. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 420 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 6/27/2021 5:54 PM 3. The physical design is the blueprint for the desired solution. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 420 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 11 Implementing Information Security DATE MODIFIED:

9/14/2016 10:29 AM

4. In the physical design phase, specific technologies are selected. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 420 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 12/4/2016 2:19 PM 5. The water-ski model is a type of SDLC in which each phase of the process flows from the information gained in the previous phase, with multiple opportunities to return to previous phases and make adjustments. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 419 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 12/4/2016 2:23 PM 6. The project plan as a whole must describe how to acquire and implement the needed security controls and create a setting in which those controls achieve the desired outcomes. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Information Security Project Management H2: Developing the Project Plan p. 429 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 11 Implementing Information Security

DATE CREATED: DATE MODIFIED:

success of an information security project 9/14/2016 10:48 AM 9/14/2016 10:48 AM

7. In general, the design phase is accomplished by changing the configuration and operation of the organization’s information systems to make them more secure. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 428 H1: Information Security Project Management QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 8. Planning for the implementation phase of a security project requires the creation of a detailed project plan. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 9. Each organization has to determine its own project management methodology for IT and information security projects. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Information Security Project Management p. 429 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 11 Implementing Information Security

DATE CREATED: DATE MODIFIED:

success of an information security project 9/14/2016 10:48 AM 9/14/2016 10:48 AM

10. The first step in the work breakdown structure (WBS) is to break down the project plan into its action steps. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Information Security Project Management H2: Developing the Project Plan p. 429 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:21 PM 11. The work breakdown structure (WBS) can only be prepared with a complex, specialized desktop PC application. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management H2: Developing the Project Plan LO: 11.2 H2: Developing the Project Plan QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 3/10/2017 8:20 AM 12. Planners need to estimate the effort required to complete each task, subtask, or action step in the project plan. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 431 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: True / False Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 11 Implementing Information Security HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 3/10/2017 8:20 AM 13. To justify the amount budgeted for a security project, it may be useful for the organization to adopt the budgets of larger, more successful organizations. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Information Security Project Management H2: Project Planning Considerations p. 433 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:22 PM 14. The budgets of public organizations are usually the product of legislation or public meetings. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 15. The need for qualified, trained, and available personnel constrains the project plan. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Information Security Project Management H2: Project Planning Considerations p. 433 Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 11 Implementing Information Security QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 16. The size of the organization and the normal conduct of business may preclude a large training program on new security procedures or technologies. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 434 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 17. All organizations should designate a champion from the general management community of interest to supervise the implementation of an information security project plan. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Information Security Project Management H2: The Need for Project Management p. 434 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 18. When an estimate is flawed, as when the number of effort-hours required is underestimated, the plan should be corrected and downstream tasks updated to reflect the change. a. True b. False ANSWER: True POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 11 Implementing Information Security REFERENCES:

H1: Information Security Project Management H2: The Need for Project Management p. 435 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 19. The primary drawback to the direct changeover approach is that if the new system fails or needs modification, users may be without services while the system’s bugs are worked out. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Technical Aspects Of Implementation H2: Conversion Strategies p. 437 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 20. The networks layer of the bull’s eye is the outermost ring of the bull’s eye. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 3/10/2017 8:21 AM 21. The bull’s-eye model can be used to evaluate the sequence of steps taken to integrate parts of the information security blueprint into a project plan. a. True b. False Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 11 Implementing Information Security ANSWER: POINTS: REFERENCES:

True 1 p. 439 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 3/10/2017 8:21 AM 22. As dictated by the bull’s-eye model, until sound and usable IT and information security policies are developed, communicated, and enforced, no additional resources should be spent on other controls. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:23 PM 23. Every organization needs to develop an information security department or program of its own. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 439 H1: Technical Aspects Of Implementation H2: To Outsource or Not QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 24. "Unfreezing" in the Lewin change model involves thawing hard-and-fast habits and established procedures. a. True Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 11 Implementing Information Security b. False ANSWER: POINTS: REFERENCES:

True 1 H1: Nontechnical Aspects Of Implementation H2: The Culture of Change Management p. 442 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 3/10/2017 8:22 AM 25. Weak management support, with overly delegated responsibility and no champion, sentences a project to almostcertain failure. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 443 H1: Nontechnical Aspects Of Implementation H2: Considerations for Organizational Change QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM Modified True / False 26. The Security Development Life Cycle (SDLC) is a general methodology for the design and implementation of an information system. _____ False - Systems ANSWER: POINTS: 1 REFERENCES: p. 419 H1: The Systems Development Life Cycle QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 6/6/2021 4:07 PM Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 11 Implementing Information Security 27. The Analysis phase of the SDLC examines the event or plan that initiates the process and specifies the objectives, constraints, and scope of the project. _____ ANSWER: False - Investigation POINTS: 1 REFERENCES: p. 420 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 6/6/2021 4:07 PM 28. SecOps focuses on integrating the need for the development team to provide iterative and rapid improvements to system functionality and the need for the operations team to improve security and minimize the disruption from software release cycles. _____ False - DevOps ANSWER: POINTS: 1 REFERENCES: p. 419 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:29 AM DATE MODIFIED: 6/27/2021 6:23 PM 29. Performance management is the process of identifying and controlling the resources applied to a project as well as measuring progress and adjusting the process as progress is made toward the goal. _____ False - Project ANSWER: POINTS: 1 REFERENCES: p. 428 H1: Information Security Project Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 11 Implementing Information Security 30. Planning for the implementation phase requires the creation of a detailed request for proposal, which is often assigned either to a project manager or the project champion. _____ ANSWER: False - project plan POINTS: 1 REFERENCES: p. 431 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM 31. In project planning, the tasks or action steps that come before the specific task at hand are commonly referred to as milestones. _____ ANSWER: False - predecessors POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:24 PM 32. A task or subtask becomes a(n) action step when it can be completed by one individual or skill set and when it includes a single deliverable. _____ ANSWER: True POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 11 Implementing Information Security 33. In the early stages of planning, the project planner should attempt to specify completion dates only for major action steps within the project. _____ ANSWER: False - milestones POINTS: 1 REFERENCES: p. 431 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:24 PM 34. The RFP determines the impact that a specific technology or approach can have on the organization’s information assets and what it may cost. _____ ANSWER: False - cost-benefit analysis False - CBA False - cost-benefit analysis (CBA) False - cost benefit analysis False - cost benefit analysis (CBA) False - (CBA) cost-benefit analysis False - (CBA) cost benefit analysis POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM 35. The optimal time frame for training is usually one to three weeks before the new policies and technologies come online. _____ ANSWER: True POINTS: 1 REFERENCES: p. 434 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 11 Implementing Information Security LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:25 PM 36. Most information security projects require a trained project developer - CISO or a skilled IT manager who is trained in project management techniques. _____ False - manager ANSWER: POINTS: 1 REFERENCES: p. 434 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:26 PM 37. Once a project is underway, it is managed using a process known as gap analysis, which ensures that progress is measured periodically. _____ ANSWER: True POINTS: 1 REFERENCES: p. 435 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM 38. Corrective action decisions are usually expressed in terms of trade-offs. _____ ANSWER: True POINTS: 1 REFERENCES: p. 435 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 11 Implementing Information Security

DATE CREATED: DATE MODIFIED:

complex projects 9/14/2016 10:48 AM 6/6/2021 4:07 PM

39. A direct changeover is also known as going “fast turnkey.” _____ ANSWER: False - cold turkey POINTS: 1 REFERENCES: H1: Technical Aspects Of Implementation H2: Conversion Strategies p. 437 QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM 40. The primary drawback to the direct changeover approach is that if the new system fails or needs modification, users may be without services while the system’s bugs are worked out. _____ ANSWER: True POINTS: 1 REFERENCES: p. 437 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:27 PM 41. The parallel operations strategy works well when an isolated group can serve as a test area, which prevents any problems with the new system dramatically interfering with the performance of the organization as a whole. _____ ANSWER: False - pilot implementation POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 11 Implementing Information Security DATE CREATED: DATE MODIFIED:

9/14/2016 10:48 AM 6/6/2021 4:07 PM

42. A proven method for prioritizing a program of complex change is the bull’s-eye method. _____ ANSWER: True POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:07 PM 43. An ideal organization fosters resilience to change, meaning the the organization understands that change is a necessary part of the culture and that embracing change is more productive than fighting it.. _____ ANSWER: True POINTS: 1 REFERENCES: p. 443 H1: Nontechnical Aspects Of Implementation H2: Considerations for Organizational Change QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:27 PM Multiple Choice 44. A methodology and formal development strategy for the design and implementation of an information system is referred to as a _____. a. systems design b. development life project c. systems development life cycle d. systems schema ANSWER: c POINTS: 1 REFERENCES: p. 418 H1: Introduction To Information Security Implementation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 11 Implementing Information Security

DATE CREATED: DATE MODIFIED:

becomes a project plan 9/14/2016 10:30 AM 6/6/2021 4:06 PM

45. An emerging methodology to integrate the effort of the development team and the operations team to improve the functionality and security of applications is known as _____. a. SecSDLC b. DevOps c. JAD/RAD d. SecOps ANSWER: b POINTS: 1 REFERENCES: p. 419 H1: Introduction To Information Security Implementation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/27/2021 6:28 PM 46. A type of SDLC in which each phase has results that flow into the next phase is called the _____ model. a. agile b. SA&D c. waterfall d. Method 7 ANSWER: c POINTS: 1 REFERENCES: p. 419 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/27/2021 6:28 PM 47. During the _____ phase, specific technologies are selected to support the alternatives identified and evaluated in the prior phases. a. investigation b. implementation c. analysis d. physical design ANSWER: d POINTS: 1 REFERENCES: p. 420 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Multiple Choice Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 11 Implementing Information Security HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/6/2021 4:06 PM 48. Which of the following phases is often considered the longest and most expensive phase of the systems development life cycle? a. investigation b. logical design c. implementation d. maintenance and change ANSWER: d POINTS: 1 REFERENCES: p. 421 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 9/14/2016 10:30 AM 49. Organizations are moving toward more _____-focused development approaches, seeking to improve not only the functionality of the systems they have in place, but consumer confidence in their product. a. security b. reliability c. accessibility d. availability ANSWER: a POINTS: 1 REFERENCES: p. 428 H1: The Systems Development Life Cycle H2: The NIST Approach to Securing the SDLC QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/6/2021 4:06 PM 50. The _____ design phase of an SDLC methodology is implementation independent, meaning that it contains no reference to specific technologies, vendors, or products. a. conceptual b. logical c. integral d. physical ANSWER: b POINTS: 1 REFERENCES: p. 420 Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 11 Implementing Information Security H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/6/2021 4:06 PM 51. Effective planning for information security involves: a. collecting information about an organization's objectives. b. collecting information about an organization's information security environment. c. collecting information about an organization's technical architecture. d. All of these answers are correct ANSWER: d POINTS: 1 REFERENCES: p. 428 H1: Information Security Project Management QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:29 PM 52. Tasks or action steps that come after the task at hand are called _____. a. predecessors b. successors c. derivatives d. parents ANSWER: b POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:29 PM 53. A(n) _____ is a simple project management planning tool used to break the project plan into smaller and smaller steps. a. RFP b. WBS c. ISO 17799 d. SDLC ANSWER: b Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 11 Implementing Information Security POINTS: REFERENCES:

1 p. 429 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:35 PM 54. If the task is to write firewall specifications for the preparation of a(n) _____, the planner would note that the deliverable is a specification document suitable for distribution to vendors. a. WBS b. CBA c. SDLC d. RFP ANSWER: d POINTS: 1 REFERENCES: p. 430 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 55. The date for sending the final RFP to vendors is considered a milestone because it signals that __________. a. the budget is approved b. all approvals have been obtained c. all RFP preparation work is complete d. the bid by date has passed ANSWER: c POINTS: 1 REFERENCES: p. 431 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:38 PM 56. A(n) _____ determines the impact that a specific technology or approach can have on the organization’s information assets and what it may cost. a. RFP b. WBS Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 11 Implementing Information Security c. SDLC d. CBA ANSWER: POINTS: REFERENCES:

d 1 p. 432 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:40 PM 57. Many public organizations must spend all budgeted funds within the fiscal year—otherwise, the subsequent year’s budget is _____. a. increased by the unspent amount b. not affected unless the deficit is repeated c. automatically audited for questionable expenditures d. reduced by the unspent amount ANSWER: d POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 58. In a _____ when significant deviation occurs, corrective action is taken to bring the deviating task back into compliance with the project plan; otherwise, the project is revised in light of the new information. a. gap analysis b. wrap-up c. direct changeover d. turnover ANSWER: a POINTS: 1 REFERENCES: H1: Information Security Project Management H2: The Need for Project Management p. 435 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 6:54 PM Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 11 Implementing Information Security 59. The goal of the _____ is to resolve any pending project-related issues, critique the overall effort of the project, and draw conclusions about how to improve the project management process for the future. a. direct changeover b. project wrap-up c. phased implementation d. pilot implementation ANSWER: b POINTS: 1 REFERENCES: p. 436 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:04 PM 60. Some cases of _____ are simple, such as requiring employees to begin using a new password on an announced date. a. phased implementation b. direct changeover c. pilot implementation d. wrap-up ANSWER: b POINTS: 1 REFERENCES: p. 437 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 61. A _____ is usually the best approach to security project implementation. a. direct changeover b. phased implementation c. pilot implementation d. parallel operation ANSWER: b POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 11 Implementing Information Security DATE MODIFIED:

6/6/2021 4:06 PM

62. In a _____ implementation, the entire security system is put in place in a single office, department, or division before expanding to the rest of the organization. a. loop b. direct c. parallel d. pilot ANSWER: d POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 63. The _____ methodology has been used by many organizations and requires that issues be addressed from the general to the specific, and that the focus be on systematic solutions instead of individual problems. a. parallel b. direct changeover c. bull’s-eye d. wrap-up ANSWER: c POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/16/2021 2:06 PM 64. The _____ level of the bull’s-eye model establishes the ground rules for the use of all systems and describes what is appropriate and what is inappropriate; it enables all other information security components to function correctly. a. Policies b. Networks c. Systems d. Applications ANSWER: a POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: Multiple Choice HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 11 Implementing Information Security LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 65. The _____ layer of the bull's-eye model includes computers used as servers, desktop computers, and systems used for process control and manufacturing. a. Policies b. Networks c. Systems d. Applications ANSWER: c POINTS: 1 REFERENCES: p. 439 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 66. The _____ layer of the bull's-eye model receives attention last. a. Policies b. Networks c. Systems d. Applications ANSWER: d POINTS: 1 REFERENCES: p. 439 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 67. Technology _____ guides how frequently technical systems are updated, and how technical updates are approved and funded, and also facilitates communication about technical advances and issues across the organization.. a. wrap-up b. governance c. turnover d. changeover ANSWER: b POINTS: 1 REFERENCES: p. 440 H1: Technical Aspects Of Implementation H2: Technology Governance and Change Control Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 11 Implementing Information Security QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:05 PM 68. By managing the _____, the organization can reduce unintended consequences by having a process to resolve the potential conflict and disruption that uncoordinated change can introduce. a. conversion process b. wrap-up c. process of change d. governance ANSWER: c POINTS: 1 REFERENCES: p. 440 H1: Technical Aspects Of Implementation H2: Technology Governance and Change Control QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM 69. The Lewin change model includes _____. a. unfreezing b. moving c. refreezing d. All of these are correct ANSWER: d POINTS: 1 REFERENCES: p. 442 H1: Nontechnical Aspects Of Implementation H2: The Culture of Change Management QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:06 PM 70. Project managers can reduce resistance to change by involving employees in the project plan. In the systems development parts of a project, this is referred to as _____. a. DMZ b. SDLC c. WBS d. JAD ANSWER: d POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 11 Implementing Information Security REFERENCES:

p. 442 H1: Nontechnical Aspects Of Implementation H2: Considerations for Organizational Change QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:06 PM Completion 71. A(n) _____ is a formal approach to solving a problem by means of a structured sequence of procedures. methodology ANSWER: POINTS: 1 REFERENCES: p. 419 H1: The Systems Development Life Cycle QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/6/2021 4:05 PM 72. The _____ phase of the SDLC consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems. analysis ANSWER: POINTS: 1 REFERENCES: p. 420 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/27/2021 7:06 PM 73. During the _____ phase of the SDLC, the process begins by examining the event or plan that initiated the process. During this phase, the objectives, constraints, and scope of the project are specified. investigation ANSWER: POINTS: 1 REFERENCES: p. 420 Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 11 Implementing Information Security H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/27/2021 7:07 PM 74. During the implementation phase of the SDLC, the organization translates its blueprint for information security into a project _____. plan ANSWER: POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:07 PM 75. The _____ of any given project plan should be carefully reviewed and kept as small as possible, given the project’s objectives. scope ANSWER: POINTS: 1 REFERENCES: p. 434 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:09 PM 76. A(n) _____ is a completed document or program module that can either serve as the beginning point for a later task or become an element in the finished project. deliverable ANSWER: POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 11 Implementing Information Security H2: Developing the Project Plan QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 77. _____ is a phenomenon in which the project manager spends more time documenting project tasks, collecting performance measurements, recording project task information, and updating project completion forecasts than accomplishing meaningful project work. Projectitis ANSWER: POINTS: 1 REFERENCES: p. 430 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 78. A(n) _____ is a specific point in the project plan when a task that has a noticeable impact on the plan's progress is complete. milestone ANSWER: POINTS: 1 REFERENCES: p. 431 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 79. The tasks or action steps that come before the specific task at hand are called _____. predecessors ANSWER: POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 11 Implementing Information Security H2: Developing the Project Plan QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 80. Tasks or action steps that come after the task at hand are called _____. successors ANSWER: POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 81. In the early stages of planning, the project planner should attempt to specify completion dates only for major project _____. milestones ANSWER: POINTS: 1 REFERENCES: p. 431 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:10 PM 82. Regardless of an organization’s information security needs, the amount of effort that can be expended depends on the available funds; therefore, a _____ is typically prepared in the analysis phase of the SecSDLC and must be reviewed and verified prior to the development of the project plan. CBA ANSWER: cost-benefit analysis cost benefit analysis cost-benefit analysis (CBA) Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 11 Implementing Information Security cost benefit analysis (CBA) CBA (cost-benefit analysis) CBA (cost benefit analysis) POINTS: 1 REFERENCES: p. 432 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 83. Project _____ is a description of a project’s features, capabilities, functions, and quality level, and is used as the basis of a project plan. scope ANSWER: POINTS: 1 REFERENCES: p. 434 H1: Information Security Project Management H2: Project Planning Considerations QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 84. Once a project is underway, it is managed to completion using a process known as _____ analysis. gap ANSWER: POINTS: 1 REFERENCES: p. 435 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:11 PM 85. A direct _____ involves stopping the old system and starting the new one without any overlap. Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 11 Implementing Information Security ANSWER: POINTS: REFERENCES:

changeover 1 p. 437 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 86. A(n) _____ implementation is the most common conversion strategy and involves a measured rollout of the planned system with a part of the system being brought out and disseminated across an organization before the next piece is implemented. phased ANSWER: POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 87. The _____ operations strategy involves running the new system concurrently with the old system. parallel ANSWER: POINTS: 1 REFERENCES: p. 438 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 88. At the center of the bull's-eye model are the _____ used by the organization to accomplish its work. applications ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 11 Implementing Information Security POINTS: REFERENCES:

1 p. 439 H1: Technical Aspects Of Implementation H2: The Bull’s-Eye Model QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 89. Technology _____ is a complex process that organizations use to manage the impact and costs of technology implementation, innovation, and obsolescence. governance ANSWER: POINTS: 1 REFERENCES: p. 440 H1: Technical Aspects Of Implementation H2: Technology Governance and Change Control QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 90. Medium- and large-sized organizations deal with the impact of technical change on the organization's operation through a(n) _____ control process. change ANSWER: POINTS: 1 REFERENCES: p. 440 H1: Technical Aspects Of Implementation H2: Technology Governance and Change Control QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 91. One of the oldest models of change is the Lewin change model, which consists of three stages: unfreezing, _____, and refreezing. moving ANSWER: Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 11 Implementing Information Security POINTS: REFERENCES:

1 p. 442 H1: Nontechnical Aspects Of Implementation H2: The Culture of Change Management QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/6/2021 4:05 PM 92. The level of _____ to change impacts the ease with which an organization is able to implement procedural and managerial changes. resistance ANSWER: POINTS: 1 REFERENCES: p. 442 H1: Nontechnical Aspects Of Implementation H2: Considerations for Organizational Change QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: DENT.SING.22.11.6 - Compare and contrast among the types of gloves used in dentistry. DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:12 PM 93. In systems development _____ means getting key representatives of user groups to serve as members of the development process. joint application development ANSWER: JAD joint application development (JAD) POINTS: 1 REFERENCES: p. 419 H1: Introduction To Information Security Implementation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 6/27/2021 7:14 PM Essay Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 11 Implementing Information Security 94. List and describe the phases of the traditional systems development life cycle. Investigation ANSWER: The first phase, investigation, is the most important. What problem is the system being developed to solve? The investigation phase begins by examining the event or plan that initiates the process. During this phase, the objectives, constraints, and scope of the project are specified. A preliminary cost-benefit analysis evaluates the perceived benefits and their appropriate levels of cost. At the conclusion of this phase and at every phase afterward, a process will be undertaken to assess economic, technical, and behavioral feasibilities and ensure that implementation is worth the organization’s time and effort. Analysis The analysis phase begins with the information gained during the investigation phase. This phase consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems. Analysts begin by determining what the new system is expected to do and how it will interact with existing systems. This phase ends with documentation of the findings and an update of the feasibility analysis. Logical Design In the logical design phase, the information gained from the analysis phase is used to begin creating a systems solution for a business problem. In any systems solution, the first and driving factor must be the business need. Based on the business need, applications are selected to provide needed services, and then the team chooses data support and structures capable of providing the needed inputs. Finally, based on all of this, specific technologies are delineated to implement the physical solution. The logical design, therefore, is the blueprint for the desired solution. The logical design is implementation-independent, meaning that it contains no reference to specific technologies, vendors, or products. Instead, it addresses how the proposed system will solve the problem at hand. In this stage, analysts generate estimates of costs and benefits to allow for a general comparison of available options. At the end of this phase, another feasibility analysis is performed. Physical Design During the physical design phase, specific technologies are selected to support the alternatives identified and evaluated in the logical design. The selected components are evaluated based on a make-or-buy decision—the option to develop components in-house or purchase them from a vendor. Final designs integrate various components and technologies. After yet another feasibility analysis, the entire solution is presented to the organization’s management for approval. Implementation In the implementation phase, any needed software is created. Components are ordered, received, and tested. Afterward, users are trained and supporting documentation created. Once all components are tested individually, they are installed and tested as a system. A feasibility analysis is again prepared, and the sponsors are then presented with the system for a performance review and acceptance test. Maintenance and Change The maintenance and change phase is the longest and most expensive of the process. This phase consists of the tasks necessary to support and modify the system for the remainder of its useful life cycle. Even though formal development may conclude during this phase, the life cycle of the project continues until the team determines that the process should begin again from the investigation phase. At periodic points, the system is tested for compliance, and the feasibility of continuance versus discontinuance is evaluated. Upgrades, updates, and patches are managed. As the needs of the organization change, the systems that support the organization must also change. When a current system can no longer support Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 11 Implementing Information Security the evolving mission of the organization, the system is retired from use and ongoing maintenance stops. If the services provided by the retired system are still needed, a new project is planned and implemented. POINTS: 1 REFERENCES: p. 419 H1: The Systems Development Life Cycle H2: Traditional Development Methods QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.1 - Explain how an organization’s information security blueprint becomes a project plan DATE CREATED: 9/14/2016 10:30 AM DATE MODIFIED: 6/27/2021 7:14 PM 95. What are the major steps in executing the project plan? The major steps in executing the project plan are: ANSWER: Planning the project Supervising tasks and action steps Wrapping up POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:48 AM DATE MODIFIED: 9/14/2016 10:48 AM 96. What minimum attributes for project tasks does the WBS document? Work to be accomplished (activities and deliverables) ANSWER: Individuals (or skill set) assigned to perform the task Start and end dates for the task (when known) Amount of effort required for completion in hours or work days Estimated capital expenses for the task Estimated noncapital expenses for the task Identification of dependencies between and among tasks POINTS: 1 REFERENCES: p. 429 H1: Information Security Project Management H2: Developing the Project Plan QUESTION TYPE: Essay HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 11 Implementing Information Security STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.2 - Explain the significance of the project manager’s role in the success of an information security project DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 9/14/2016 10:49 AM 97. What can the organization do by managing the process of change through a change control process? By managing the process of change, the organization can do the following: ANSWER: - Improve communication about change across the organization - Enhance coordination between groups within the organization as change is scheduled and completed - Reduce unintended consequences by having a process to resolve the conflict and disruption that change can introduce - Improve quality of service as potential failures are eliminated and groups work together - Assure management that all groups are complying with the organization’s policies regarding technology governance, procurement, accounting, and information security POINTS: 1 REFERENCES: p. 440 H1: Technical Aspects Of Implementation H2: Technology Governance and Change Control QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 9/14/2016 10:49 AM DATE MODIFIED: 6/27/2021 7:16 PM Subjective Short Answer 98. What is a milestone, and why is it significant to project planning? A milestone is a specific point in the project plan when a task and its action steps are ANSWER: complete and have a noticeable impact on the progress of the project plan as a whole. For example, the date for sending the final RFP to vendors is considered a milestone because it signals all RFP preparation is complete. POINTS: REFERENCES:

1 p. 431 H2: Developing the Project Plan H1: The Systems Development Life Cycle QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.3 - Discuss the many organizational considerations that a project plan must address DATE CREATED: 6/19/2021 9:39 AM Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 11 Implementing Information Security DATE MODIFIED:

6/19/2021 9:41 AM

99. What is gap analysis? How is it used to keep a project in control? ANSWER:

Once a project is under way, it is managed using a process known as gap analysis (also known as a negative feedback loop or cybernetic loop), which ensures that progress is measured periodically. When significant deviation occurs, corrective action is taken to bring the deviating task back into compliance with the project plan; otherwise, the project is revised in light of the new information. POINTS: 1 REFERENCES: p. 435 H1: Information Security Project Management H2: The Need for Project Management QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.4 - Describe the need for professional project management for complex projects DATE CREATED: 6/19/2021 9:39 AM DATE MODIFIED: 6/27/2021 7:17 PM 100. List and describe the four basic conversion strategies that are used when converting to a new system. Under which circumstances is each strategy the best approach? Direct changeover—Also known as going “cold turkey,” a direct changeover involves ANSWER: stopping the old method and beginning the new one. This could be as simple as having employees follow the existing procedure one week and then use a new procedure the next. Some cases of direct changeover are simple, such as a change requiring employees to use a new password that has a stronger degree of authentication, beginning on an announced date. Some cases may be more complex, such as requiring the entire company to change procedures when the network team disables an old firewall and activates a new one. The primary drawback to a direct changeover is that if the new system fails or needs modification, users may be without services while the system’s bugs are worked out. Complete testing of the new system in advance of the direct changeover helps to reduce the probability of such problems. Phased implementation—A phased implementation is the most common conversion strategy; it involves rolling out a piece of the system across the entire organization. This could mean that the security group implements only a small portion of the new security profile, giving users a chance to get used to it and resolving small issues as they arise. This is usually the best approach to security project implementation. For example, if the organization plans to introduce a new VPN solution that employees can use to connect to the organization’s network while they’re traveling, one department per week might be added to the group allowed to use the new VPN. This process would continue until all departments are using the new approach. Pilot implementation—This strategy involves implementing all security improvements in a single office, department, or division and resolving issues within that group before expanding to the rest of the organization. The pilot implementation works well when an isolated group can serve as the “guinea pig,” which keeps the implementation from dramatically affecting the organization’s performance as a whole. The operation of a research and development group, for example, may not affect the organization’s real-time Copyright Cengage Learning. Powered by Cognero.

Page 36

Name:

Class:

Date:

Mod 11 Implementing Information Security operations and could assist security in resolving issues that emerge. Parallel operations—The parallel operations strategy involves running the new methods alongside the old methods. In general, this means running two systems concurrently. In terms of information systems, it might involve running two firewalls concurrently, for example. Although this approach is usually complex, it can reinforce an organization’s information security by allowing the old system(s) to serve as a backup for the new systems if they fail or are compromised. Drawbacks usually include the need to deal with both systems and maintain both sets of procedures. POINTS: REFERENCES:

1 p. 437 H1: Technical Aspects Of Implementation H2: Conversion Strategies QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.11.5 - Discuss technical strategies and models for implementing a project plan DATE CREATED: 6/19/2021 9:39 AM DATE MODIFIED: 6/19/2021 9:43 AM

Copyright Cengage Learning. Powered by Cognero.

Page 37

Name:

Class:

Date:

Mod 12 Information Security Maintenance True / False 1. If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment, the existing security improvement program will probably continue to work well. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Introduction To Information Security Maintenance p. 448 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.1 - Discuss the need for ongoing maintenance of the information security program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 3/29/2018 7:10 PM 2. Over time, policies and procedures may become inadequate due to changes in the organization's mission and operational requirements, threats, or the environment. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” p. 449 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 3. An effective information security governance program requires no ongoing review once it is well established. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 449 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM Copyright Cengage Learning. Powered by Cognero.

Page 1

Name:

Class:

Date:

Mod 12 Information Security Maintenance DATE MODIFIED:

2/4/2017 7:25 PM

4. There are several key ongoing activities that can assist in monitoring and improving an organization’s information governance activities, including plans of action and milestones, measurement and metrics, continuous assessment and configuration management. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” p. 450 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:12 PM 5. Documentation procedures are not required for configuration and change management processes. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 469 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 6. While management models such as the ISO 27000 series and NIST SP 800 series deal with methods to manage and operate systems, a maintenance model is designed to focus the organization’s effort on securing systems. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 470 H1: The Security Maintenance Model QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM Copyright Cengage Learning. Powered by Cognero.

Page 2

Name:

Class:

Date:

Mod 12 Information Security Maintenance DATE MODIFIED:

6/28/2021 8:13 PM

7. External monitoring entails forming intelligence from various data sources and then giving that intelligence context and meaning for use by decision makers within the organization. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: The Security Maintenance Model H2: Monitoring the External Environment p. 470 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 3/2/2018 7:14 PM 8. Carnegie Mellon University's CC-CERT is generally viewed as the definitive authority for computer emergency response teams. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 471 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:13 PM 9. Intelligence for external monitoring can come from a number of sources: vendors, CERT organizations, public network sources, and membership sites. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 471 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 3

Name:

Class:

Date:

Mod 12 Information Security Maintenance LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 3/10/2017 5:51 PM 10. Over time, external monitoring processes should capture information about the external environment in a format that can be referenced across the organization as threats emerge and for historical use. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 3/10/2017 5:51 PM 11. The internal monitoring domain is the component of the maintenance model that focuses on identifying, assessing, and managing the physical security of assets in an organization. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 12. Organizations should maintain a carefully planned and fully populated inventory of all their computing devices, including hardware, and software - both operating systems and applications. The process of collecting this information is often referred to as characterization.. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 474 Copyright Cengage Learning. Powered by Cognero.

Page 4

Name:

Class:

Date:

Mod 12 Information Security Maintenance H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:18 PM 13. The target selection step of Internet vulnerability assessment involves using the external monitoring intelligence to configure a test engine (such as Nessus) for the tests to be performed. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation p. 485 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 14. internet vulnerability assessment is an assessment approach designed to find and document vulnerabilities that may be present in the organization’s internal networks. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation p. 485 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:18 PM 15. As the platform security validation (PSV) is designed to find and document vulnerabilities in misconfigured systems used in the organization, all systems that are mission critical should be enrolled PSV measurement. a. True b. False Copyright Cengage Learning. Powered by Cognero.

Page 5

Name:

Class:

Date:

Mod 12 Information Security Maintenance ANSWER: POINTS: REFERENCES:

True 1 p. 487 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:20 PM 16. Wireless vulnerability assessment begins with the planning, scheduling, and notification of all Internet connections, and is usually performed on the organization's networks using every possible approach to penetration testing. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 487 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:21 PM 17. Remediation of vulnerabilities can be accomplished by accepting or transferring the risk, removing the threat, or repairing the vulnerability, but the best solution in most cases is to repair the vulnerability, often by applying patch software or implementing a permanent alternative work practice. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:22 PM Copyright Cengage Learning. Powered by Cognero.

Page 6

Name:

Class:

Date:

Mod 12 Information Security Maintenance 18. The vulnerability database is an essential part of effective remediation because it helps organizations keep track of specific vulnerabilities as they are reported and remediated. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 488 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:22 PM 19. Remediation is the processes of removing or repairing flaws in information assets that cause a vulnerability or reducing or removing the risk associated with the vulnerability. a. True b. False ANSWER: POINTS: REFERENCES:

True 1 p. 488 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:23 PM 20. The most common vulnerability repair is the disabling of an application's associated port; this usually allows the system function in the expected fashion and removes the vulnerability. a. True b. False ANSWER: False POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability Copyright Cengage Learning. Powered by Cognero.

Page 7

Name:

Class:

Date:

Mod 12 Information Security Maintenance

DATE CREATED: DATE MODIFIED:

assessment, and remediation tie into information security maintenance 9/14/2016 10:51 AM 6/28/2021 8:40 PM

21. Policy needs to be reviewed and refreshed from time to time to ensure that it’s providing a current foundation for the information security program. a. True b. False ANSWER: True POINTS: 1 REFERENCES: H1: The Security Maintenance Model H2: Readiness and Review p. 489 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 22. Major planning components should be reviewed on a periodic basis to ensure that they are current, accurate, and appropriate. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 23. Rehearsal adds value by exercising the procedures, identifying shortcomings, and providing security personnel the opportunity to improve the security plan before it is needed. a. True b. False ANSWER: True POINTS: 1 REFERENCES: p. 490 H1: The Security Maintenance Model H2: Readiness and Review Copyright Cengage Learning. Powered by Cognero.

Page 8

Name:

Class:

Date:

Mod 12 Information Security Maintenance QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 9/14/2016 10:51 AM 24. Physical security is not as important as logical or computer security to an information security program. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Physical Security p. 490 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 6/23/2021 9:54 AM DATE MODIFIED: 6/28/2021 8:41 PM 25. A secure facility uses a different defense-in-depth strategy as logical network security. a. True b. False ANSWER: False POINTS: 1 REFERENCES: H1: Physical Security H2: Physical Access Controls p. 491 QUESTION TYPE: True / False HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 6/23/2021 9:55 AM DATE MODIFIED: 6/23/2021 9:57 AM Modified True / False 26. An effective information security governance program requires constant change. _____ ANSWER: False - review POINTS: 1 REFERENCES: p. 449 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 9

Name:

Class:

Date:

Mod 12 Information Security Maintenance STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 27. NIST Special Publication (SP) 800-100, “Information Security Handbook: A Guide for Managers,” provides managerial guidance for the establishment and implementation of an information security program; in particular, it addresses the ongoing tasks expected of an information security manager once the program is working and day-to-day operations are established. _____ ANSWER: True POINTS: 1 REFERENCES: p. 449 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:43 PM 28. The security development life cycle (SDLC) is the overall process of developing, implementing, and retiring information systems through a multistep approach—from initiation to maintenance and eventually disposal. _____ False - systems ANSWER: POINTS: 1 REFERENCES: p. 450 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:46 PM 29. For configuration management and control, it is important to document the proposed or actual changes in the system security plan. _____ ANSWER: True POINTS: 1 REFERENCES: p. 450 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 10

Name:

Class:

Date:

Mod 12 Information Security Maintenance LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 30. Configuration change management is an approach to implementing system change that uses policies, procedures, techniques, and tools to manage and evaluate proposed changes, track changes through completion, and maintain systems security and supporting documentation. _____ False - inventory ANSWER: POINTS: 1 REFERENCES: p. 453 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:47 PM 31. A significant number of help-desk trouble tickets are the result of user access issues involving hackers and other mechanisms of authentication, authorization, and accountability, which can be reduced but not eliminated by proper user training and ongoing awareness campaigns. _____ False - passwords ANSWER: POINTS: 1 REFERENCES: p. 466 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:48 PM 32. In some organizations, status management is the identification, inventory, and documentation of the current information system's status—hardware, software, and networking configurations. _____ ANSWER: False - configuration POINTS: 1 REFERENCES: p. 466 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program Copyright Cengage Learning. Powered by Cognero.

Page 11

Name:

Class:

Date:

Mod 12 Information Security Maintenance DATE CREATED: DATE MODIFIED:

9/14/2016 10:51 AM 6/28/2021 8:48 PM

33. CCM assists in streamlining change management processes and prevents changes that could detrimentally affect the security posture of a system before they happen. _____ ANSWER: True POINTS: 1 REFERENCES: p. 467 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:49 PM 34. CERT stands for "computer emergency recovery team." _____ False - response ANSWER: POINTS: 1 REFERENCES: p. 471 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 35. TechTarget is a set of moderated mailing lists full of detailed, full-disclosure discussions and announcements about computer security vulnerabilities and is sponsored in part by SecurityFocus. _____ False - Bugtraq ANSWER: POINTS: 1 REFERENCES: p. 473 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:50 PM Copyright Cengage Learning. Powered by Cognero.

Page 12

Name:

Class:

Date:

Mod 12 Information Security Maintenance 36. Specific warning plans are issued when developing threats and specific attacks pose a measurable risk to the organization. _____ ANSWER: False - bulletins POINTS: 1 REFERENCES: p. 473 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:51 PM 37. The basic function of the external monitoring process is to monitor activity, report results, and escalate warnings. _____ ANSWER: True POINTS: 1 REFERENCES: p. 473 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 38. The primary goal of the external monitoring domain is to maintain an informed awareness of the state of all the organization’s networks, information systems, and information security defenses. _____ False - internal ANSWER: POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM Copyright Cengage Learning. Powered by Cognero.

Page 13

Name:

Class:

Date:

Mod 12 Information Security Maintenance 39. Organizations should have a carefully planned and fully populated inventory of all their network devices, communication channels, and computing devices. _____ ANSWER: True POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 40. A traffic analysis is a procedure that compares the current state of a network segment against a known previous state of the same network segment (the baseline of systems and services). _____ False - difference ANSWER: POINTS: 1 REFERENCES: p. 475 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:53 PM 41. An example of the type of vulnerability exposed via traffic analysis occurs when an organization is trying to determine if all its device signatures have been adequately masked. _____ ANSWER: True POINTS: 1 REFERENCES: p. 475 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM Copyright Cengage Learning. Powered by Cognero.

Page 14

Name:

Class:

Date:

Mod 12 Information Security Maintenance 42. The process of identifying and documenting specific and provable flaws in the organization’s information asset environment is called vulnerability assessment (VA). _____ ANSWER: True POINTS: 1 REFERENCES: p. 481 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 43. The internal vulnerability assessment is usually performed against every device that is exposed to the Internet, using every possible penetration testing approach. _____ False - Internet ANSWER: POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 44. A vulnerability analyst screens test results for possible vulnerabilities logged during scanning by performing three tasks: classify the test level, validate its existence and document the results. _____ False - risk ANSWER: POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:54 PM Copyright Cengage Learning. Powered by Cognero.

Page 15

Name:

Class:

Date:

Mod 12 Information Security Maintenance 45. WAP driving is the use of mobile scanning techniques to identify open wireless access points. _____ False - War ANSWER: POINTS: 1 REFERENCES: p. 488 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:55 PM 46. The final function in the vulnerability assessment and remediation domain is the maintenance phase. _____ ANSWER: False - remediation POINTS: 1 REFERENCES: p. 488 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:55 PM 47. The best method of remediation in most cases is to repair a vulnerability often by applying patch software or implementing a permanent alternative work practice. _____ ANSWER: True POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:56 PM 48. When possible, major incident response plan elements should be rehearsed, which adds value by providing the Copyright Cengage Learning. Powered by Cognero.

Page 16

Name:

Class:

Date:

Mod 12 Information Security Maintenance opportunity to improve the security plan before it is needed. _____ ANSWER: True POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:57 PM 49. Because early CMM approaches were intended to improve the software development process, their use in assessing and improving security management systems was somewhat limited. _____ ANSWER: True POINTS: 1 REFERENCES: p. 490 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:58 PM 50. A type of rehearsal known as a war game, or simulation exercise, puts a subset of plans in place to create a realistic test environment. _____ ANSWER: True POINTS: 1 REFERENCES: p. 490 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:58 PM 51. A(n) data center is a small room or enclosure with separate entry and exit points, designed to restrain a person who Copyright Cengage Learning. Powered by Cognero.

Page 17

Name:

Class:

Date:

Mod 12 Information Security Maintenance fails an access authorization attempt. _____ ANSWER: False - mantrap POINTS: 1 REFERENCES: p. 493 H1: Physical Security H2: Physical Access Controls QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 6/23/2021 9:59 AM DATE MODIFIED: 6/28/2021 8:59 PM 52. Fire suppression systems typically work by denying an environment one of the three requirements for a fire to burn: temperature (an ignition source), fuel, and oxygen. ANSWER: True POINTS: 1 REFERENCES: p. 494 H1: Physical Security H2: Fire Security and Safety QUESTION TYPE: Modified True / False HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 6/23/2021 10:02 AM DATE MODIFIED: 6/23/2021 10:02 AM Multiple Choice 53. _____ are a component of the "security triple." a. Threats b. Assets c. Vulnerabilities d. All of these are correct ANSWER: d POINTS: 1 REFERENCES: p. 448 H1: Introduction To Information Security Maintenance QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.1 - Discuss the need for ongoing maintenance of the information security program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 8:59 PM 54. A primary mailing list for new vulnerabilities, called simply _____, provides time-sensitive coverage of emerging vulnerabilities, documenting how they are exploited and reporting on how to remediate them. Individuals can register for Copyright Cengage Learning. Powered by Cognero.

Page 18

Name:

Class:

Date:

Mod 12 Information Security Maintenance the flagship mailing list or any one of the entire family of its mailing lists. a. Bugs b. Bugfix c. Buglist d. Bugtraq ANSWER: d POINTS: 1 REFERENCES: p. 473 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 55. U.S. Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA) coordinates CERT services at ________. a. US-CERT b. Bugtraq c. CM-CERT d. CERT/CC ANSWER: a POINTS: 1 REFERENCES: p. 472 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:00 PM 56. The _____ Web site is home to several security tools including the leading free network exploration tool, Nmap. a. insecure.org b. Packet Storm c. Security Focus d. Snort-sigs ANSWER: a POINTS: 1 REFERENCES: p. 472 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM Copyright Cengage Learning. Powered by Cognero.

Page 19

Name:

Class:

Date:

Mod 12 Information Security Maintenance DATE MODIFIED:

6/28/2021 9:01 PM

57. The _____ commercial site focuses on current security tool resources. a. Nmap-hackerz b. Packet Storm c. Security Laser d. Snort-SIGs ANSWER: b POINTS: 1 REFERENCES: p. 472 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 58. The monitoring process has three primary deliverables. Which of the following is NOT one of them?. a. Specific warning bulletins issued when developing threats and specific b. Periodic summaries of attacks pose a measurable risk to the organization external information c. Detailed intelligence on the highest-risk warnings d. All of these are correct ANSWER: d POINTS: 1 REFERENCES: p. 473 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:03 PM 59. Detailed intelligence on the highest risk warnings can include identifying which _____ apply to which vulnerabilities as well as which types of defenses have been found to work against the specific vulnerabilities reported. a. risks b. vendor updates c. threats d. assets ANSWER: b POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external Copyright Cengage Learning. Powered by Cognero.

Page 20

Name:

Class:

Date:

Mod 12 Information Security Maintenance

DATE CREATED: DATE MODIFIED:

and internal environment 9/14/2016 10:51 AM 6/28/2021 9:04 PM

60. A process called _____ examines the data packets that flows through a system and its associated devices to identify the most frequently used devices. a. difference analysis b. traffic analysis c. schema analysis d. data flow assessment ANSWER: b POINTS: 1 REFERENCES: p. 475 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:05 PM 61. One approach that can improve the situational awareness of the information security function is to use a process known as _____ to quickly identify changes to the internal environment. a. baselining b. difference analysis c. differentials d. revision ANSWER: b POINTS: 1 REFERENCES: p. 475 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 62. The _____ process is designed to find and document vulnerabilities that may be present because there are misconfigured systems in use within the organization. a. ASP b. ISP c. SVP d. PSV ANSWER: d POINTS: 1 REFERENCES: p. 487 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation Copyright Cengage Learning. Powered by Cognero.

Page 21

Name:

Class:

Date:

Mod 12 Information Security Maintenance QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 63. _____, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a malicious external source like a hacker. a. Penetration testing b. Penetration simulation c. Attack simulation d. Attack testing ANSWER: a POINTS: 1 REFERENCES: p. 482 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:06 PM 64. Common vulnerability assessment processes include: a. Internet VA b. wireless VA c. intranet VA d. all of these are correct answers ANSWER: d POINTS: 1 REFERENCES: p. 481 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:07 PM 65. _____ penetration testing, also known as disclosure testing, is usually used when a specific system or network segment is suspect and the organization wants the pen tester to focus on a particular aspect of the target. a. White box b. Black box c. Gray box d. Green box ANSWER: a POINTS: 1 Copyright Cengage Learning. Powered by Cognero.

Page 22

Name:

Class:

Date:

Mod 12 Information Security Maintenance REFERENCES:

p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:07 PM 66. A step commonly used for Internet vulnerability assessment includes _____, which occurs when the penetration test engine is unleashed at the scheduled time using the planned target list and test selection. a. scanning b. subrogation c. delegation d. targeting ANSWER: a POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 67. The _____ vulnerability assessment is a process designed to find and document selected vulnerabilities that are likely to be present on the organization's internal network. a. intranet b. Internet c. LAN d. WAN ANSWER: a POINTS: 1 REFERENCES: p. 486 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 68. The _____ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization’s wireless local area networks. a. wireless b. phone-in Copyright Cengage Learning. Powered by Cognero.

Page 23

Name:

Class:

Date:

Mod 12 Information Security Maintenance c. battle-dialing ANSWER: POINTS: REFERENCES:

d. network a 1 p. 487 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 69. _____ allows for major security control components to be reviewed on a periodic basis to ensure that they are current, accurate, and appropriate. a. System review b. Vulnerability assessment c. Program review d. Application review ANSWER: c POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:07 PM 70. Most guards have clear __________ that help them to act decisively in unfamiliar situations. a. MACs b. SOPs c. POSs d. OPSs ANSWER: b POINTS: 1 REFERENCES: H1: Physical Security p. 492 H2: Physical Security Controls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 9/14/2016 10:47 AM 71. __________ occurs when an authorized person opens a door, and other people, who may or may not be authorized, also enter. Copyright Cengage Learning. Powered by Cognero.

Page 24

Name:

Class:

Date:

Mod 12 Information Security Maintenance a. Crowdsurfing c. Shoulder surfing ANSWER: POINTS: REFERENCES:

b. Tailgating d. Hitchhiking b 1 p. 492 H1: Physical Security H2: Physical Access Controls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 6/28/2021 9:08 PM 72. Which of the following are NOT technologies commonly deployed in biometric locks? a. retina scanners b. palm readers c. voice readers d. breathalyzer ANSWER: d POINTS: 1 REFERENCES: p. 493 H1: Physical Security H2: Physical Security Controls QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 6/28/2021 9:10 PM 73. One of the leading causes of damage to sensitive circuitry is __________. a. CPU b. EPA c. ESD d. HVAC ANSWER: c POINTS: 1 REFERENCES: p. 495 H1: Physical Security H2: Heating, Ventilation, and Air Conditioning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 9/14/2016 10:47 AM 74. A device that assures the delivery of electric power without interruption is a(n) __________. a. GFCI b. HVAC c. GPS d. UPS Copyright Cengage Learning. Powered by Cognero.

Page 25

Name:

Class:

Date:

Mod 12 Information Security Maintenance ANSWER: POINTS: REFERENCES:

d 1 p. 495 H1: Physical Security H2: Power Management and Conditioning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 9/14/2016 10:47 AM 75. Computing and other electrical equipment used in areas where water can accumulate must be uniquely grounded using __________ equipment. a. UPS b. HVAC c. GFCI d. ESD ANSWER: c POINTS: 1 REFERENCES: p. 495 H1: Physical Security H2: Power Management and Conditioning QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 3/10/2017 12:15 AM 76. Data or the trends in data that may indicate the effectiveness of security countermeasures or technical and managerial controls implemented in the organization are known as performance _____. a. indices b. monitors c. measurements d. evaluators ANSWER: c POINTS: 1 REFERENCES: p. 455 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 6/23/2021 10:41 AM DATE MODIFIED: 6/23/2021 10:43 AM 77. The InfoSec measurement development process recommended by NIST is divided into major activities that include all Copyright Cengage Learning. Powered by Cognero.

Page 26

Name:

Class:

Date:

Mod 12 Information Security Maintenance of the following EXCEPT _____. a. Identification and definition of the current InfoSec program. b. Development and selection of specific measurements to gauge the implementation, effectiveness, efficiency, and impact of the security controls. c. Usage of the selected metrics. d. All other answers here are included in the NIST development process recommendation. ANSWER: c POINTS: 1 REFERENCES: H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” p. 457 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 6/23/2021 10:44 AM DATE MODIFIED: 6/23/2021 10:49 AM 78. _____ is one of the most crucial ongoing responsibilities in security management with strategic, tactical, and operating elements that must align with and support organizational and IT objectives. a. Organizing b. Controlling c. Supervision d. Planning ANSWER: d POINTS: 1 REFERENCES: H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” p. 460 QUESTION TYPE: Multiple Choice HAS VARIABLES: False LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 6/23/2021 10:44 AM DATE MODIFIED: 6/23/2021 10:55 AM Completion 79. Almost all aspects of a company’s environment are dynamic, meaning _____ that were originally assessed in the early stages of the project’s systems development life cycle have probably changed and new priorities have emerged. threats ANSWER: assets POINTS: 1 REFERENCES: p. 448 H1: Introduction To Information Security Maintenance QUESTION TYPE: Completion HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 27

Name:

Class:

Date:

Mod 12 Information Security Maintenance STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.1 - Discuss the need for ongoing maintenance of the information security program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:12 PM 80. An automated tool known as a log _____ can consolidate system logs, perform comparative analysis, and detect common occurrences or behavior of interest. analyzer ANSWER: POINTS: 1 REFERENCES: p. 461 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:13 PM 81. It is critical that any effort performed within the security program follows a _____ improvement approach involving periodic review and assessment of any implemented change. continuous ANSWER: POINTS: 1 REFERENCES: p. 449 H1: Security Management Maintenance Models QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/28/2021 9:13 PM 82. A _____ configuration is a current record of the configuration of the information system for use in comparisons to future states. baseline ANSWER: POINTS: 1 REFERENCES: p. 453 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program Copyright Cengage Learning. Powered by Cognero.

Page 28

Name:

Class:

Date:

Mod 12 Information Security Maintenance DATE CREATED: DATE MODIFIED:

9/14/2016 10:51 AM 6/6/2021 4:13 PM

83. One key advantage to having formal help-desk software is the ability to create and develop a _____ of common problems and solutions, which can be searched when a user problem comes up. knowledge base ANSWER: database POINTS: 1 REFERENCES: p. 466 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:11 PM 84. The objective of the _____ monitoring domain within the maintenance model is to provide early awareness of new and emerging threats, threat agents, vulnerabilities, and attacks that the organization needs in order to mount an effective and timely defense. external ANSWER: POINTS: 1 REFERENCES: p. 470 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:24 PM 85. When an organization uses specific hardware and software products as part of its information security program, the _____ often provides either direct support or indirect tools that allow user communities to support each other. vendors ANSWER: vendor POINTS: 1 REFERENCES: p. 471 H1: The Security Maintenance Model H2: Monitoring the External Environment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 29

Name:

Class:

Date:

Mod 12 Information Security Maintenance LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/19/2021 11:03 PM 86. The primary goal of the _____ monitoring domain is an informed awareness of the state of all the organization’s networks, information systems, and information security defenses. internal ANSWER: POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 87. The process of collecting detailed information about devices in a network that may not be owned by the organization but are essential to its continued partnership with another company, is often referred to as _____. characterization ANSWER: POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:24 PM 88. Partner _____ are the network devices, communications channels, and applications that may not be owned by the organization but are essential to the organization’s cooperation with another company. interconnections ANSWER: POINTS: 1 REFERENCES: p. 474 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 30

Name:

Class:

Date:

Mod 12 Information Security Maintenance LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:25 PM 89. A(n) _____ analysis is a procedure that compares the current state of a network segment (the systems and services it offers) against a known previous state of that same network segment (the baseline of systems and services). difference ANSWER: POINTS: 1 REFERENCES: p. 475 H1: The Security Maintenance Model H2: Monitoring the Internal Environment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.4 - Identify the key factors involved in monitoring the external and internal environment DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 90. The primary objective of the planning and _____ domain is to keep a lookout over the entire information security program in part by identifying and planning ongoing information security activities that further reduce risk. risk assessment ANSWER: POINTS: 1 REFERENCES: p. 476 H1: The Security Maintenance Model H2: Planning and Risk Assessment QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:26 PM 91. A recommended approach to the information security program planning and review function is to take advantage of the fact that most larger organizations have annual _____ budget planning cycles to develop an annual list of project ideas. capital ANSWER: POINTS: 1 REFERENCES: p. 477 H1: The Security Maintenance Model H2: Planning and Risk Assessment QUESTION TYPE: Completion HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 31

Name:

Class:

Date:

Mod 12 Information Security Maintenance STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:27 PM 92. The primary goal of the vulnerability assessment and _____ domain is to identify specific, documented vulnerabilities and remediate them in a timely fashion. remediation ANSWER: POINTS: 1 REFERENCES: p. 481 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 93. The _____ tester’s ultimate responsibility is to identify weaknesses in the security of the organization’s systems and networks and then present findings to the system owners in a detailed report. pen ANSWER: penetration POINTS: 1 REFERENCES: p. 482 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 94. The _____ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization's public network. Internet ANSWER: POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion Copyright Cengage Learning. Powered by Cognero.

Page 32

Name:

Class:

Date:

Mod 12 Information Security Maintenance HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 95. The _____ step of an Internet vulnerability assessment occurs when a knowledgeable and experienced vulnerability analyst screens test results for candidate vulnerabilities logged during scanning. analysis ANSWER: POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:28 PM 96. A(n) _____ risk is one that is higher than the risk appetite of the organization. significant ANSWER: POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 97. As part of the analysis step of Internet Vulnerability Assessment is to _____ the existence of the vulnerability when appropriate. validate ANSWER: POINTS: 1 REFERENCES: p. 485 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 33

Name:

Class:

Date:

Mod 12 Information Security Maintenance STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:30 PM 98. The _____ step in the intranet vulnerability assessment is identical to the one followed in Internet vulnerability analysisand involves documenting the details of the vulnerability in a database. record-keeping ANSWER: POINTS: 1 REFERENCES: p. 486 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:31 PM 99. The _____ vulnerability assessment is designed to find and document vulnerabilities that may be present in the organization's wireless local area networks. wireless ANSWER: POINTS: 1 REFERENCES: p. 487 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 100. In wireless vulnerability assessment's _____ selection, all areas of the organization’s premises should be scanned with a portable wireless network scanner. target ANSWER: POINTS: 1 REFERENCES: p. 488 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False Copyright Cengage Learning. Powered by Cognero.

Page 34

Name:

Class:

Date:

Mod 12 Information Security Maintenance STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:32 PM 101. An attacker's use of a laptop while driving around looking for open wireless connections is often called _____ driving. war ANSWER: POINTS: 1 REFERENCES: p. 487 H1: The Security Maintenance Model H2: Vulnerability Assessment and Remediation QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/29/2021 6:32 PM 102. The primary goal of the readiness and _____ domain is to keep the information security program functioning as designed and improve it continuously over time. review ANSWER: POINTS: 1 REFERENCES: p. 489 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM 103. Rehearsals that use plans as realistically as possible are called _____ games. war ANSWER: POINTS: 1 REFERENCES: p. 490 H1: The Security Maintenance Model H2: Readiness and Review QUESTION TYPE: Completion HAS VARIABLES: False STUDENT ENTRY MODE: Basic Copyright Cengage Learning. Powered by Cognero.

Page 35

Name:

Class:

Date:

Mod 12 Information Security Maintenance LEARNING OBJECTIVES: POIS.WHMA.22.12.6 - Explain how to build readiness and review procedures into information security maintenance DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/6/2021 4:13 PM Essay 104. List the five steps to developing a CCM plan. Identify Change ANSWER: Evaluate Change Request Implementation Decision Implement Approved Change Request Continuous Monitoring POINTS: 1 REFERENCES: p. 468 H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.3 - Define a model for a full maintenance program DATE CREATED: 9/14/2016 10:51 AM DATE MODIFIED: 6/19/2021 11:17 PM 105. What is configuration and change management (CCM) and why is it important? For configuration and change management (CCM), also known as configuration ANSWER: management (CM), it is important to document proposed or actual changes in the system security plan. Information systems are typically in a constant state of evolution, with upgrades to hardware, software, and firmware and possible modifications to the system’s surrounding environment. Documenting information system changes and assessing their potential impact on system security is an essential part of continuous monitoring and key to avoiding a lapse in system security accreditation. Monitoring security controls helps to identify potential security problems in the information system that are not identified during the security impact analysis. This analysis is conducted as part of the CM and control process. POINTS: REFERENCES:

1 H1: Introduction to Information Security Maintenance H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” p. 452 QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.1 - Discuss the need for ongoing maintenance of the information security program DATE CREATED: 6/23/2021 9:47 AM Copyright Cengage Learning. Powered by Cognero.

Page 36

Name:

Class:

Date:

Mod 12 Information Security Maintenance DATE MODIFIED:

6/29/2021 6:34 PM

106. What is a security facility? Provide an description of a secure facility from the employee's perspective, from with the parking lot to their office. A secure facility is A physical location with access barriers and controls in place to ANSWER: minimize the risk of attacks from physical threats. A secure facility includes the same defense-in-depth strategy as logical network security. Any intrusion attempt, whether natural or human-made, should be confronted with multiple layers of defense, including those for the facility’s location, the drive to and onto the facility grounds, and multiple layers of physical access controls needed to gain access to information. This could start with a facility guard at the employee parking lot, continue through a keycard mantrap, and end in the lock-and-key process necessary to access employees’ individual offices. POINTS: REFERENCES:

1 p. 491 H1: Physical Security H2: Physical Access Controls QUESTION TYPE: Essay HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.7 - Discuss physical security controls DATE CREATED: 9/14/2016 10:47 AM DATE MODIFIED: 6/29/2021 6:37 PM Subjective Short Answer 107. What is a management maintenance model? What does it accomplish? A management model deals with methods to manage and operate a particular business ANSWER: operation. It is designed to provide clear guidelines for accomplishing the outlined goals of the organization. POINTS: 1 REFERENCES: H1: Security Management Maintenance Models p. 449 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.2 - Describe recommended security management models DATE CREATED: 6/23/2021 9:47 AM DATE MODIFIED: 6/23/2021 11:01 AM 108. What is the difference between vulnerability assessment and penetration testing? The primary goal of the vulnerability assessment is to identify specific, documented ANSWER: vulnerabilities using the inventory of environment characteristics stored in the risk, threat, and attack database. These vulnerabilities are stored, tracked, and reported in the vulnerability database until they are remediated. Penetration testing, a level beyond vulnerability testing, is a set of security tests and evaluations that simulate attacks by a Copyright Cengage Learning. Powered by Cognero.

Page 37

Name:

Class:

Date:

Mod 12 Information Security Maintenance malicious hacker. A penetration test, or pen test, is usually performed periodically as part of a full security audit. In most security tests, such as vulnerability assessments, great care is taken not to disrupt normal business operations, but in pen testing the analyst tries to get as far as possible by simulating the actions of an attacker. POINTS: 1 REFERENCES: p. 482 H2: Vulnerability Assessment and Remediation H1: The Security Maintenance Model QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.5 - Describe how planning, risk assessment, vulnerability assessment, and remediation tie into information security maintenance DATE CREATED: 6/23/2021 9:47 AM DATE MODIFIED: 6/23/2021 11:04 AM 109. What is InfoSec performance management and what is it used for? InfoSec performance management is the process of designing, implementing, and ANSWER: managing the use of collected data elements (called measurements or metrics) to determine the effectiveness of the overall security program. Performance measurements (or performance measures) are the data points or trends computed from such measurements that may indicate the effectiveness of security countermeasures or technical and managerial controls implemented in the organization. Some countermeasures are technical, while others are managerial. Both types require some method of assessing the results of their use. Control approaches that are not effective should be modified or replaced, and those that are effective should be supported and continued. Measurement supports managerial decision making, increased accountability, and improved effectiveness of the InfoSec function. Also, by enabling the collection, analysis, and reporting of critical performance data, measurements help organizations align InfoSec performance and objectives with the organization’s overall mission. POINTS: 1 REFERENCES: H1: Security Management Maintenance Models H2: NIST SP 800-100, “Information Security Handbook: A Guide for Managers” p. 455 QUESTION TYPE: Subjective Short Answer HAS VARIABLES: False STUDENT ENTRY MODE: Basic LEARNING OBJECTIVES: POIS.WHMA.22.12.2 - Describe recommended security management models DATE CREATED: 6/23/2021 9:47 AM DATE MODIFIED: 6/29/2021 6:40 PM

Copyright Cengage Learning. Powered by Cognero.

Page 38

Instructor Solution Manual for Principles of Information Security 7th Edition

richard@qwconsultancy.com

1|Pa ge

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Instructor Manual Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 2 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 5 Module Outline .............................................................................................................................. 5 Discussion Questions .................................................................................................................. 18 Suggested Usage for Lab Activities ............................................................................................ 19 Additional Activities and Assignments ....................................................................................... 21 Additional Resources................................................................................................................... 21 Cengage Video Resources ....................................................................................................................... 21 Internet Resources .................................................................................................................................. 21 Appendix ...................................................................................................................................... 22 Grading Rubrics ....................................................................................................................................... 22

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Purpose and Perspective of the Module The first module of the course in information security provides learners the foundational knowledge to become well versed in the protection systems of any size need within an organization today. The module begins with fundamental knowledge of what information security is and the how computer security evolved into what we know now as information security today. Additionally, learners will gain knowledge on the how information security can be viewed either as an art or a science and why that is the case.

Cengage Supplements The following product-level supplements are available in the Instructor Resource Center and provide additional information that may help you in preparing your course: • • • • •

PowerPoint slides Test banks, available in Word, as LMS-ready files, and on the Cognero platform MindTap Educator Guide Solution and Answer Guide This instructor’s manual

Module Objectives The following objectives are addressed in this module: 1.1

Define information security.

1.2

Discuss the history of computer security and explain how it evolved into information security.

1.3

Define key terms and critical concepts of information security.

1.4

Describe the information security roles of professionals within an organization.

Complete List of Module Activities and Assessments For additional guidance refer to the MindTap Educator Guide. Module Objective 1.1–1.2 1.3 1.4 1.1–1.4

PPT slide

Activity/Assessment

Duration

2 19–20 34–35 39–40 MindTap

Icebreaker: Interview Simulation Knowledge Check Activity 1 Knowledge Check Activity 2 Knowledge Check Activity 3 Module 01 Review Questions

10 minutes 2 minutes 2 minutes 2 minutes 30–40 minutes

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

1.1 – 1.4 1.1 – 1.4

MindTap MindTap

Module 01 Case Exercises Module 01 Exercises

1.1 – 1.4 1.1 – 1.4

MindTap MindTap

Module 01 Security for Life Module 01 Quiz

30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: computer security: In the early days of computers, this term specified the protection of the physical location and assets associated with computer technology from outside threats, but it later came to represent all actions taken to protect computer systems from losses. security: A state of being secure and free from danger or harm as well as the actions taken to make someone or something secure. information security: Protection of the confidentiality, integrity, and availability of information assets, whether in storage, processing, or transmission, via the application of policy, education, training and awareness, and technology. network security: A subset of communications security; the protection of voice and data networking components, connections, and content. C.I.A. triad: The industry standard for computer security since the development of the mainframe; the standard is based on three characteristics that describe the attributes of information that are important to protect: confidentiality, integrity, and availability. confidentiality: An attribute of information that describes how data is protected from disclosure or exposure to unauthorized individuals or systems. personally identifiable information (PII): Information about a person’s history, background, and attributes that can be used to commit identity theft that typically includes a person’s name, address, Social Security number, family information, employment history, and financial information. integrity: An attribute of information that describes how data is whole, complete, and uncorrupted. availability: An attribute of information that describes how data is accessible and correctly formatted for use without interference or obstruction. accuracy: An attribute of information that describes how data is free of errors and has the value that the user expects.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

authenticity: An attribute of information that describes how data is genuine or original rather than reproduced or fabricated. utility: An attribute of information that describes how data has value or usefulness for an end purpose. possession: An attribute of information that describes how the data’s ownership or control is legitimate or authorized. McCumber Cube: A graphical representation of the architectural approach used in computer and information security that is commonly shown as a cube composed of 3×3×3 cells, similar to a Rubik’s Cube. information system: The entire set of software, hardware, data, people, procedures, and networks that enable the use of information resources in the organization. physical security: The protection of material items, objects, or areas from unauthorized access and misuse. bottom-up approach: A method of establishing security policies and/or practices that begins as a grassroots effort in which systems administrators attempt to improve the security of their systems. top-up approach: A methodology of establishing security policies and/or practices that is initiated by upper management. chief information officer (CIO): An executive-level position that oversees the organization’s computing technology and strives to create efficiency in the processing and access of the organization’s information. chief information security officer (CISO): The title typically assigned to the top information security manager in an organization. data owners: Individuals who control and are therefore ultimately responsible for the security and use of a particular set of information. data custodians: Individuals who are responsible for the storage, maintenance, and protection of information. data stewards: See data custodians. data trustees: Individuals who are assigned the task of managing a particular set of information and coordinating its protection, storage, and use. data users: Internal and external stakeholders (customers, suppliers, and employees) who interact with information in support of their organization’s planning and operations. community of interest: A group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives. © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

[return to top]

What's New in This Module The following elements are improvements in this module from the previous edition: • • •

This Module was Chapter 1 in the 6th edition. The content that covered Systems Development was moved to Module 11: Implementation. The Module was given a general update and given more current examples.

[return to top]

Module Outline Introduction to Information Security (1.1, 1.2, PPT Slides 4–17) I.

Recognize that organizations, regardless of their size or purpose, have information they must protect and store internally and externally.

II.

Analyze the importance and reasoning an organization must be responsible for the information they collect, store, and use.

III.

Review the concept of computer security and when the need for it initially arose.

IV.

Discuss how badges, keys, and facial recognition of authorized personnel are required to access military locations deemed sensitive.

V.

Describe the primary threats to security: physical theft of equipment, product espionage, and sabotage.

VI.

Examine information security practices in the World War II era and compare with modern day needs.

The 1960s I.

Explain the purpose of the Department of Defense’s Advanced Research Procurement Agency (ARPA) and their need to create redundant networked communications systems so that the military can exchange information.

II.

Identify Dr. Larry Roberts as the creator of the ARPANET project and now the modern-day Internet.

The 1970s and ’80s I.

Critique the use of ARPANET and how it became more widely used and consequentially misused.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

II.

Recognize that Robert M. Metcalfe expressed concerns about ARPANET and how it could be easily hacked into due to password structure vulnerabilities, lack of safety protocols, and widely distributed phone numbers for system access.

III.

Conclude that a lack of controls in place provided users limited safeguards to protect themselves from unauthorized remote users.

IV.

Discuss how dial-up connections lacked safety protocols when connecting to ARPANET.

V.

Recall that authorizations into the system and a lack of user identification were significant security risks for ARPANET during this time.

VI.

Evaluate the movement of stronger security protocols thanks to the implementation of conclusions from the Rand Report R-609.

VII.

Relate how the need of physical security protocols grew to include computer security protocols as part of a holistic information security plan.

MULTICS I.

Define the purpose of the Multiplexed Information and Computing Service (MULTICS) and its importance to information security.

II.

Relate that the restructuring of the MULTICS project created the UNIX operating system in 1969.

III.

Contrast the facts that the MULTICS system had multiple security levels planned, whereas the new UNIX system did not have them included.

IV.

Examine the decentralization of data processing and why it is important to modernday information security protocols.

V.

Distinguish that in the late 1970s microprocessors transformed computing capabilities but also established new security threats.

VI.

Recall the Defense Advanced Research Projects Agency (DARPA) created the Computer Emergency Response Team (CERT) in 1988.

VII.

Conclude that not until the mid-1980s computer security was a non-issue for federal information systems.

The 1990s I.

Understand that as more computers and their networks became more common, the need to connect networks rose in tandem during this time. Hence, the Internet was born out of the need to have a global network of networks.

II.

Analyze the consequences of how exponential growth of the Internet early on resulted in security being a low priority over other core components.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

III.

Identify that the networked computers were the most common style of computing during this time. However, a result of this was the lessened ability to secure a physical computer and stored data is more exposed to security threats internally and externally.

IV.

Recognize that toward the turn of the new millennium, numerous large corporations demonstrated the need and integration of security into their internal systems. Antivirus products grew in popularity and information security grown into its own discipline because of these proactive initiatives.

2000 to Present I.

Recall the fact that millions of unsecured computer networks and billions of computing devices are communicating with each other.

II.

Recognize and apply the fact that cyberattacks are increasing and have caused governments and corporations to resign themselves to stronger information security protocols.

III.

Examine the exponential rise in mobile computing and how these devices bring their own set of vulnerabilities with respect to information security.

IV.

Apply the fact that one’s ability to secure the information stored in their device is influenced by security protocols on the others they are connected to.

V.

Establish that wireless networks and their associated risks often have minimal security protocols in place and can be a catalyst for anonymous attacks.

What Is Security? (1.3, PPT Slides 18 and 21–26) I.

Define the term security and why it is important to have multiple layers of it to protect people, operations, infrastructure, functions, communications, and information.

II.

Emphasize the role of the Committee on National Security Systems (CNSS) and its role in defining information security. This includes the protection of critical elements such as systems and hardware that stores, transmits, and use information.

III.

Recognize the importance of the C.I.A. Triad but which is no longer an adequate model to apply to modern information security needs.

Key Information Security Concepts I.

Comprehend and define the following security terms and concepts: •

Access: A subject or object’s ability to use, manipulate, modify, or affect another subject or object. Authorized users have legal access to a system, whereas hackers must gain illegal access to a system. Access controls regulate this ability.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

•

Asset: The organizational resource that is being protected. An asset can be logical, such as a Web site, software information, or data, or an asset can be physical, such as a person, computer system, hardware, or other tangible object. Assets, particularly information assets, are the focus of what security efforts are attempting to protect.

•

Attack: An intentional or unintentional act that can damage or otherwise compromise information and the systems that support it. Attacks can be active or passive, intentional or unintentional, and direct or indirect. Someone who casually reads sensitive information not intended for his or her use is committing a passive attack. A hacker attempting to break into an information system is an intentional attack. A lightning strike that causes a building fire is an unintentional attack. A direct attack is perpetrated by a hacker using a PC to break into a system. An indirect attack is a hacker compromising a system and using it to attack other systems—for example, as part of a botnet (slang for robot network). This group of compromised computers, running software of the attacker’s choosing, can operate autonomously or under the attacker’s direct control to attack systems and steal user information or conduct distributed denial-of-service attacks. Direct attacks originate from the threat itself. Indirect attacks originate from a compromised system or resource that is malfunctioning or working under the control of a threat.

•

Control, safeguard, or countermeasure: Security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve security within an organization. The various levels and types of controls are discussed more fully in the following modules.

•

Exploit: A technique used to compromise a system. This term can be a verb or a noun. Threat agents may attempt to exploit a system or other information asset by using it illegally for their personal gain, or an exploit can be a documented process to take advantage of a vulnerability or exposure, usually in software, that is either inherent in the software or created by the attacker. Exploits make use of existing software tools or custom-made software components.

•

Exposure: A condition or state of being exposed; in information security, exposure exists when a vulnerability is known to an attacker.

•

Loss: A single instance of an information asset suffering damage or destruction, unintended or unauthorized modification or disclosure, or denial of use. When an organization’s information is stolen, it has suffered a loss. Protection profile or security posture is the entire set of controls and safeguards—including policy, education, training and awareness, and technology—that the organization implements to protect the asset. The terms are sometimes used interchangeably

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

with the term security program although a security program often comprises managerial aspects of security, including planning, personnel, and subordinate programs. •

Risk: The probability of an unwanted occurrence, such as an adverse event or loss. Organizations must minimize risk to match their risk appetite—the quantity and nature of risk they are willing to accept.

•

Subjects and objects of attack: A computer can be either the subject of an attack—an agent entity used to conduct the attack—or the object of an attack: the target entity. See Figure 1-8. A computer can also be both the subject and object of an attack. For example, it can be compromised by an attack (object) and then used to attack other systems (subject).

•

Threat: Any event or circumstance that has the potential to adversely affect operations and assets. The term threat source is commonly used interchangeably with the more generic term threat. The two terms are technically distinct, but to simplify discussion, the text will continue to use the term threat to describe threat sources.

•

Threat agent: The specific instance or a component of a threat. For example, the threat source of “trespass or espionage” is a category of potential danger to information assets, while “external professional hacker” (like Kevin Mitnick, who was convicted of hacking into phone systems) is a specific threat agent. A lightning strike, hailstorm, or tornado is a threat agent that is part of the threat source known as “acts of God/acts of nature.”

•

Threat event: An occurrence of an event caused by a threat agent. An example of a threat event might be damage caused by a storm. This term is commonly used interchangeably with the term attack.

•

Threat source: A category of objects, people, or other entities that represents the origin of danger to an asset—in other words, a category of threat agents. Threat sources are always present and can be purposeful or undirected. For example, threat agent “hackers,” as part of the threat source “acts of trespass or espionage,” purposely threaten unprotected information systems, while threat agent “severe storms,” as part of the threat source “acts of God/acts of nature,” incidentally threaten buildings and their contents.

•

Vulnerability: A potential weakness in an asset or its defensive control system(s). Some examples of vulnerabilities are a flaw in a software package, an unprotected system port, and an unlocked door. Some well-known vulnerabilities have been examined, documented, and published; others remain latent (or undiscovered).

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Critical Characteristics of Information I.

Recognize that when a characteristic of information changes, the value of that information may increase but more so decreases.

II.

Comprehend and define the following security terms and concepts: confidentiality, personally identifiable information (PII), integrity, availability, accuracy, authenticity, utility, and possession.

Confidentiality I.

Define the purpose of confidentiality and the measures that must be in place to protect information. •

Information classification

•

Securely storing documents

•

Applying general security policies and protocols

•

Educating information custodians and end users

II.

Analyze common reasons confidentiality breaches occur.

III.

Review the concept of personally identifiable information (PII) and its application to confidentiality.

Integrity I.

Examine the concept of integrity and its application to information security principles.

II.

Justify that file corruption is not strictly the result of hackers or other external forces but can include internal forces such as noise, low-voltage circuits, and retransmissions.

Availability I.

Define the concept of availability and how it allows users to access information without restriction in their required formats.

Accuracy I.

Understand that accuracy of data transmitted in information is important as it must be free of mistakes or errors, and it aligns with end user’s expectations.

Authenticity I.

Identify the fact that information is authentic when it is given to a user in the same state that it was created, placed, stored, or transferred.

II.

Evaluate the example of e-mail spoofing and how messages sent look authentic on the surface but are, in fact, not.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Utility I.

Examine the usefulness of information and how it can be applied for an end purpose.

Possession I.

Recall this attribute as one where the ownership or control of information has legitimacy or authorization.

II.

Assess the scenario where a breach of possession does not always equate to a breach of confidentiality.

CNSS Security Model I.

II.

Discuss the concept of the McCumber Cube and its application into computer and information security protocols. •

Quantify via Figure 1-9 (page 14) within the text that there are a total of 27 areas (3 x 3 x 3) that must be properly addressed during a security process.

•

Understand the fact that as policy, education, and technology increase, so too the needs for confidentiality, integrity, availability, storage, processing, and transmission.

Conclude that a common exclusion in this model is the need for guidelines and policies that provide direction for implementation technologies and the practices of doing so.

Components of an Information System (1.3, PPT Slide 27) I.

Gain an understanding that to have a full understanding of the importance of an information system, one must have an awareness of what all is included within it.

II.

Review the six most common elements of an information system. •

Software

•

Hardware

•

Data

•

People

•

Procedures

•

Networks

Software

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

I.

Compare and contrast the different types of software that are used to digitally operate an information system. These include applications or programs, operating systems, and assorted command utilities. II. Justify the core reason that software is used is to carry information through an organization.

Hardware I.

Classify that this part of an information system is the physical technologies that house and execute software, stores and transports data, and provides an interface for entry and removal of information within it. II. Acquire an understanding of the concept of physical security and its importance to an information system.

Data I.

Recall that data that is stored, processed, and/or transmitted must be protected as it is the most valuable asset an organization possesses. II. Gain awareness that the protection of physical information is just as important as the protection of electronic information.

People I.

Establish that people are often the weakest link of an information system since they provide direction, design, develop, and ultimately use and game them to operate in the business world.

Procedures I.

Recall that procedures are written instructions that are created to accomplish a specific task or action. Note that they may or may not use the technology of an information system. II. Recognize that they provide the foundation for technical controls and security systems that must be designed so they can be implemented.

Networks I.

Acknowledge the fact that modern information processing systems are highly complex and rely on numerous internal and external connections. II. Conclude that networks are the highway in which information systems pass data and users complete their tasks on a daily basis. III. Justify that proper network controls in an organization are vital to managing information flows and the security of data transmitted internally and externally. Quick Quiz 1

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

1. True or False: Network security addresses the issues needed to protect items, objects, or areas. Answer: False 2. Which type of security addresses the protection of all communications media, technology, and content? a. information b. network c. physical d. communication Answer: d 3. Which type of security encompasses the protection of voice and data networking components, connections, and content? a. information b. network c. physical d. communications Answer: b 4. What term is used to describe the quality or state of ownership or control of information? a. confidentiality b. possession c. authenticity d. integrity Answer: b 5. True or False: If information has a state of being genuine or original and is not a fabrication, it has the characteristic of authenticity. Answer: True

Security and the Organization (1.4, PPT Slides 28–33, 36–38, and 41) I.

Analyze components that make up security as a program and the professionals who are tasked with maintaining it within an organization.

Balancing Information Security and Access © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

I.

Recall that everyone does not have carte blanche access to all data that is transmitted, processed, or stored within or outside an organization.

II. Comprehend that security is never an absolute as it is a process and not a goal. III. Interpret that security is a delicate balance between protection and availability.

Approaches to Information Security Implementation I.

Compare and contrast the two most commonly used approaches to information security implementation: bottom-up and top-down. •

•

Bottom-up approaches implement security policies and/or policies from the ground up where system administrators are responsible for improving the security of the system. A top-down approach is quite the opposite where upper management determines security policies for an organization. This is usually the Chief Information Officer (CIO) or the Vice President of Information Technology (VP-IT).

II. Conclude that often a bottom-up approach rarely works, and a top-down approach has the most effectiveness in an organization.

Security Professionals I.

Compare and contrast the different positions that are part of an implementation for an information security program. •

The Chief Information Officer (CIO) is the senior technology officer of an organization and provides guidance to the owner or CEO strategic planning that affects information management in an organization.

•

The Chief Security Officer (CISO) assesses, manages, and implements information security in an organization.

Senior Management I.

II.

Examine that the Chief Information Officer (CIO) is the senior technology officer although other titles such as vice president of information, VP of information technology, and VP of systems may also be used. The CIO is primarily responsible for advising the chief executive officer, president, or company owner on the strategic planning that affects the management of information in the organization. Contrast with the CIO that the Chief Information Security Officer (CISO) is the individual primarily responsible for the assessment, management, and implementation of securing the information in the organization. The CISO may also be referred to as the manager for security, the security administrator, or a similar title.

Information Security Project Team

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

I.

Review the core team members of an information security project team and their specific role: •

•

•

•

•

• •

Champion: A senior executive who promotes the project and ensures its support, both financially and administratively, at the highest levels of the organization. Team leader: A project manager, who may be a departmental line manager or staff unit manager and who understands project management, personnel management, and information security technical requirements. Security policy developers: Individuals who understand the organizational culture, policies, and requirements for developing and implementing successful policies. Risk assessment specialists: Individuals who understand financial risk assessment techniques, the value of organizational assets, and the security methods to be used. Security professionals: Dedicated, trained, and well-educated specialists in all aspects of information security from both a technical and nontechnical standpoint. Systems administrators: Individuals whose primary responsibility is administering the systems that house the information used by the organization. End users: Those whom the new system will most directly impact. Ideally, a selection of users from various departments, levels, and degrees of technical knowledge assist the team in focusing on the application of realistic controls applied in ways that do not disrupt the essential business activities they seek to safeguard.

Data Responsibilities I.

Compare and contrast persons who own and safeguard data within an organization. •

•

•

Data Owners: Those responsible for the security and use of a particular set of information. Data owners usually determine the level of data classification associated with the data, as well as changes to that classification required by organizational change. Data Custodians: Those responsible for the storage, maintenance, and protection of the information. The duties of a data custodian often include overseeing data storage and backups, implementing the specific procedures and policies laid out in the security policies and plans, and reporting to the data owner. Data Trustees: Individuals appointed by data owners who oversee the management of an information set and its use. Though these are often executives, they appoint someone else to handle these responsibilities.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Data Users: End users who work with the information to perform their daily jobs supporting the mission of the organization. Everyone in the organization is responsible for the security of data, so data users are included here as individuals with an information security role. II. Recall that data stewards are also known as data custodians. •

Communities of Interest I.

Establish an understanding that each organization develops and maintains its own unique culture and values. II. Recall that a community of interest is a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives. III. Disseminate the fact there can be many different communities of interest in an organization which aid in information security practices.

Information Security Management and Professionals I.

Apply knowledge that these professionals are aligned with an information security’s community of interest.

II.

Review the fact that their goal is to protect an organization’s information and stored information from internal and external attacks.

Information Technology Management and Professionals I.

Recognize that these individuals are often a team of IT managers and skilled professionals in a number of areas: systems design, programming, and networks at a minimum.

II.

Establish an understanding their goals do not always align with the information security community based on an organization’s structure. Conflict may result if there are inconsistencies between them.

Organization Management and Professionals I.

Analyze that this group of persons in an organization are often other managers and professionals who are consumers of information being secure.

Information Security: Is It an Art or a Science? (PPT Slides 42–43) I.

Gain an understanding that the implementation of information security has often been described as a combination of art and science due to the complex nature of information systems. II. Discuss the concept of a “security artisan” and explain how it is based on the way individuals see technologists as computers became more commonplace in the workplace.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Security as Art I.

Recognize that there are no hard and fast rules regulating the installation of various security mechanisms, nor are there many universally accepted complete solutions. II. Conclude that there is no one user’s manual that can solve all security issues that a system may encounter. As an organization becomes more complex, so do the controls and technology needed to keep it together.

Security as a Science I.

Establish an understanding that technologies that are developed are enacted by highly trained computer scientists and engineers who are required to operate at rigorous levels of performance. II. Conclude that specific scientific conditions often cause virtually all actions that occur in a computer system. Nearly everything that negatively occurs in a system is a result of an interaction between software and hardware. III. Justify that with enough time and resources, developers could eliminate faults that occur.

Security as a Social Science I.

Understand a combination of both components of art and science make security a social science. II. Identify a social science as the examination of people’s behavior and their interactions with (information) systems. III. Conclude that end users who need the information security personnel protect are often the weakest links in the security chain. Quick Quiz 2 1. When projects are initiated at the highest levels of an organization and then pushed to all levels, they are said to follow which approach? b. executive-led c. trickle down d. top-down e. bottom-up Answer: c 2. ________ ensures that only users with the rights, privileges, and need to access information are able to do so. a. confidentiality b. enhanced credentials c. software engineers © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

d. awareness Answer: a 3. True or False: The person responsible for the storage, maintenance, and protection of the information is the data custodian. Answer: True 4. Which critical characteristic of information discussed is one that focuses on the fact when information stored, transferred, created, or placed is in the same state as it was received? a. utility b. possession c. accuracy d. authenticity Answer: d 5. Which of the following examines the behavior of individuals as they interact with systems, whether societal systems or information systems? a. community science b. social science c. societal science d. interaction management Answer: b [return to top]

Discussion Questions You can assign these questions several ways: in a discussion forum in your LMS, as wholeclass discussions in person, or as a partner or group activity in class. These questions are separate from the review questions and exercises in the textbook. For answers to the textbook questions, see the associated solutions for this module. Additional class discussion options: 1. What are the defining differences between computer security and information security? (1.2, PPT Slides 5, 7–9, and 13) Duration 15 minutes.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

2. When reviewing the critical characteristics of information, which one is the most important? Why is that the case and should all receive equal attention? (1.3, PPT Slides 18 and 25–26) Duration 15 minutes. 3. Do information security professionals have superiority over one another outside of their ranking in an organization? Why or why not? (1.4, PPT Slides 29–33) Duration 15 minutes. [return to top]

Suggested Usage for Lab Activities A series of hands-on labs has been developed to complement the text material for this course and are available for download at the Instructor Center. The labs do not depend on specific chapter content, so instructors can insert them where they best suit the syllabus. The following is a list of lab titles, objectives, and approximate durations to assist with lesson planning. Lab Title Ethical Considerations in IT and Detecting Phishing Attacks

Web Browser Security

Malware Defense

Objective Upon completion of this activity, you will: • have a better understanding of the ethical expectations of IT professionals; and • be able to identify several types of social engineering attacks that use phishing techniques. Upon completion of this activity, the student will be able to: • Review and configure the security and privacy settings in the most popular web browsers. Upon completion of this activity, the student will be able to: • Understand the basic setup and use of an open-source AV product. • Install and use Clam AV on a Windows system. • Using a USB storage device create a portable AV scanner. • Understand what a YARA file is and how it is used.

Duration Ethical Considerations lab in 15 to 20 minutes. Phishing E-Mail lab in 60 to 75 minutes.

1 to 1.5 hours

1 to 1.5 hours

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Windows Password Management

Backup and Recovery and File Integrity Monitoring

OS Processes and Services

Log Management & Security

Footprinting, Scanning, and Enumeration

AlienVault OSSIM

Upon completion of this activity, the student will be able to: • Review and configure password management policies in a Windows client computer. Upon completion of this activity, you will be able to: • Describe backup and recovery processes and will be aware of basic backup activities using Windows 10 or another desktop operating system (OS). • Perform file integrity monitoring using file hash values. Upon completion of this activity, the student will be able to: • Review available and enabled OS services. • Review available and enabled OS processes. • Review current system resource utilization. Upon completion of this activity, the student will be able to: • Access and review the various logs present in a Windows 10 computer. Upon completion of this activity, the student will be able to: • Identify network addresses associated with an organization. • Identify the systems associated with the network addresses. Upon completion of this activity, the student will be much more knowledgeable about the AlienVault OSSIM software and how to install, configure, and operate it. You will use the software more extensively in a subsequent lab.

30 minutes to 1 hour

15–20 minutes

60–90 minutes

30 minutes to 1 hour

40–60 minutes

2–3 hours

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Image Analysis Using Autopsy

Upon completion of this activity, the student will be able to perform basic drive image analysis using the Autopsy software package.

45–70 minutes

[return to top]

Additional Activities and Assignments Please see associated solutions for the Closing Scenario at the end of the textbook module. Additional project options include the following: 1. Using the Internet, find a recent feature article about a CISO or other IT professional with CISO job functions. Write a short summary of that individual and how he or she came to hold that position. The publications ComputerWorld and Information Week often have these kinds of features. Have students list the hardware assets found in a computing lab and then list the attributes of those assets. They should provide as many facts about each asset as possible. 2. Using a library with current periodicals, find a recent news article about a topic related to information security. Write a one- to two-page review of the article and how it is related to the principles of information security introduced in the textbook. [return to top]

Additional Resources Cengage Video Resources •

MindTap Video: What is Information Security

Internet Resources • • • •

Internet Society—Histories of the Internet CNSS National Information Assurance Glossary Microsoft Security Development Lifecycle The Role of a Chief Security Officer

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 1: Introduction to Information Security

Appendix Grading Rubrics Providing students with rubrics helps them understand expectations and components of assignments. Rubrics help students become more aware of their learning process and progress, and they improve students’ work through timely and detailed feedback. Customize these rubrics as you wish. The grading rubric suggests a 4-point scale and the discussion rubric indicates 30 points.

Grading Rubric These grading criteria can be applied to open-ended Review Questions, Real-World Exercises, Case Studies, and Security for Life activities 3

2

1

0

Exceeds Expectations

Meets Expectations • Student demonstrates accurate understanding of the concept. • Student applies the concept appropriately. • Student develops a complete response to the prompt.

Needs Improvement • Student’s response demonstrates a gap in understanding of the concept. • Student applies the concept incorrectly. • Student’s response is poorly developed or incomplete.

Inadequate • Student’s response is missing or incomplete. • Student’s response demonstrates a critical gap in understanding. • Student is unable to apply the concept.

• Student demonstrates accurate understanding of the concept. • Student applies the concept appropriately. • Student uses sound critical analysis to develop an insightful and comprehensive response to the prompt. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Instructor Manual Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 2 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 9 Module Outline ............................................................................................................................ 10 Discussion Questions .................................................................................................................. 35 Suggested Usage for Lab Activities ............................................................................................ 35 Additional Activities and Assignments ....................................................................................... 37 Additional Resources................................................................................................................... 37 Cengage Video Resources ....................................................................................................................... 37 Internet Resources .................................................................................................................................. 37 Appendix ...................................................................................................................................... 39 Grading Rubrics ....................................................................................................................................... 39

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Purpose and Perspective of the Module Protecting information is one of the most important tasks an organization must monitor around the clock and regardless as to where personnel are located. In this module, students will gain knowledge as to the purpose of information security and the need that is present in organizations. Next, they will gain an understanding of why a successful information security program is the shared responsibility of the entire organization and not just departments that focus on technology. In the second half of the module, emphasis is placed on threats that occur to trigger information security solutions and common attacks of them. The final part of the module lists common information security issues that result from poor software development efforts.

Cengage Supplements The following product-level supplements provide additional information that may help you in preparing your course. They are available in the Instructor Resource Center. • • • • •

PowerPoint slides Test banks, available in Word, as LMS-ready files, and on the Cognero platform MindTap Educator Guide Solution and Answer Guide This instructor’s manual

Module Objectives The following objectives are addressed in this module: 2.1

Discuss the need for information security.

2.2

Explain why a successful information security program is the shared responsibility of the entire organization.

2.3

List and describe the threats posed to information security and common attacks associated with those threats.

2.4

List the common information security issues that result from poor software development efforts.

Complete List of Module Activities and Assessments For additional guidance, refer to the MindTap Educator Guide. Module Objective

PPT slide

Activity/Assessment

Duration

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

2.1, 2.2, and 2.3 2.3 and 2.4 2.4 2.1–2.4

11–12

Knowledge Check Activity 1

2 minutes

31–32 64–65 77 MindTap MindTap MindTap

Knowledge Check Activity 2 Knowledge Check Activity 3 Self-Assessment Module 02 Review Questions Module 02 Case Exercises Module 02 Exercises

MindTap MindTap

Module 02 Security for Life Module 02 Quiz

2 minutes 2 minutes 5 minutes 30–40 minutes 30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: information asset: The focus of information security; information that has value to the organization and the systems that store, process, and transmit the information. media: As a subset of information assets, the systems, technologies, and networks that store and transmit information. data: Items of fact collected by an organization; includes raw numbers, facts, and words. information: Data that has been organized, structured, and presented to provide additional insight into its context, worth, and usefulness. database: A collection of related data stored in a structured form and usually managed by specialized systems. database security: A subset of information security that focuses on the assessment and protection of information stored in data repositories. exploit: A technique used to compromise a system; may also describe the tool, program, or script used in the compromise. intellectual property (IP): Original ideas and inventions created, owned, and controlled by a particular person or organization; IP includes the representation of original ideas. software piracy: The unauthorized duplication, installation, or distribution of copyrighted computer software, which is a violation of intellectual property. availability disruption: An interruption or disruption in service, usually from a service provider, which causes an adverse event within an organization.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

service level agreement (SLA): A document or part of a document that specifies the expected level of service from a service provider, including provisions for minimum acceptable availability and penalties or remediation procedures for downtime. uptime: The percentage of time a particular service is available. downtime: The percentage of time a particular service is not available. blackout: A long-term interruption (outage) in electrical power availability. brownout: A long-term decrease in quality of electrical power availability. fault: A short-term interruption in electrical power availability. noise: The presence of additional and disruptive signals in network communications or electrical power delivery. sag: A short-term decrease in electrical power availability. spike: A short-term increase in electrical power availability, also known as a swell. surge: A long-term increase in electrical power availability. competitive intelligence: The collection and analysis of information about an organization’s business competitors through legal and ethical means to gain business intelligence and competitive advantage. industrial espionage: The collection and analysis of information about an organization’s business competitors, often through illegal or unethical means, to gain an unfair competitive advantage; also known as corporate spying. shoulder surfing: The direct, covert operation of individual information or system use. trespass: Unauthorized entry into the real or virtual property of another party. hacker: A person who accesses systems and information without authorization and often illegally. expert hacker: A hacker who uses extensive knowledge of the inner workings of computer hardware and software to gain unauthorized access to systems and information, and who often creates automated exploits, scripts, and tools used by other hackers; also known as an elite hacker. novice hacker: A relatively unskilled hacker who uses the work of expert hackers to perform attacks; also known as a neophyte, n00b, newbie, script kiddie, or packet monkey. professional hacker: A hacker who conducts attacks for personal financial benefit or for a crime organization or foreign government; not to be confused with a penetration tester. penetration tester: An information security professional with authorization to attempt to gain system access in an effort to identify and recommend resolutions for vulnerabilities in those systems; also known as a pen tester. © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

pen tester: See penetration tester. script kiddies: Novice hackers who use expertly written software to attack a system; also known as skids, skiddies, or script bunnies. packet monkey: A novice hacker who uses automated exploits to engage in denial-ofservice attacks. privilege escalation: The unauthorized modification of an authorized or unauthorized system user account to gain advanced access and control over system resources. jailbreaking: Escalating privileges to gain administrator-level or root access control over a smartphone operating system; typically associated with Apple iOS smartphones. See also rooting. rooting: Escalating privileges to gain administrator-level control over a computer system (including smartphones); typically associated with Android OS smartphones. See also jailbreaking. cracker: A hacker who intentionally removes or bypasses software copyright protection designed to prevent unauthorized duplication or use. phreaker: A hacker who manipulates the public telephone system to make free calls or disrupt services. cracking: Attempting to reverse-engineer, remove, or bypass a password or other access control protection, such as the copyright protection on software (see cracker). brute force password attack: An attempt to guess a password by attempting every possible combination of characters and numbers in it. 10.4 password rule: An industry recommendation for password structure and strength that specifies passwords should be at least 10 characters long and contain at least one of the following four elements: an uppercase letter, one lowercase letter, one number, and one special character. dictionary password attack: A variation of the brute force password attack that attempts to narrow the range of possible passwords guessed by using a list of common passwords and possibly including attempts based on the target’s personal information. rainbow table: A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system’s encrypted password file. social engineering: The process of using interpersonal skills to convince people to reveal access credentials or other valuable information to an attacker. business e-mail compromise (BEC): A social engineering attack involving the compromise of an organization’s e-mail system followed by a series of forged e-mail messages directing

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

employees to transfer funds to a specified account, or to purchase gift cards and send them to an individual outside the organization. advance-fee fraud (AFF): A form of social engineering, typically conducted via e-mail, in which an organization or some third party indicates that the recipient is due an exorbitant amount of money and needs only to send a small advance fee or personal banking information to facilitate the transfer. phishing: A form of social engineering in which the attacker provides what appears to be a legitimate communication (usually e-mail), but it contains hidden or embedded code that redirects the reply to a third-party site in an effort to extract personal or confidential information. spear phishing: A highly targeted phishing attack. pretexting: A form of social engineering in which the attacker pretends to be an authority figure who needs information to confirm the target’s identity, but the real object is to trick the target into revealing confidential information; commonly performed by telephone. information extortion: The act of an attacker or trusted insider who steals or interrupts access to information from a computer system and demands compensation for its return or for an agreement not to disclose the information. cyberextortion: See information extortion. ransomware: Computer software specifically designed to identify and encrypt valuable information in a victim’s system in order to extort payment for the key needed to unlock the encryption. hacktivist: A hacker who seeks to interfere with or disrupt systems to protest the operations, policies, or actions of an organization or government agency. cyberactivist: See hacktivist. doxing: A practice of using online resources to find and then disseminate compromising information, perhaps without lawful authority, with the intent to embarrass or harm the reputation of an individual or organization. The term originates from dox, an abbreviation of documents. cyberterrorism: The conduct of terrorist activities via networks or Internet pathways. cyberterrorist: A hacker who attacks systems to conduct terrorist activities via networks or Internet pathways. cyberwarfare: Formally sanctioned offensive operations conducted by a government or state against information or systems of another government or state; sometimes called information warfare.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

malware: Computer software specifically designed to perform malicious or unwanted actions. malicious software: See malware. zero-day attack: An attack that makes use of malware that is not yet known by the antimalware software companies. adware: Malware intended to provide undesired marketing and advertising, including popups and banners on a user’s screens. spyware: Any technology that aids in gathering information about people or organizations without their knowledge. virus: A type of malware that is attached to other executable programs and, when activated, replicates and propagates itself to multiple systems, spreading by multiple communications vectors. macro virus: A type of virus written in a specific language to target applications that use the language and activated when the application’s product is opened; typically affects documents, slideshows, e-mails, or spreadsheets created by office suite applications. boot virus: Also known as a boot sector virus, a type of virus that targets the boot sector or Master Boot Record (MBR) of a computer system’s hard drive or removable storage media. memory-resident virus: A virus that is capable of installing itself in a computer’s operating system, starting when the computer is activated, and residing in the system’s memory even after the host application is terminated; also known as a resident virus. non-memory-resident virus: A virus that terminates after it has been activated, infected its host system, and replicated itself; does not reside in an operating system or memory after executing and is also known as a non-resident virus. worm: A type of malware that is capable of activation and replication without being attached to an existing program. Trojan horse: A malware program that hides its true nature and reveals its designed behavior only when activated. polymorphic threat: Malware that over time changes the way it appears to antivirus software programs, making it undetectable by techniques that look for preconfigured signatures. malware hoax: A message that reports the presence of nonexistent malware and wastes valuable time as employees share the message. back door: A malware payload that provides access to a system by bypassing normal access controls or an intentional access control bypass left by a system designer to facilitate development.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

trap door: See back door. maintenance hook: See back door. denial-of-service (DoS) attack: An attack that attempts to overwhelm a computer target’s ability to handle incoming communications, prohibiting legitimate users from accessing those systems. distributed denial-of-service (DDoS) attack: A form of attack in which a coordinated stream of requests is launched against a target from multiple locations at the same time using bots or zombies. bot: An abbreviation of robot, an automated software program that executes certain commands when it receives a specific input; also known as a zombie. zombie: See bot. spam: Undesired e-mail, typically commercial advertising transmitted in bulk. mail bomb: An attack designed to overwhelm the receiver with excessive quantities of email. packet sniffer: A software program or hardware appliance that can intercept, copy, and interpret network traffic. sniffer: See packet sniffer. spoofing: The use of a communications identifier, such as a phone number, network address, or e-mail address, that is not accurately assigned to the source. IP spoofing: A technique for gaining unauthorized access to computers using a forged or modified source IP address to give the perception that messages are coming from a trusted host. pharming: The redirection of legitimate user Web traffic to illegitimate Web sites with the intent to collect personal information. Domain Name System (DNS) cache poisoning: The intentional hacking and modification of a DNS database to redirect legitimate traffic to illegitimate Internet locations; also known as DNS spoofing. man-in-the-middle: A group of attacks whereby a person intercepts a communications stream and inserts himself in the conversation to convince each of the legitimate parties that he is the other communications partner; some of these attacks involve encryption functions. TCP hijacking: A form of man-in-the-middle attack whereby the attacker inserts himself into TCP/IP-based communications. session hijacking: See TCP hijacking.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

mean time between failure (MTBF): The average amount of time between hardware failures, calculated as the total amount of operation time for a specified number of units divided by the total number of failures. mean time to failure (MTTF): The average amount of time until the next hardware failure. mean time to diagnose (MTTD): The average amount of time a computer repair technician needs to determine the cause of a failure. mean time to repair (MTTR): The average amount of time a computer repair technician needs to resolve the cause of a failure through replacement or repair of a faulty unit. annualized failure rate (AFR): The probability of a failure of hardware based on the manufacturer’s data of failures per year. cross-site scripting (XSS): A Web application fault that occurs when an application running on a Web server inserts commands into a user’s browser session and causes information to be sent to a hostile server. buffer overrun: An application error that occurs when more data is sent to a program buffer than it is designed to handle. integer bug: A class of computational error caused by methods that computers use to store and manipulate integer numbers; this bug can be exploited by attackers. command injection: An application error that occurs when user input is passed directly to a compiler or interpreter without screening for content that may disrupt or compromise the intended function. theft: The illegal taking of another’s property, which can be physical, electronic, or intellectual. [return to top]

What's New in This Module The following elements are improvements in this module from the previous edition: • • •

This module was Chapter 2 in the 6th edition. The sections on the threats and attacks were updated to reflect the latest trends, and examples were updated. The entire module was refreshed with a general update and given more current examples.

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Module Outline Introduction to the Need for Information Security (2.1, 2.2, PPT Slides 3–9) I.

Discuss the view that information security is unlike any other aspect of information technology. The primary mission is to ensure things stay the way they are. Point out that if there were no threats to information and systems, we could focus on improving systems that support the information.

II.

Explain that organizations must understand the environment in which information systems operate so that their information security programs can address actual and potential problems.

III.

Emphasize to students the four important functions for an organization with respect to information security: •

Protecting the organization’s ability to function

•

Protecting the data and information the organization collects and uses

•

Enabling the safe operation of applications running on the organization’s IT systems

•

Safeguarding the organization’s technology assets

Business Needs First I.

Explain that without the underlying business to generate revenue and use information, it has a likelihood to lose value and the need for it would go to zero.

II.

Stress that the decisions that need to be made with respect to information security and their assets should be done carefully and holistically.

III.

Emphasize that the responsibility of protecting information within an organization is everyone’s responsibility. Regardless of their title, rank in the firm, or position, everyone must proactively protect the data it stores and uses.

Protecting Functionality I.

Discuss the fact that general management, IT management, and information security management are responsible for implementing information security to protect the ability of the organization to function.

II.

Relate to students that information security is a management issue in addition to a technical issue; it is a people issue in addition to the technical issue.

III.

Explain that to assist management in addressing the need for information security, communities of interest must communicate in terms of business impact and the

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

cost of business interruption, and they must avoid arguments expressed only in technical terms.

Protecting Data That Organizations Collect and Use I.

Stress to students that they should understand that many organizations realize that one of their most valuable assets is their data. Without data, an organization loses its record of transactions and/or its ability to deliver value to its customers.

II.

Explain the concept of data security. This concept is about protecting data in motion and data at rest, a critical aspect of information security. An effective information security program is essential to the protection of the integrity and value of the organization’s data.

III.

Detail how information is stored. This is often stored using databases and database security is important because it applies a broad range of control mechanisms to numerous areas of information security.

Enabling the Safe Operation of Applications I.

Distinguish an understanding that a modern organization needs to create an environment that protects and safeguards applications, specifically ones that are important elements to the infrastructure of a firm—operating systems, platforms, operational applications, e-mail, instant messaging applications, and text messaging platforms.

Safeguarding Technology Assets in Organizations I.

Relate to students that as an organization grows, so does its need for more robust technologies and commercial-grade solutions.

II.

Explain the example that is provided in the textbook that lists core components of security technologies (a commercial-grade, unified security architecture device, complete with intrusion detection and prevention systems, public key infrastructure (PKI), and virtual private network (VPN) capabilities).

III.

Establish that although cloud services provide another way to solve business information management challenges, they inherit their own set of risks and concerns that must be defended against.

Information Security Threats and Attacks (2.3, PPT Slides 10 and 13–23) I.

Remind students that to make sound decisions about information security as well as to create and enforce policies, management must be informed of the various kinds of threats facing the organization and its applications, data, and information systems.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

Explain that a threat is an object, person, or other entity that represents a constant danger to an asset. Point out that an attack represents an ongoing act against the asset that could result in a loss. Also mention that threat agents use exploits to take advantage of vulnerabilities where controls are not present or are no longer effective.

4.8 Billion Potential Hackers I.

State that about 62 percent of the world’s population (about 4.8 billion) have some form of internet access, which is significantly up from 2015, when 49.2 percent of the population had access.

II.

Discuss the agreement that the threat from external sources increases when an organization connects to the Internet.

III.

Guide students to briefly review the world Internet usage spread in Table 2-1.

Other Studies of Threats I.

Point out to students that according to a recent study and survey, 67.1 precent of responding organizations suffered malware infections. Also, more than 98 percent of responding organizations identified malware as the second-highest threat source behind electronic phishing/spoofing.

II.

Discuss Tables 2-2, 2-3, and 2-4 that outline threats from internal and external stakeholders as well as general threats to information assets.

Common Attack Pattern Enumeration and Classification (CAPEC) I.

Introduce students to the CAPEC Web site, which can be used by security professionals to understand attacks.

II.

Explain that this resource is a good tool for information security professionals to use to gain additional insight on how attacks occur procedurally.

The 12 Categories of Threats (2.3, 2.4, PPT Slides 24–72) I.

Apply the use of Table 2-5 to explain the 12 categories of threats that represent a clear and present danger to an organization’s people, information, and systems. In summary, they are the following: •

Compromises to intellectual property

•

Deviations in quality of service

•

Espionage or trespass

•

Forces of nature

•

Human error or failure

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

•

Information extortion

•

Sabotage or vandalism

•

Software attacks

•

Technical hardware failures or errors

•

Technical software failures or errors

•

Technological obsolescence

•

Theft

Recognize that a threat to an organization may include more than one of these categories, depending on the severity of the attack.

Compromises to Intellectual Property I.

Explain that many organizations create or support the development of intellectual property (IP) as part of their business operations. Intellectual property is defined as “the ownership of ideas and control over the tangible or virtual representation of those ideas.”

II.

Recall that intellectual property for an organization includes trade secrets, copyrights, trademarks, and patents. Once intellectual property has been defined and properly identified, breaches to IP constitute a threat to the security of this information. Most common IP breaches involve the unlawful use or duplication of software-based intellectual property, known as software piracy.

Software Piracy I.

Emphasize to students that the most common IP breaches involve the unlawful use or duplication of software-based intellectual property, known as software piracy.

II.

Outline that in addition to the laws surrounding software piracy, two watchdog organizations investigate allegations of software abuse: the Software and Information Industry Association (SIIA), formerly the Software Publishers Association, and the Business Software Alliance (BSA).

III.

Quantify the severity of software privacy with the following statistics mentioned in the text:

IV.

•

The BSA estimates that 37 percent of software installed on personal computers globally was not properly licensed in 2018.

•

Some countries indicate unlicensed rates of more than 50 percent.

Recall that malware attacks significantly increase with the use of unlicensed software.

Copyright Protection and User Registration © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

I.

Discuss that enforcement of copyright laws has been attempted through several technical security mechanisms, such as digital watermarks, embedded code, and copyright codes.

II.

Identify that online registrations combat piracy because users must register their software to complete the installation process. Caution students that key generators can be used to override and outsmart online registration tools and still result in intellectual property losses.

Deviations in Quality of Service I. Summarize that concerns in this category represent situations in which a product or service is not delivered to the organization as expected. II. Explain that the organization’s information system depends on the successful operation of many interdependent support systems, including power grids, telecom networks, parts suppliers, service vendors, and even the janitorial staff and garbage haulers.

Internet Service Issues I.

Explain that Internet service, communications, and power irregularities are three sets of service issues that dramatically affect the availability of information and systems. This is regardless of if a person is at the office or connecting through a virtual private network (VPN) connection.

II.

Justify that the U.S. government’s Federal Communications Commission (FCC) maintains a Network Outage Reporting System (NORS), which according to FCC regulation 47 C.F.R. Part 4, requires communications providers to report outages that disrupt communications at certain facilities, like emergency services and airports.

III.

Report that when an Internet service provider fails to meet the terms in a service level agreement (SLA), it is often fined to cover client losses, although the lost business exceeds anything recovered. This is even with vendors promoting high availability of uptime (or low downtime).

IV.

Apply the example of Amazon and how a 30- to 40-minute outage cost them a significant amount of money ($3-4 million) in just that short amount of time.

V.

Identify the most common causes of downtime and the financial impact of those incidents from the data provided in Figure 2-4.

Communication and Other Service Provider Issues I.

Describe communications and other service provider issues: other utility services can impact organizations as well. Among these are telephone, water, wastewater,

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

trash pickup, cable television, natural or propane gas, and custodial services. The loss of these services can impair the ability of an organization to function properly.

Power Irregularities I.

Describe power irregularities: irregularities from power utilities are common and can lead to fluctuations, such as power excesses, power shortages, and power losses. In the United States, we are “fed” 120-volt, 60-cycle power usually through 15-amp and 20-amp circuits.

II.

Explain that voltage levels are subject to a spike (momentary increase), surge (prolonged increase), sag (momentary decrease), brownout (prolonged drop in voltage), fault (momentary complete loss of power) or blackout (a lengthier loss of power).

III.

Emphasize that organizations with dedicated power needs must think of backup solutions such as generators to provide power in the event an outage were to occur. This is especially the case for information technology and security-related systems.

IV.

Predict that because sensitive electronic equipment—especially networking equipment, computers, and computer-based systems—is susceptible to fluctuations, controls should be applied to manage power quality.

Espionage or Trespass I.

Explain that this threat represents a well-known and broad category of electronic and human activities that breach the confidentiality of information.

II.

Establish that when an unauthorized individual gains access to the information an organization is trying to protect, that act is categorized as a deliberate act of espionage or trespass.

III.

Contrast the thoughts that some people assume that information-gathering techniques are illegal when, in fact, they are not. When they are done properly, this is referred to as competitive intelligence. However, if a legal or ethical threshold is crossed, persons doing this are conducting industrial espionage.

IV.

Describe the concept of shoulder surfing. Emphasize that these commonly occur at computer terminals, desks, ATM machines, smartphones, or other places where a person is accessing confidential information.

V.

Justify the notion that users should constantly be aware of the presence of others when they are always accessing sensitive data.

Hackers I.

Present the fact that trespassing often leads to unauthorized, real, or virtual actions that enable information gatherers to enter premises or systems they have not been authorized to enter.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

Discuss that the classic perpetrator of deliberate acts of espionage or trespass is the hacker. In the gritty world of reality, a hacker uses skill, guile, or fraud to attempt to bypass the controls placed around information that is the property of someone else. The hacker frequently spends long hours examining the types and structures of the targeted systems.

III.

Remind students that there are generally two skill levels among hackers. The first is the expert hacker, who develops software scripts and program exploits used by the second category, the novice, or unskilled hacker.

IV.

Explain that the expert hacker is usually a master of several programming languages, networking protocols, and operating systems and exhibits a mastery of the technical environment of the chosen targeted system.

V.

Demonstrate that expert hackers who have become bored with directly attacking systems have turned to writing software. The software they write are automated exploits that allow novice hackers to become script kiddies (or packet monkeys)— hackers of limited skill who use expertly written software to exploit a system, but do not fully understand or appreciate the systems they hack.

VI.

Compare and contrast the difference between professional hackers and penetration (pen) testers. Although they are doing the same thing, which is testing the information and network defenses, professional hackers are doing it illegally, whereas pen testers are conducting them ethically and professionally.

Escalation of Privileges I.

Discuss the term privilege escalation. Explain that a common example of privilege escalation is called jailbreaking or rooting.

II.

Justify that according to the U.S. Copyright Office, the practice of jailbreaking smartphones was considered legal as a special exemption under the Digital Millennium Copyright Act, but jailbreaking a tablet (such as the iPad) was not and often voids any manufacturer warranty.

Hacker Variants I.

Describe that there are other terms for system rule breakers as mentioned in the text: •

Crackers are now commonly associated with an individual who “cracks” or removes software protection that is designed to prevent unauthorized duplication.

•

Phreakers hack the public telephone network to make free calls, disrupt services, and generally wreak havoc. Although more common in the 1970’s, they can still do a number on phone systems.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Password Attacks I.

Emphasize that password attacks fall under the category of espionage and are a serious offense.

II.

Outline the four approaches to password cracking: •

brute force password attack: An attempt to guess a password by attempting every possible combination of characters and numbers in it.

•

dictionary password attack: A variation of the brute force password attack that attempts to narrow the range of possible passwords guessed by using a list of common passwords and possibly including attempts based on the target’s personal information.

•

rainbow table: A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system’s encrypted password file.

•

social engineering: An attempt to gain access by contacting low-level employees and offering to help with their computer issues.

III.

Evaluate the purpose and composition of the 10.4 password rule and how it can provide a method for users to generate a stronger password that is less likely to be hacked.

IV.

Recommend that students review Table 2-6 and see how the odds increase the more characters are in a password, and the time it would take to do so based on a 2020-era computer system.

Social Engineering Password Attacks I.

Stress that by hackers posing as friendly help-desk associates or repair techs, they have an easy inroad into servers and systems even if they resolve a user’s issue.

II.

Critique the scenario where hackers can work inside an organization and even at a help desk using this method to gain systems access where they would otherwise be denied entry. This is true even if their background check comes up clean.

III.

Distinguish the fact that attempts to gain access like this are often subtle and go unnoticed until it is too late.

Forces of Nature I.

Discuss how forces of nature, force majeure, or acts of God pose some of the most dangerous threats, because they are unexpected and can occur with little warning.

II.

Emphasize that pandemics, such as the 2020 COVID-19 outbreak, are considered a force of nature even though most things remained operational.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

III.

Explain that these threats can disrupt not only the lives of individuals but also the storage, transmission, and use of information. Since it is not possible to avoid many of these threats, management must implement controls to limit damage and prepare contingency plans for continued operations.

IV.

Outline the 11 forces of nature that are outlined in the text. They are the following: •

Fires

•

Floods

•

Earthquakes

•

Lightning

•

Landslides or mudslides

•

Tornados or severe windstorms

•

Hurricanes, typhoons, and tropical depressions

•

Tsunamis

•

Electrostatic discharge (ESD)

•

Dust contamination

•

Solar activity

Fire I.

Outline ways a fire can cause damage to computing equipment up to the point of compromising all or part of a system. This includes the fire itself, suppression systems such as sprinklers, or water from firefighting hoses.

II.

Demonstrate that this threat often can be mitigated with fire casualty insurance or business interruption insurance policies.

Floods I.

Detail the net effects a flood can do to a facility and computing equipment. On top of damaging the systems, building access may also be compromised.

II.

Explain that this specific threat often may be mitigated with flood insurance or business interruption insurance. This is especially important if the business is in a potential flood zone as deemed by FEMA.

Earthquakes I.

Present that an earthquake can cause direct damage to information system equipment and/or the facilities that house the equipment.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

Stress that not only physical structures are at risk. Give the example in the text of a large earthquake off the coast of Taiwan that severed underwater communications cables.

III.

Explain that this specific threat can sometimes be mitigated with casualty or business interruption insurance. Often, as mentioned, it is covered under its own policy.

Lightning I.

Illustrate what a lightning strike is. It is an abrupt, discontinuous natural electric discharge in the atmosphere.

II.

Recognize that lightning strikes not only can damage all or part of an information system but also cause building damage, fires, or other damage.

III.

Emphasize proactive measures that can be taken by installing specialized lightning rods placed strategically on and around the organization’s facilities and by installing special circuit protectors in the organization’s electrical service.

IV.

Classify that this type of natural cause can sometimes be mitigated with multipurpose casualty or business interruption insurance.

Landslides, Mudslides, and Avalanches I.

Relate that these are downward slides of masses of earth, rock, or snow and are sometimes sudden or with minimal notice so evacuations can take place.

II.

Direct students to understand the impacts here to buildings that house the systems. Depending on the severity of the incident, they may be destroyed or temporarily buried.

III.

Classify that this type of natural cause can sometimes be mitigated with multipurpose casualty or business interruption insurance.

Tornados and Severe Windstorms I.

Contrast the differences between a tornado and wind shear events.

II.

Denote that a tornado facility housing the information systems can directly damage all or part of the structure, depending on the strength of the funnel cloud and wind speed.

III.

Explain that this brief but impactful type of natural disaster may be mitigated with casualty or business interruption insurance.

Hurricanes, Typhoons, and Tropical Depressions I.

Compare the difference between a typhoon and a hurricane. Note that it is virtually the same thing with the exception of its location in the world.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

Stress that excessive rainfall and high winds from these storms can directly damage all or part of the information system or, more likely, the building that houses it. Organizations in coastal or low-lying areas may suffer flooding as well, which would restrict access to the buildings that house information systems.

III.

Guide students to understand that this brief but impactful type of natural disaster may be mitigated with casualty or business interruption insurance.

Tsunamis I.

Describe the impact of a tsunami and the severity of impact that just one event may cause.

II.

Apply the tsunami that occurred in 2011 as a threat that affected the world directly and indirectly.

III.

Explain how in most cases that this threat can sometimes be mitigated with casualty insurance or business interruption insurance.

Electrostatic Discharge I.

Illustrate what an electrostatic discharge (ESD) is and the impact it can have to flammable mixtures or electronic components.

II.

Stress that as little as 10 volts can cause catastrophic damage to information systems equipment, and humans cannot detect static electricity until it reaches about 1,500 volts. Discharges from walking across dry carpet can exceed 12,000 volts.

III.

Emphasize that the financial repercussions of static discharge could result in millions of dollars of damage and significant loss of production time in information processing. Although ESD can disrupt information systems, it is not usually an insurable loss unless covered by business interruption insurance.

Dust Contamination I.

Relate that dust particle buildups and debris inside systems can dramatically reduce the effectiveness and efficiency of the equipment. This often leads to unexpected shutdowns and overheating.

II.

Stress that this can often shorten the life of information systems and disrupt normal operations.

Solar Activity I.

Recognize that solar flares or extremes in radiation can affect power grids and power lines, blow out transformers, and shut down power stations.

II.

Emphasize that businesses that rely on satellites should have alternate options available should communications from them be disrupted.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Human Error or Failure I.

Describe this category and comment to students that it includes the possibility of acts performed without intent or malicious purpose by an individual who is an employee of an organization.

II.

Discuss the fact that employees constitute one of the greatest threats to information security, as they are the individuals closest to the organizational data. Employee mistakes can easily lead to the following: revelation of classified data, entry of erroneous data, accidental deletion or modification of data, storage of data in unprotected areas, and failure to protect information.

III.

Note that many threats can be prevented with controls, ranging from simple procedures, such as requiring the user to type a critical command twice, to more complex procedures, such as the verification of commands by a second party.

IV.

Explain that this threat represents a well-known and broad category of electronic and human activities that breach the confidentiality of information.

Social Engineering I.

Define within the context of information security that social engineering is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker.

II.

Explain that people are the weakest link. You can have the best technology— firewalls, intrusion-detection systems, biometric devices—and somebody can call an unsuspecting employee and obtain a wealth of information.

Business E-Mail Compromise (BEC) I.

Stress that this is one of the newest forms of social engineering attack methods being deployed on organizations today.

II.

Detail the process of how an attacker gains access to the system either through another social engineering attack or technical exploit and then proceeds to request that employees within the organization, usually administrative assistants to highlevel executives, transfer funds to an outside account or purchase gift cards and send them to someone outside the organization.

III.

Emphasize that in 2019 alone, there were 24,000 BEC complaints and projected losses of more than $1.7 billion dollars.

Advance-Fee Fraud I. Compare and contrast one of most common social engineering attacks, known as the advance-fee fraud (AFF) and phishing.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

Stress that AFF is also known as 4-1-9 fraud due to it being named after a Nigerian Penal Code and not an area code in northern Ohio.

III.

Examine a sample letter, as illustrated in Figure 2-9, which illustrates this scheme in practice.

IV.

Outline to students that this scam is one for stealing funds from credulous people, first by requiring them to participate in a proposed money-making venture by sending money up front, and then by soliciting an endless series of fees. In the most serious cases, kidnapping, extortion, or murder can result.

V.

Quantify that most recently in 2020, up to $100 billion dollars has been swindled using this method.

Phishing I.

Distinguish phishing as an attempt to gain personal or financial information from an individual, usually by posing as a legitimate entity.

II.

Emphasize that a variant is spear phishing, a label that applies to any highly targeted phishing attack. While normal phishing attacks target as many recipients as possible, a spear phisher sends a message that appears to be from an employer, a colleague, or other legitimate correspondent to a small group, or even one specific person.

III.

Discuss that phishing attacks use two primary techniques, often used in combination with one another: URL manipulation and Web site forgery.

Pretexting I.

Point out another form of social engineering is called pretexting, which is sometimes referred to as phone phishing.

II. Emphasize that VOIP phone services have made it easy to spoof caller IDs and hence hide the identity of someone who may be on the other end of the line.

Information Extortion I.

Illustrate how information extortion involves the possibility of an attacker or trusted insider stealing information from a computer system and demanding compensation for its return or for an agreement to not disclose the information. Extortion is common in credit card number theft.

II.

Give examples provided in the textbook of different information extortion incidents and the impacts to their respective businesses. Translate to students that regardless of a company’s size or function, they are susceptible to extortion.

Ransomware

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

I.

Explain that the latest type of attack in this category is known as ransomware, which is a malware attack on the host system that denies access to the user and then offers to provide a key to allow access back to the user’s system and data for a fee.

II.

Compare and contrast the two different types of ransomwares: lockscreen and encryption.

III.

•

Lockscreen ransomware denies access to the system by disabling access to the desktop and preventing the user from bypassing the ransom screen that demands payment for access.

•

Encryption ransomware is more severe, as it requires payment up front to access one’s hard drive after their information has been encrypted.

Illustrate the three examples of ransomware activities highlighted in the text and stress to students that these types of attacks occur daily, and an information security team must be on guard to overcome and nullify these.

Sabotage or Vandalism I.

Summarize that this type of threat involves the deliberate sabotage of a computer system or business or acts of vandalism to either destroy an asset or damage the image of an organization.

II.

Emphasize that these threats can range from petty vandalism by employees to organized sabotage against an organization.

III.

Identify that organizations frequently rely on image to support the generation of revenue, and vandalism to a Web site can erode consumer confidence, thus reducing the organization’s sales and net worth. Compared to Web site defacement, vandalism within a network is more malicious in intent and less public.

Online Activism I.

Explain that security experts are noticing a rise in another form of online vandalism, hacktivist or cyberactivist operations. A more extreme version is referred to as cyberterrorism (which is explained next).

II.

Stress that the concept of doxing is where a hacker would use online resources to find and disseminate compromising information for the purpose of harming or harassing an individual, group, or government entity. Apply Figure 2-14 as an example of this in action.

Cyberterrorism and Cyberwarfare I. Detail the purpose of cyberterrorism and what the United States and other government bodies are doing to combat this.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

23

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II. Differentiate between the three examples provided in the text with respect to supposed cyberterrorism attacks and why it is important to be on guard. III. Relate that some government entities express concern that cyberattacks that are aimed at disrupting their entities are likely to be seen as cyberwarfare. Note that their purpose is to take down critical infrastructure. IV. Apply one of the most recent attacks on critical infrastructure in the United States— the Colonial Pipeline shutdown that wreaked havoc in the eastern part of the country—as an example of a cyberterrorism threat in the eyes of the federal government.

Positive Online Activism I. Compare cyberterrorism to more positive online activism, such as using Facebook, Twitter, and so on to perform fundraising and raise awareness of social issues. II. Stress that positive online activism is a legal right to enact provided it does not cross the moral threshold of doing illegal activities. Quick Quiz 1 1. True or False: The three communities of interest are general management, operations management, and information security management. Answer: False 2. Hackers of limited skill who use expertly written software to attack a system are known as which of the following? a. cyberterrorists b. script kiddies c. jailbreakers d. social engineers Answer: b 3. Which of the following occurs when an attacker or trusted insider steals information from a computer system and demands compensation for its return or for an agreement not to disclose it? a. information extortion b. technological extortion c. insider trading d. information hoarding Answer: a

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

24

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

4. Which type of attacker will hack systems to conduct terrorist activities via network or Internet pathways? a. cyberattackers b. electronic terrorists c. cyberterrorists d. electronic hackers Answer: c 5. True or False: Cyberterrorism has thus far been largely limited to acts such as the defacement of NATO Web pages during the war in Kosovo. Answer: True 6. True or False: When looking at forces of nature that could cause destruction or damage to information systems, electrostatic discharge (ESD) is not considered to be one of them. Answer: False

Software Attacks I.

Emphasize that an attack is a deliberate act that exploits a vulnerability to compromise a controlled system. This attack can consist of specially crafted software that attackers trick users into installing on their systems.

II.

State that the most common form of software attacks is malware, viruses, worms, back doors, denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, e-mail communication, and communication interception attacks.

Malware I.

Describe malware as malicious code or malicious software. Point out that other attacks that use software, such as redirect attacks and denial-of-service attacks, also fall under this threat. Note that the malicious code attack includes the execution of viruses, worms, Trojan horses, and active Web scripts with the intent to destroy or steal information.

II.

Explain that the polymorphic, or multivector, worm is a state-of-the-art attack system. Point out that these attack programs use up to six known attack vectors to exploit a variety of vulnerabilities in commonly found information system devices.

III.

Emphasize to students that when an attack makes use of malware that is not yet known by the antimalware software companies, it is said to be a zero-day attack.

IV.

Summarize other forms of malware, including covert software applications—bots, spyware, and adware—that are designed to work out of sight of users, or via an

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

25

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

apparently innocuous user action. Use Table 2-7 to review some of the most dangerous malware attacks to date.

Viruses I.

State that a computer virus consists of code segments that perform malicious actions. Point out to students that one of the most common methods of virus transmission is via e-mail attachments.

II.

Mention that viruses can be classified by how they spread themselves. Discuss the most common types of information system viruses, which are the macro virus and the boot virus.

III.

Explain the classification known as memory-resident and non-memory-resident viruses. Note that resident viruses are capable of reactivating when the computer is booted and continuing their actions until the system is shut down.

IV.

Differentiate between different types of attack replication vectors illustrated in Table 2-8 within the text and stress that regardless of which one is used, the impact can still be crippling to an organization.

Worms I.

Explain that worms are viruses that replicate themselves like bunnies until all available resources have been exhausted.

II.

Relate to the speed that worms can spread by applying the examples of the Nimda outbreak in 2001 and the Klez worm that infiltrated computers much in the same way.

III.

Examine the consequences of a perpetrator creating and distributing a virus. Use the example of Jeffrey Lee Parson, an 18-year-old high school student who committed such an act.

IV.

Compare and contrast the definitions of a worm with a Trojan horse. Note that a Trojan horse on the surface looks legitimate, but once opened, it instills a virus onto the devices it infects. Recommend students review Figure 2-15 for an illustration of this in practice.

V.

Illustrate that a more modern version of a Trojan horse attack is known as a SMiShing, in which the victim is tricked into downloading malware onto a mobile phone via a text message. SMiShing is an abbreviation for SMS phishing.

VI.

Evaluate the ever-changing nature of a polymorphic threat and how it changes its size and other characteristics to stay one step ahead of antivirus software programs.

VII.

Consequentially, point out that malware hoaxes, or messages sent that warn of dangerous viruses when no credible threat exists, result in significant resources and

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

26

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

time wasted. Point out the author’s comment that there are Web sites that can be checked to determine the validity and credibility of a supposed threat.

Back Doors I.

Discuss how by using a known or previously unknown and newly discovered access mechanism, an attacker can gain access to a system or network resource through a back door. Point out that these doors are often referred to as maintenance hooks.

II.

Stress that a back door, or trap door, access process is difficult to detect because the person or program that places it often makes the access exempt from the system’s usual audit logging features and makes every attempt to keep the back door hidden from the system’s legitimate owners.

Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks I.

Explain that a denial-of-service attack begins when an attacker sends many connections or information requests to a target. So many requests are made that the target system cannot handle them successfully along with other legitimate requests for service. This may result in the system crashing or simply becoming unable to perform ordinary functions.

II.

Define a distributed denial-of-service attack as one in which a coordinated stream of requests is launched against a target from many locations at the same time.

III.

Relate how compromised machines are turned into bots or zombies that can be directed remotely by the attacker to participate in the attack. Apply Figure 2-16 as part of providing this point to students.

IV.

Emphasize that in most cases, the attacks are short-lived, but their impacts are significant and can last well beyond the time it took to initiate the act.

E-Mail Attacks I.

Recall that spam is unsolicited commercial e-mail. While many consider spam a nuisance rather than an attack, it is emerging as a vector for some attacks.

II.

Explain that mail bombing is another form of e-mail attack that is also a denial of service (DoS), in which an attacker routes large quantities of e-mail to the target.

III.

Comment that phishing attacks may occur via e-mail, but they are aligned with social engineering designed to trick users to perform an action then making them a target of a larger DoS e-mail attack.

Communications Interception Attacks I.

Explain that common software-based communications attacks include several subcategories designed to intercept and collect information in transit. Point out to

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

27

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

students that the emergence of the Internet of Things (IoT) increases the possibility of these types of attacks. II.

Describe that a packet sniffer is a software program or hardware appliance that can intercept, copy, and interpret network traffic. Stress that these can be extremely dangerous because of them being virtually impossible to detect.

III.

Establish that Internet protocol spoofing (or IP spoofing) is another way that hackers take trusted IP addresses and modify their packet headers and insert fake addresses. Apply the sequence shown in Figure 2-17 to demonstrate how the process occurs. Emphasize, however, that most modern routers can offer some level of protection from this.

IV.

Describe the term pharming and that it is “the redirection of legitimate Web traffic to an illegitimate site for the purpose of obtaining private information.” Note that pharming may also exploit the Domain Name System (DNS) by causing it to transform the legitimate host name into the invalid site’s IP address. This form of pharming is also known as DNS cache poisoning.

V.

Outline that an attacker sniffs packets from the network, modifies them, and inserts them back into the network. Point out that in a TCP hijacking attack, the attacker uses address spoofing to impersonate other legitimate entities on the network. Mention that this is also known as session hijacking or a man-in-the-middle scenario.

Technical Hardware Failures or Errors I.

Emphasize that technical hardware failures or errors occur when a manufacturer distributes a user’s equipment containing a known or unknown flaw. These defects can cause the system to perform outside of expected parameters, resulting in unreliable or unavailable service.

II.

Discuss that some errors are terminal in that they result in the unrecoverable loss of the equipment. Some errors are intermittent in that they only periodically manifest themselves, resulting in faults that are not easily repeated.

III.

Stress that applying Murphy’s Law, it is more of a matter of when and not if computing equipment will break down.

The Intel Pentium CPU Failure I.

Illustrate that one of the best-known hardware failures was the Intel Pentium II chip.

II.

Since a simple quotient problem caused systems to crash, the Pentium floatingpoint division bug (FDIV) led to a public-relations disaster for Intel that resulted in its first-ever chip recall and a loss of more than $475 million. A few months later,

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

28

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

disclosure of another bug, known as the Dan-0411 flag erratum, further eroded the chip manufacturer’s public image.

Mean Time Between Failures I.

II.

Compare and contrast the differences between mean time between failure (MTBF) and mean time to failure (MTTF). •

Explain that in hardware terms, failures are measured in mean time between failure (MTBF) and mean time to failure (MTTF). Point out that MTBF and MTTF are sometimes used interchangeably.

•

Also note that additionally, the mean time to diagnose (MTTD) is the average amount of time a technician needs to determine the cause of a failure, and the mean time to repair (MTTR) is the average time it will take to rectify the issue.

Calculate the MTBF by adding up the sum of MTTF, MTTD, and MTTR.

Technical Software Failures or Errors I.

Explain that this category involves threats that come from purchasing software with unknown, hidden faults. Large quantities of computer code are written, debugged, published, and sold before all their bugs are detected and resolved.

II.

Discuss how combinations of certain software and hardware can reveal new bugs. Sometimes these items are not errors, but rather are purposeful shortcuts left by programmers for benign or malign reasons.

The OWASP Top 10 I.

List the top 10 Web application security risks, as outlined by the Open Web Application Security Project (OWASP): •

Injection

•

Broken authentication

•

Sensitive data exposure

•

XML external entities (XXE)

•

Broken access control

•

Security misconfiguration

•

Cross-site scripting (XSS)

•

Insecure deserialization

•

Insufficient logging & monitoring

•

Insecure direct object references

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

29

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

II.

Emphasize that these have rarely changed since 2010, but the threat is just as big— if not bigger comparatively speaking in terms of time.

The Deadly Sins in Software Security I.

Explain that some software development problems result in software that is difficult or impossible to deploy in a secure fashion. There are at least two dozen problem areas or categories in software development (which is also called software engineering) that are recommended to be summarized to students.

II.

Describe SQL injection as it occurs when developers fail to properly validate user input before using it to query a relational database. The possible effects of the ability to “inject” SQL of the attacker’s choosing into the program are not just limited to improper access to information but could potentially allow an attacker to drop tables or even shut down the database.

III.

Mention to students that the same cross-site scripting attacks that can infect a client system can also be used to attack Web servers. Cross-site request forgery (XSRF or CSRF) attacks and scripting cause users to attack servers they access legitimately.

IV.

Discuss Web client-related vulnerability (XSS). Client-side cross-site scripting errors can cause problems that allow an attacker to send malicious code to the user’s computer by inserting the script into a normal Web site.

V.

Describe the use of magic URLs and hidden forms.

VI.

•

Because HTTP is a stateless protocol and computer programs on either end of the communication channel cannot rely on guaranteed delivery of any message, it is difficult for software developers to track a user’s exchanges with a Web site over multiple interactions.

•

Too often, sensitive state information is simply included in a “magic” URL (e.g., the authentication ID is passed as a parameter in the URL for the exchanges that will follow) or included in hidden form fields on the HTML page.

•

If this information is stored as plain text, an attacker can harvest the information from a magic URL as it travels across the network or use scripts on the client to modify information in hidden form fields.

Detail what buffer overruns are and how they occur. This is a situation in which buffers are used when there is a mismatch in the processing rates between two entities involved in a communication process. A buffer overrun (or buffer overflow) is an application error that occurs when more data is sent to a program buffer than it is designed to handle. During a buffer overrun, an attacker can make the target system execute instructions, or the attacker can take advantage of some other unintended consequence of the failure.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

30

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

VII.

Illustrate format string problems and the reason that they occur. Computer languages are often equipped with built-in capabilities to reformat data while they are outputting it. The formatting instructions are usually written as a “format string.” An attacker may embed characters meaningful as formatting directives into malicious input. If this input is then interpreted by the program as formatting directives, the attacker may be able to access information or overwrite very targeted portions of the program’s stack with data of the attacker’s choosing.

VIII.

Discuss integer bugs (overflows/underflows). Although paper and pencil can deal with arbitrary numbers of digits, the binary representations used by computers are of a particular fixed length. “Integer bugs fall into four broad classes: overflows, underflows, truncations, and signedness errors. Integer bugs are usually exploited indirectly—that is, triggering an integer bug enables an attacker to corrupt other areas of memory, gaining control of an application.”

IX.

Summarize the occurrence of C++ catastrophes. Note that this programming language has been around for nearly 40 years, and due to its age, security concerns have arisen. Since operating systems have API that use these pointers to control execution code, they are susceptible to diverting program flows and open the door for a hacker to take them over.

X.

Explain that effective software can catch and resolve exceptions, which are unusual situations that require special processing.

XI.

Define command injection and explain that command injection problems occur when user input is passed directly to a compiler or interpreter. The underlying issue is the developer’s failure to ensure that command input is validated before it is used in the program.

XII.

Comprehend that failure to handle errors can cause a variety of unexpected system behaviors. Programmers are expected to anticipate problems and prepare their application code to handle them.

XIII.

Analyze that information leakage is one of the most common methods of obtaining inside and classified information that is directly or indirectly from an individual, usually an employee. By warning employees against disclosing information, organizations can protect the secrecy of their operation.

XIV.

Justify that a race condition is the failure of a program that occurs when an unexpected ordering of events in the execution of the program results in a conflict over access to the same system resource.

XV.

Stress that employees prefer to do things “the easy way” when the official way is too difficult or cumbersome to complete. They must be reminded that there is only one way to do things—the secure way! If users choose the easier way, they are likely to experience loss of some kind very quickly.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

31

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

XVI.

Relate that the complexity of updating applications and/or systems increases over time, and without catching the errors, they become harder to find. As a result, hackers can sneak in through those vulnerabilities and, as a result, create an urgent security risk.

XVII.

Recall that when computers have more privileges than they need, this sets up numerous critical security issues. One of the greatest concerns in this area occurs when individuals download and run code from public sources, like Web sites.

XVIII.

Distinguish the fact that mobile code is an application, applet, macro, or script that may be imbedded in another application or document and thus downloaded and executed without the user even knowing, and especially without consenting. This potentially results in a security risk from occurring as well.

XIX.

Apply the process of cryptography and how weak passwords are an open door for hackers and viruses to work their way into systems. As one of many safeguards to protect access, administrators should limit the number of attempts an incorrect password is entered.

XX.

Discuss the failure to use cryptographically strong random numbers. Many computer systems use random number generators. These “random” number generators use a mathematical algorithm, based on a seed value and another system component (such as the computer clock), to simulate a random number. Those who understand the workings of such a “random” number generator can predict values at particular times.

XXI.

Emphasize that cryptography is a powerful tool to protect information, especially information that may travel outside the organization’s protective networks and systems. Using untested or undertested cryptographic algorithms and programs can cause issues. Using weak crypto keys or reusing the same crypto keys can cause issues, as can sending crypto keys through the same medium as the encrypted messages.

XXII.

Describe the failure to protect network traffic and explain that with the growing popularity of wireless networking comes a corresponding increase in the risk that wirelessly transmitted data will be intercepted. Most wireless networks are installed and operated with little or no protection for the information that is broadcast between the client and the network wireless access point. Without appropriate encryption (such as that afforded by WPA), attackers can intercept and view your data. Traffic on a wired network is also vulnerable to interception in some situations.

XXIII.

Discuss the improper use of SSL. Programmers use Secure Sockets Layer (SSL) to transfer sensitive data such as credit card numbers and other personal information between a client and server. SSL and its successor, Transport Layer Security (TLS),

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

32

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

both need certificate validation to be utterly secure. Failure to use secure HTTP, to validate the certificate authority and then validate the certificate itself, or to validate the information against a certificate revocation list (CRL), can compromise the security of SSL traffic. XXIV.

Explain that the DNS is a core function of the Internet and World Wide Web and that it is subject to cache poisoning. In other words, when the DNS is compromised, the valid IP address associated with a domain name change into one the attacker chooses, usually a fake Web site designed to obtain personal information or one that accrues a benefit to the attacker—for example, redirecting shoppers from a competitor’s site. This may include additional attacks to other primary and secondary DNS servers linked to a specific domain.

XXV.

Stress the issue of neglecting change control. Developers use a process known as change control to ensure that the working system delivered to users represents the intent of the developers. Change control processes ensure that developers do not work at cross purposes by altering the same programs or parts of programs at the same time. They also ensure that only authorized changes are introduced and that all changes are adequately tested before being released.

Technological Obsolescence I.

Discuss how antiquated or outdated infrastructure leads to unreliable and untrustworthy systems. Management must recognize that when technology becomes outdated, there is a risk of loss of data integrity from attacks.

II.

Explain that proper planning by management should prevent technology from becoming obsolete. However, when obsolescence is identified, management must take immediate action.

III.

Illustrate examples of obsolete technologies as provided in Figure 2-20 within the text. If available, provide additional examples of items virtually or in person.

Theft I.

Define theft as the illegal taking of another’s property. Within an organization, that property can be physical, electronic, or intellectual.

II.

Summarize how physical theft can be controlled quite easily. Many measures can be taken, including locking doors, training security personnel, and installing alarm systems.

III.

Contrast electronic theft, however, as a more complex problem to manage and control. Organizations may not even know it has occurred.

Quick Quiz 2

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

33

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

1. Using a known or previously installed access mechanism is known as which of the following? a. hidden bomb b. vector c. spoof d. back door Answer: d 2. True or False: When a program tries to reverse-calculate passwords, this is known as a brute force spoof. Answer: False 3. True or False: Warnings of attacks that are not valid are usually called hoaxes. Answer: False 4. What is another name for a man-in-the-middle attack? a. TCP hijacking b. mail bombing c. spoofing d. denial of service Answer: a 5. Which of the following is an application error that occurs when more data is sent to a program buffer than it is designed to handle? a. buffer underrun b. buffer overrun c. heap overflow d. heap attack Answer: b 6. True or False: A SQL injection occurs when developers fail to properly validate user input before using it to query a relational database. Answer: True 7. True or False: The Domain Name System (DNS) is a function of the World Wide Web that converts a URL (Uniform Resource Locator) such as www.course.com into the IP address of the Web server host.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

34

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Answer: True [return to top]

Discussion Questions You can assign these questions several ways: in a discussion forum in your LMS, as wholeclass discussions in person, or as a partner or group activity in class. These questions are separate from the review questions and exercises in the textbook. For answers to the textbook questions, see the associated solutions for this module. Additional class discussion options: 1. Discuss the differences between a threat and an attack. How are they similar and how are they different with respect to the need for information security at an organization? (2.1, 2.3, PPT Slides 3, 10, 73–76) Duration 15 minutes. 2. Detail the reasons why everyone in an organization should be responsible for information security and not just persons in information technology or security. What are the consequences to users and the firm with a tunnel vision-based approach? (2.2, 2.4, PPT Slides 8–10, 68–70, and 72) Duration 15 minutes. 3. Is there an ethically acceptable reason to study and use the various attack methods described in this chapter? Why or why not? (2.3, 2.4, PPT Slides 3–10 and 33–35) Duration 15 minutes. [return to top]

Suggested Usage for Lab Activities A series of hands-on labs has been developed to complement the text material for this course and are available for download at the Instructor Center. The labs do not depend on specific chapter content, so instructors can insert them where they best suit the syllabus. The following is a list of lab titles, objectives, and approximate durations to assist with lesson planning. Lab Title Ethical Considerations in IT and Detecting Phishing Attacks

Objective Upon completion of this activity, you will: • have a better understanding of the ethical expectations of IT professionals; and • be able to identify several types of social engineering attacks that use phishing techniques.

Duration Ethical Considerations lab in 15 to 20 minutes. Phishing E-Mail lab in 60 to 75 minutes.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

35

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Web Browser Security

Malware Defense

Windows Password Management

Backup and Recovery and File Integrity Monitoring

OS Processes and Services

Log Management & Security

Upon completion of this activity, the student will be able to: • Review and configure the security and privacy settings in the most popular web browsers. Upon completion of this activity, the student will be able to: • Understand the basic setup and use of an open-source AV product. • Install and use Clam AV on a Windows system. • Using a USB storage device create a portable AV scanner. • Understand what a YARA file is and how it is used. Upon completion of this activity, the student will be able to: • Review and configure password management policies in a Windows client computer. Upon completion of this activity, you will be able to: • Describe backup and recovery processes and will be aware of basic backup activities using Windows 10 or another desktop operating system (OS). • Perform file integrity monitoring using file hash values. Upon completion of this activity, the student will be able to: • Review available and enabled OS services. • Review available and enabled OS processes. • Review current system resource utilization. Upon completion of this activity, the student will be able to: • Access and review the various

1 to 1.5 hours

1 to 1.5 hours

30 minutes to 1 hour

15–20 minutes

60–90 minutes

30 minutes to 1 hour

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

36

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Footprinting, Scanning, and Enumeration

AlienVault OSSIM

Image Analysis Using Autopsy

logs present in a Windows 10 computer. Upon completion of this activity, the student will be able to: • Identify network addresses associated with an organization. • Identify the systems associated with the network addresses. Upon completion of this activity, the student will be much more knowledgeable about the AlienVault OSSIM software and how to install, configure, and operate it. You will use the software more extensively in a subsequent lab. Upon completion of this activity, the student will be able to perform basic drive image analysis using the Autopsy software package.

40–60 minutes

2–3 hours

45–70 minutes

[return to top]

Additional Activities and Assignments Please see associated solutions for the Closing Scenario at the end of the textbook module. Additional project options include: 1. Using the Internet, browse www.cert.org and find the most recent CERT advisory. Have students report on any recent vulnerabilities posted on the site. 2. Using the Internet, find and read the SANS/FBI Top 20 Vulnerabilities. Assign each student 1 or 2 of the 20 vulnerabilities listed and have them identify the threat group and threat category it warns about. [return to top]

Additional Resources Cengage Video Resources •

MindTap Video: Information Security Terminology

Internet Resources •

Build Security In: Making the Case for Software Assurance

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

37

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

• • • • •

Build Security In: Secure Software Development Lifecycle Cross-Site Scripting FAQ Governing for Enterprise Security Implementation Guide Hackers Breached Colonial Pipeline Using Compromised Password Verizon Data Break Investigation Report (2016)

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

38

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 2: The Need for Information Security

Appendix Grading Rubrics Providing students with rubrics helps them understand expectations and components of assignments. Rubrics help students become more aware of their learning process and progress, and they improve students’ work through timely and detailed feedback. Customize these rubrics as you wish. The grading rubric suggests a 4-point scale, and the discussion rubric indicates 30 points. Grading Rubric These grading criteria can be applied to open-ended Review Questions, Real-World Exercises, Case Studies, and Security for Life activities 3 2 1 0 Exceeds Expectations Meets Expectations Needs Improvement Inadequate • Student • Student • Student’s • Student’s response demonstrates demonstrates response is missing or accurate accurate demonstrates a incomplete. understanding of understanding of gap in • Student’s response the concept. the concept. understanding of demonstrates a • Student applies the • Student applies the concept. critical gap in concept the concept • Student applies understanding. appropriately. appropriately. the concept • Student is unable • Student uses • Student develops incorrectly. to apply the sound critical a complete • Student’s concept. analysis to develop response to the response is poorly an insightful and prompt. developed or comprehensive incomplete. response to the prompt. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

39

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Instructor Manual Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 3 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 7 Module Outline .............................................................................................................................. 7 Discussion Questions .................................................................................................................. 35 Suggested Usage for Lab Activities ............................................................................................ 35 Additional Activities and Assignments ....................................................................................... 37 Additional Resources................................................................................................................... 37 Cengage Video Resources ....................................................................................................................... 37 Internet Resources .................................................................................................................................. 37 Appendix ...................................................................................................................................... 39 Grading Rubrics ....................................................................................................................................... 39

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Purpose and Perspective of the Module Maintaining the security of information is paramount to any organization thriving and surviving in the digital age. In this module, students will gain an understanding of the different management functions that are required to maintain information security. One topic that is important to note that is part of this is information security governance. Think of this as the guiderails for maintaining and protecting information in an organization. The role management has in this is critical for policies, procedures, standards, and practices, not to mention guidelines. Students will also gain knowledge on different elements that should be in security education and training and the composition of a blueprint. This module is a foundational piece to comprehend the more complex topics later in the text.

Cengage Supplements The following product-level supplements provide additional information that may help you in preparing your course. They are available in the Instructor Resource Center. • • • • •

PowerPoint slides Test banks, available in Word, as LMS-ready files, and on the Cognero platform MindTap Educator Guide Solution and Answer Guide This instructor’s manual

Module Objectives The following objectives are addressed in this module: 3.1

Describe the different management functions with respect to information security.

3.2

Define information security governance and list the expectations of the organization’s senior management with respect to it.

3.3

Describe management’s role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines.

3.4

List the elements in an effective security education, training, and awareness program and describe a methodology for effectively implementing security policy in the organization.

3.5

Explain what an information security blueprint is, identify its major components, and explain how it supports the information security program.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Complete List of Module Activities and Assessments For additional guidance, refer to the MindTap Educator Guide. Module Objective 3.1, 3.2, and 3.3 3.4 and 3.5 3.4 and 3.5 3.1–3.5

PPT slide

Activity/Assessment

Duration

16–17

Knowledge Check Activity 1

2 minutes

37–38 53–55 62–63 MindTap MindTap MindTap

Knowledge Check Activity 2 Knowledge Check Activity 3 Self-Assessment Module 03 Review Questions Module 03 Case Exercises Module 03 Exercises

MindTap MindTap

Module 03 Security for Life Module 03 Quiz

2 minutes 2 minutes 5 minutes 30–40 minutes 30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: strategic planning: The process of defining and specifying the long-term direction (strategy) to be taken by an organization, and the allocation and acquisition of resources needed to pursue this effort. goals: A term sometimes used synonymously with objectives; the desired end of a planning cycle. strategic plan: The documented product of strategic planning; a plan for the organization’s intended strategic efforts over the next several years. objectives: A term sometimes used synonymously with goals; the intermediate states obtained to achieve progress toward a goal or goals. governance, risk management, and compliance (GRC): An approach to information security strategic guidance from a board of directors’ or senior management perspective that seeks to integrate the three components of information security governance, risk management, and regulatory compliance. governance: The set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

achieved, ascertaining that risks are managed appropriately, and verifying that the enterprise’s resources are used responsibly. corporate governance: Executive management’s responsibility to provide strategic direction, ensure the accomplishment of objectives, oversee that risks are appropriately managed, and validate responsible resource use. information security governance: The application of the principles and practices of corporate governance to the information security function, emphasizing the responsibility of the board of directors and/or senior management for the oversight of information security in the organization. tactical plan: The documented product of tactical planning; a plan for the organization’s intended tactical efforts over the next few years. operational plan: The documented product of operational planning; a plan for the organization’s intended operational efforts on a day-to-day basis for the next several months. tactical planning: The actions taken by management to specify the intermediate goals and objectives of the organization in order to obtain specified strategic goals, followed by estimates and schedules for the allocation of resources necessary to achieve those goals and objectives. operational planning: The actions taken by management to specify the short-term goals and objectives of the organization in order to obtain specified tactical goals, followed by estimates and schedules for the allocation of resources necessary to achieve those goals and objectives. policy: Instructions that dictate certain behavior within an organization. standard: A detailed statement of what must be done to comply with policy, sometimes viewed as the rules governing policy compliance. de facto standard: A standard that has been widely adopted or accepted by a public group rather than a formal standards organization. de jure standard: A standard that has been formally evaluated, approved, and ratified by a formal standards organization. guidelines: Nonmandatory recommendations the employee may use as a reference in complying with a policy. procedures: Step-by-step instructions designed to assist employees in following policies, standards, and guidelines. practices: Examples of actions that illustrate compliance with policies.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

information security policy: Written instructions provided by management that inform employees and others in the workplace about proper behavior regarding the use of information and information assets. enterprise information security policy (EISP): The high-level information security policy that sets the strategic direction, scope, and tone for all of an organization’s security efforts; also known as a security program policy, general security policy, IT security policy, highlevel InfoSec policy, or simply an InfoSec policy. issue-specific security policy (ISSP): An organizational policy that provides detailed, targeted guidance to instruct all members of the organization in the use of a resource, such as one of its processes or technologies. systems-specific security policies (SysSPs): Organizational policies that often function as standards or procedures to be used when configuring or maintaining systems. SysSPs can be separated into two general groups—managerial guidance and technical specifications— but may be written as a single unified SysSP document. managerial guidance SysSP: A policy that expresses management’s intent for the acquisition, implementation, configuration, and management of a particular technology, written from a business perspective. technical specifications SysSP: A policy that expresses technical details for the acquisition, implementation, configuration, and management of a particular technology, written from a technical perspective; usually includes details on configuration rules, systems policies, and access control. access control list (ACL): Specifications of authorization that govern the rights and privileges of users to a particular information asset; includes user access lists, matrices, and capabilities tables. capabilities table: A lattice-based access control with rows of attributes associated with a particular subject (such as a user). access control matrix: An integration of access control lists (focusing on assets) and capability tables (focusing on users) that results in a matrix with organizational assets listed in the column headings and users listed in the row headings; contains ACLs in columns for a particular device or asset and capability tables in rows for a particular user. configuration rules: The instructions a system administrator codes into a server, networking device, or security device to specify how it operates. policy administrator: An employee responsible for the creation, revision, distribution, and storage of a policy in an organization. sunset clause: A component of policy or law that defines an expected end date for its applicability.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

security, education, training, and awareness (SETA): A managerial program designed to improve the security of information assets by providing targeted knowledge, skills, and guidance for an organization’s employees. information security blueprint: In information security, a framework or security model customized to an organization, including implementation details. information security framework: In information security, a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education and training programs, and technological controls. Information security model: A well-recognized information security framework, usually promoted by a government agency, standards organization, or industry group. managerial controls: Information security safeguards that focus on administrative planning, organizing, leading, and controlling, and that are designed by strategic planners and implemented by the organization’s security administration; they include governance and risk management. operational controls: Information security safeguards focusing on lower-level planning that deals with the functionality of the organization’s security; they include disaster recovery planning, incident response planning, and SETA programs. technical controls: Information security safeguards that focus on the application of modern technologies, systems, and processes to protect information assets; they include firewalls, virtual private networks, and IDPSs. defense in depth: A strategy for the protection of information assets that uses multiple layers and different types of controls to provide optimal protection; typically, implementation of many different types of controls. redundancy: The use of multiple types and instances of technology that prevent the failure of one system from compromising the security of information; typically, multiple instances of the same type of control. security perimeter: The boundary in the network within which an organization attempts to maintain security controls for securing information from threats from untrusted network areas. security domain: An area of trust within which information assets share the same level of protection; communication between these trust areas requires evaluation of communications traffic. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

What's New in This Module The following elements are improvements in this module from the previous edition: •

This module was mostly drawn from Chapter 4 in the 6th edition.

•

The internal organization of the module was restructured to an updated approach, expanding from planning to a more complete presentation on security management.

•

The content on contingency planning was moved to Module 5.

•

The entire module was refreshed with a general update and given more current examples.

[return to top]

Module Outline Introduction to the Management of Information Security (3.1, PPT Slides 3–5) I.

Stress that an information security program begins with policies, standards, and practices that are the foundation for the program and its blueprint. This will require coordinated planning, and it should be done regardless of an organization’s size.

II.

Denote that the information security (InfoSec) team’s goals are different than information technology’s goals. Hence, the primary focus of the IT group is to ensure the effective and efficient processing of information, whereas the primary focus of the InfoSec group is to ensure the confidentiality, integrity, and availability of information.

III.

Propose to students that even though security slows down information, the validation, verification, and assessment against attacks is worth the sacrifice so that an organization can run properly.

IV.

List out “the six Ps” of information security management: planning, policies, programs, protection, people, and project management. These are discussed further in the subsections below.

Planning I.

Outline that within the planning stage of the InfoSec model are activities that are necessary to support the design, creation, and implementation of strategies within the planning environments of an organization. Emphasize that this does include the information technology (IT) department.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

II.

Report that information that is received from other departments is essential for information needed so that the chief information security officer (CISO) and chief information officer (CIO) can develop strategies from the top down in the firm.

III.

Classify that the net result of these initiatives are to protect the organization for unexpected incidents and be able to respond to them in a timely and efficient manner.

Policy I.

Review the three categories of policy that are presented here. Note that these are covered in more depth later in the module: •

Enterprise information security policy (EISP): Developed within the context of the strategic IT plan, this sets the tone for the InfoSec department and the InfoSec climate across the organization. The CISO typically drafts the program policy, which is usually supported and signed by the CIO or the CEO.

•

Issue-specific security policies (ISSPs): These are sets of rules that define acceptable behavior within a specific organizational resource, such as e-mail or Internet usage.

•

Systems-specific policies (SysSPs): A merger of technical and managerial intent, SysSPs include both the managerial guidance for the implementation of a technology as well as the technical specifications for its configuration.

Programs I.

Relate that InfoSec operations that are specifically managed are often known as programs (or entities). Apply the example of security education, training, and awareness (SETA) programs or a risk management program.

II.

Give additional examples of different programs that may be part of InfoSec operations.

Protection I.

Summarize that the protection function is done through a set of risk management activities in addition to protection mechanisms, technologies, and tools. Note that these are critical pieces of an overall InfoSec plan.

People I.

Emphasize that people are the most critical link of the InfoSec program. State that people may include security personnel (professional information security employees), the security of personnel in an organization, and items mentioned in the SETA.

Projects © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

I.

Recognize that whatever will be implemented in the InfoSec space, it must be managed as a project.

II.

Identify that project management involves the application of a project management discipline to all elements of the InfoSec program. Project management involves identifying and controlling the resources applied to the project, as well as measuring progress and adjusting the process as progress is made toward the goal.

III.

Provide examples of projects that an information security manager may want to execute to maintain information assets in the organization.

Information Security Planning and Governance (3.2, PPT Slides 6–11) I.

Explain that long-term strategic planning is critical to the information security program and that the planning effort should have specific clearly defined goals for the organization.

II.

Discuss the organization of the planning process from the broad goals and vision of the organization down to the division and subsequent levels of the organization.

III.

Remind students that the translation of goals at one level into actionable items at the next level depends on the skill of the executive in charge of that level and is more art than science.

IV.

Analyze and present to students that the executives are often the decision makers and may be referred to as the C-level or C-suite.

Information Security Leadership I.

Recognize that the information security function that delivers strategic planning and corporate responsibility is best done applying the approach of governance, risk management, and compliance (GRC).

II.

Comment that risk is not just strictly a responsibility of the InfoSec team but rather the whole organization.

III.

Classify that InfoSec objectives must be addressed at the highest levels of an organization’s management team. This must be done so the effectiveness and sustainability of any approach is achieved.

IV.

Compare and contrast the differences between corporate and information security governance.

V.

Outline the core set of activities provided by the Corporate Governance Task Force (CGTF) needed to develop and implement an InfoSec governance program: •

Conduct an annual InfoSec evaluation, the results of which the CEO should review with staff and then report to the board of directors.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

VI.

VII.

•

Conduct periodic risk assessments of information assets as part of a risk management program.

•

Implement policies and procedures based on risk assessments to secure information assets.

•

Establish a security management structure to assign explicit individual roles, responsibilities, authority, and accountability.

•

Develop plans and initiate actions to provide adequate InfoSec for networks, facilities, systems, and information.

•

Treat InfoSec as an integral part of the system life cycle.

•

Provide InfoSec awareness, training, and education to personnel.

•

Conduct periodic testing and evaluation of the effectiveness of InfoSec policies and procedures.

•

Create and execute a plan for remedial action to address any InfoSec inefficiencies.

•

Develop and implement incident response procedures.

•

Establish plans, procedures, and tests to provide continuity of operations.

•

Use security best practices guidance, such as the ISO 27000 series, to measure InfoSec performance.

Distinguish that ISO 27014:2013 is the ISO 27000 series standard of Governance of Information Security and list the six high-level “action-oriented” principles that make up this standard: •

Establish organization-wide information security.

•

Adopt a risk-based approach.

•

Set the direction of investment decisions.

•

Ensure conformance with internal and external requirements.

•

Foster a security-positive environment.

•

Review performance in relation to business outcomes.

Outline the five governance processes that should be adopted by the organization’s executive management and governing board that are also part of the ISO 27014:2013 standard: •

Evaluate: Review the status of current and projected progress toward organizational information security objectives and decide whether modifications of the program or its strategy are needed to keep on track with strategic goals.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

•

Direct: The board of directors provides instruction for developing or implementing changes to the security program. This could include modification of available resources, structure of priorities of effort, adoption of policy, recommendations for the risk management program, or alteration to the organization’s risk tolerance.

•

Monitor: The review and assessment of organizational information security performance toward goals and objectives by the governing body. Monitoring is enabled by ongoing performance measurement.

•

Communicate: The interaction between the governing body and external stakeholders, where information on organizational efforts and recommendations for change are exchanged.

•

Assure: The assessment of organizational efforts by external entities like certification or accreditation groups, regulatory agencies, auditors, and other oversight entities, to validate organizational security governance, security programs, and strategies.

Apply Figure 3-1 as an additional visual to assist with the comprehension of this standard for students. VIII.

IX.

Review the Information Technology Governance Institute’s view on information governance and how it is similar to and different from the ISO standard. Note that in their eyes, the following must be provided by the board of directors and executive management: •

Strategic direction

•

Establishment of directives

•

Progress measurement

•

Verification that risk management practices are appropriate

•

Validation that the organization’s assets are used properly

Reference Figure 3-2 as a summarized view of information security governance, roles, and responsibilities for personnel in an organization.

Information Security Governance Outcomes I. State that governance describes the entire process of governing, or controlling, the processes used by a group to accomplish some objective. II. Define the term governance and why the board of directors are the ones that must be involved to provide strategic direction. Note the five key tasks they are responsible for: •

Strategic direction

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

•

Establishment of objectives

•

Measurement of progress toward these objectives

•

Verification that risk management practices are appropriate

•

Validation that the organization’s assets are used properly

III. List the five goals of information security governance: •

Strategic alignment of information security with business strategy to support organizational objectives

•

Risk management by executing appropriate measures to manage and mitigate threats to information resources

•

Resource management by utilizing information security knowledge and infrastructure efficiently and effectively

•

Performance measurement by measuring, monitoring, and reporting information security governance metrics to ensure that organizational objectives are achieved

•

Value delivery by optimizing information security investments in support of organizational objectives

Planning Levels I.

Explain to students that strategic plans and objectives are used to create tactical plans, which are used to develop operational plans.

II.

Compare and contrast tactical planning (one- to two-year timelines) with operational planning (day-to-day) tasks.

III.

Discuss how the chief information security officer (CISO) uses tactical plans to organize, prioritize, and acquire resources for major projects.

Planning and the CISO I.

Remind students that the primary objective of the CISO and the Information Security (IS) management team is to create the security strategic plan. Explain that this plan is an evolving statement of how the CISO will implement the objectives expressed in the Enterprise Information Security Plan.

II.

Stress that clearly directed strategies flow from top to bottom, and a systematic approach is required so that all members of an organization are aware.

III.

Define that everyone in the organization will likely use the information provided and not just strictly information security or technology professionals.

Quick Quiz 1

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

1. What type of planning occurs where the actions taken by management to specify the intermediate goals and objectives of the organization in order to obtain specified strategic goals are followed by estimates and schedules for the allocation of resources necessary to achieve those goals and objectives? a. strategic b. tactical c. operational d. financial Answer: b 2. According to the text and the information security governance roles and responsibilities graphic, who is responsible for policy implementation, reporting security vulnerabilities, and breaches? a. Chief executive officer b. Mid-level managers c. Janitorial staff d. Enterprise staff/employees Answer: d 3. The ________ process entails the review and assessment of organizational information security performance toward goals and objectives by the governing body. a. evaluate b. direct c. monitor d. assure Answer: c 4. True or False: ISO 27014:2021 is the ISO 27000 series standard for Governance of Information Security. Answer: False 5. True or False: Strategic planning sets the long-term direction to be taken by the organization and each of its component parts. It should also guide organizational efforts and focus resources toward specific, clearly defined goals. Answer: True

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Information Security Policy, Standards, and Practices (3.3, PPT Slides 12–13 and 18–30) I.

Establish how management from all communities of interest must consider policies as the basis for all information security planning, design, and deployment.

II.

Explain how policies direct how issues should be addressed and how technologies should be used.

III.

Emphasize that they should not explain the proper operation of hardware or software. This information should be placed in standards, procedures, and systems documentation.

IV.

State that policies should never contradict laws because they must be properly administered through dissemination and documented acceptance.

V.

Explain that quality security programs begin and end with policy.

VI.

Report how security policies are the least expensive control to execute, but the most difficult to implement properly.

Policy as the Foundation for Planning I.

Explain how policies are organizational laws in that they dictate acceptable and unacceptable behavior within the context of the organization’s culture. Like laws, policies must contain information on what is right and wrong, what the penalties are for violating policy, and what the appeal process is.

II.

Contrast how standards are more detailed statements of what must be done to comply with policies that are broader.

III.

Discuss how the level of acceptance of standards may be informal, as in de facto standards. Alternatively, standards may be published, scrutinized, and ratified by a group, as in formal or de jure standards.

IV.

Identify the relationship between policies, processes, practices, procedures, and guidelines as outlined in Table 3-1.

V.

Relate that the term of security policy strictly depends on the context in which it is used. As mentioned by the authors, this is a set of rules that protect an organization’s assets.

VI.

Define the term information security policy as it provides rules for protecting an organization’s information assets. Reference NIST’s SP 800-14 for the three types of security policy: •

Enterprise information security policies

•

Issue-specific security policies

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

• VII.

Systems-specific security policies

Emphasize how for a policy to be effective and legally enforceable, it must be properly disseminated, read, understood, agreed to, and enforced equally upon all members of the organization.

Enterprise Information Security Policy I.

Detail how an enterprise information security policy (EISP) is also known as a general security policy, organizational security policy, IT security policy, or information security policy. This policy sets the strategic direction, scope, and tone for all security efforts within the organization.

II.

Arrange the understanding that the EISP is often an executive-level document drafted by the CIO and is about 2 to 10 pages long.

III.

Recall the guidance that the NIST provides and that the EISP typically addresses compliance in the following two areas: •

General compliance to ensure meeting the requirements to establish a program and the responsibilities assigned therein to various organizational components.

•

The use of specified penalties and disciplinary action.

EISP Elements I.

Construct the following elements that an EISP should have. Give students an opportunity to review Table 3-2 as an example of what is included in an EISP. •

An overview of the corporate philosophy on security

•

Information on the structure of the information security organization and people who fulfill the information security role

•

Fully articulated responsibilities for security that are shared by all members of the organization (employees, contractors, consultants, partners, and visitors)

•

Fully articulated responsibilities for security that are unique to each role within the organization

Issue-Specific Security Policy I.

Explain how as an organization executes various technologies and processes to support routine operations, certain guidelines are needed to instruct employees to use these technologies and processes properly.

II.

Review the purpose of the ISSP and the components that, at a minimum, should be included within it: •

Addresses specific areas of technology

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

III.

•

Requires frequent updates

•

Contains a statement on the organization’s position on a specific issue

Outline topics that are often part of an issue-specific security policy (ISSP): •

E-mail

•

Use of the Internet and World Wide Web

•

Specific minimum configurations of computers to defend against worms and viruses

•

Prohibitions against hacking or testing organization security controls

•

Home use of company-owned computer equipment

•

Use of personal equipment on company networks (BYOD: bring your own device)

•

Use of telecommunications technologies, such as fax and phone

•

Use of photocopy equipment

•

Use of portable storage devices such as USB memory sticks, backpack drives, game players, music players, and any other device capable of storing digital files

•

Use of cloud-based storage services that are not self-hosted by the organization or engaged under contract; such services include Google Drive, Dropbox, and Microsoft OneDrive

•

Use of networked infrastructure devices, “intelligent assistants” such as Google Assistant and Amazon Echo, and accompanying devices usually classified as the Internet of Things (IoT)

•

Use of programmable logic controller (PLC) devices and associated control protocols with corporate data networks and production-focused industrial networks

IV.

Propose the three common ways that ISSPs can be created within an organization. These are tailored to specific issues, a single comprehensive ISSP document that covers all issues, or a modular ISSP document that unifies policy creation and administration while giving autonomy to each specific issue’s requirements.

V.

Critique the three different approaches to ISSP development and conclude that the optimal balance between the independent and comprehensive ISSP is the modular ISSP approach.

VI.

Name the core components of an ISSP as outlined in Table 3-3. Emphasize that these are explained in detail within this part of the module.

Statement of Policy © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

I.

Detail the purpose of a statement of policy. Emphasize that it should begin with a clear statement and purpose.

II.

Comment that within the introductory section, the following questions should be answered: •

What is the scope of the policy?

•

Who is responsible and accountable for policy implementation?

•

What technologies and issues does the policy document address?

Authorized Access and Usage of Equipment I.

Justify that this section of the policy statement addresses who can use the technology governed by the policy, and the purposes for which it can be used.

II.

Assess that additionally, this section defines “fair and responsible use” of equipment and other organizational assets and should also address key legal issues, such as protection of personal information and privacy.

Prohibited Use of Equipment I.

Stress that this section of the policy provides strict guidance with respect to where technology is prohibited to be used.

II.

Predict the fact that an organization and its employees cannot be penalized if a particular use is strictly prohibited.

Systems Management I.

Explain that this section provides focus on the users’ relations to systems management.

II.

Emphasize that it is important to identify all responsibilities delegated to both users and systems administrators to avoid confusion.

Violations of Policy I.

Label this part of the policy the consequences and penalties for violating an information security policy.

II.

Guide students to understand that this section also provides instructions on how to report policy violations.

Policy Review and Modification I.

Explain that each policy should have a procedure and a timetable for a periodic review.

Limitations of Liability

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

I.

Recall that this section is often the final section of a policy and has a general statement of liability or disclaimers.

II.

Summarize that the policy should state that if employees violate a company policy or any law using company technologies, the company will not protect them and is not liable for their actions.

Systems-Specific Security Policy (SysSP) I.

Emphasize that while issue-specific policies are formalized as written documents to be distributed to users and agreed to in writing, SysSPs are frequently codified as standards and procedures to be used when configuring or maintaining systems.

II.

Explain that systems-specific policies can be combined into a single policy document or separated into two groups: managerial guidance and technical specifications.

Managerial Guidance of SysSPs I.

Discuss the managerial guidance SysSPs. Note that a managerial guidance SysSP document is created by leadership to guide the implementation and configuration of technology, as well as to address the behavior of people in the organization in ways that support the security of information.

II.

Establish an understanding that any system that affects the confidentiality, integrity, or availability of information must be assessed to evaluate the trade-off between improved security and restrictions.

Technical Specifications of SysSPs I.

Discuss that while a manager can work with a systems administrator to create managerial policy as described in the preceding section, the system administrator may need to create a policy to implement the managerial policy.

II.

State the purpose and definition of access control lists (ACLs). Comment that these are user access lists, matrices, and capability tables that govern the rights and privileges of users. A capability table specifies which subjects and objects users or groups can access; in some systems, capability tables are called user profiles or user policies.

III.

Summarize the purpose of an ACL and what it regulates: •

Who can use the system

•

What authorized users can access

•

When authorized users can access the system

•

Where authorized users can access the system from

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

IV.

Recall the purpose of configuration rule policies, as they are specific instructions entered into a security system that govern how it reacts to data it receives. Note that these are more specific than ACLs to the operation of a system and may or may not deal with users directly.

Combination SysSPs I.

Explain that many organizations create a single document that combines the management guidance SysSP and the technical specifications SysSP. This often is confusing to casual users but is practical since it puts the guidance from both managerial and technical perspectives in a single place.

Developing and Implementing Effective Security Policy I.

Develop the six tasks that must be done properly in order for a policy to be legally defensible: •

Development: Policies must be written using industry-accepted practices and formally approved by management.

•

Dissemination: Policies must be distributed using all appropriate methods.

•

Review: Policies must be readable and read by all employees.

•

Comprehension: Policies must be understood by all employees.

•

Compliance: Policies must be formally agreed to by act or affirmation.

•

Enforcement: Policies must be uniformly applied to all employees.

Developing Information Security Policy I.

II.

Outline that in most cases, policy development is comprised of three parts: •

Designed and written

•

Senior management or an executive along with legal counsel reviews and approves the document

•

Management processes developed in the final state, which, in turn, results in policy enforcement within the organization

Emphasize the importance of security managers using all resources available to create policies, but give credit where it is due when referencing external sources outside of the organization.

Policy Distribution I.

Compare and contrast the options of providing hard copy policy documents and electronic ones.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

II.

Stress that distribution of materials, regardless of method, may still not get to individuals. Unlike in law, ignorance of policy, where policy is inadequately distributed, is considered an acceptable excuse.

III.

Distinguish that distribution of classified policies—those containing confidential information—requires additional levels of controls, in the labeling of the document, in the dissemination and storage of new policy, and in the collection and destruction of older versions to ensure the confidentiality of the information contained within the policy documents themselves.

Policy Review I.

Identify that one of the common barriers of employees reading policies arises from literacy or language issues. Provide the fact that, according to Macrotrends, 1 in 15 adults cannot read and write with understanding. Language issues are even more prevalent in organizations with multiple locations around the world.

II.

Stress that alternate forms of materials such as braille, an audio version, or a sign language intrpreter of policies must be available to accommodate employees who are visually impaired or deaf.

Policy Comprehension I.

Review the two aspects of policy comprehension: the target audience can understand the policy, and the organization has assessed how well they understand it.

II.

Apply the use of software or add-ons that examine the readability of a document. For example, the Flesch Reading Ease test recommends a score of 60 to 70 on its 100-point scale for corporate documents. The Flesh–Kincaid Grade Level test, alternately, recommends a score of 7.0 to 8.0 for similar documents.

III.

Classify the use of assessments to gauge how well employees comprehend underlying issues. Quizzes and other forms of examination can be employed to assess quantitatively which employees understand the policy by earning a minimum score (e.g., 70 percent) and which employees require additional training and awareness efforts before the policy can be enforced.

Policy Compliance I.

Record that an employee must agree to policies by act or affirmation with respect to policies developed within an organization.

II.

Emphasize that through direct collection of a signature or the equivalent digital alternative the organization can prove that it has obtained an agreement to comply with policy, which also demonstrates that the previous conditions have been met.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

III.

Give an example of what may happen when an employee refuses to agree to comply with a policy. In most cases, they will be terminated. However, organizations can avoid this dilemma by incorporating policy confirmation statements into employment contracts, annual evaluations, or other documents necessary for the individual’s continued employment.

Policy Enforcement I.

Recognize that the final component of the design and implementation of effective policies is uniform and impartial enforcement. As in law enforcement, policy enforcement must be able to withstand external scrutiny. Because this scrutiny may occur during legal proceedings—for example, in a civil suit contending wrongful termination— organizations must establish high standards of due care about policy management.

II.

Consequentially, state that an employee who is punished, censured, or dismissed because of a refusal to follow policy and is subsequently able to demonstrate that the policies are not uniformly applied or enforced, the organization may find itself facing punitive as well as compensatory damages.

Policy Development and Implementation Using the SDLC I.

Apply the concept of the systems development life cycle (SDLC) to creating policies.

II.

Outline information and processes that the policy development team should obtain in each of the five phases, as arranged below: •

Investigation Phase: o

Support from senior management because any project without it has a reduced chance of success. Only with the support of top management will a specific policy receive the attention it deserves from the intermediate-level managers who must implement it and from the users who must comply with it.

o

Support and active involvement of IT management, specifically the CIO. Only with the CIO’s active support will technology-area managers be motivated to participate in policy development and support the implementation efforts to deploy it once created.

o

Clear articulation of goals. Without a detailed and succinct expression of the goals and objectives of the policy, broken into distinct expectations, the policy will lack the structure it needs to obtain full implementation.

o

Participation of the correct individuals from the communities of interest affected by the recommended policies. Assembling the right team, by ensuring the participation of the proper representatives from the groups that will be affected by the new policies, is very important. The team must

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

include representatives from the legal department, the human resources department, and end users of the various IT systems covered by the policies, as well as a project champion with sufficient stature and prestige to accomplish the goals of the project and a capable project manager to see the project through to completion. o •

A detailed outline of the scope of the policy development project and sound estimates for the cost and scheduling of the project.

Analysis Phase: o

A new or recent risk assessment or IT audit documenting the current InfoSec needs of the organization. This risk assessment should include any loss history, as well as past lawsuits, grievances, or other records of negative outcomes from InfoSec areas.

o

The gathering of key reference materials, including any existing policies. Sometimes policy documents that affect InfoSec will be housed in the human resources department as well as the accounting, finance, legal, or corporate security departments.

o

The policy development committee must determine the fundamental philosophy of the organization when it comes to policy. This will dictate the general development of all policies, but in particular, the format to be used in the crafting of all ISSPs. This philosophy typically falls into one of two groups: 1. “That which is not permitted is prohibited.” Also known as the “whitelist” approach, this is the more restrictive of the two, and focuses on creating an approach where specific authorization is provided for various actions and behaviors; all other actions and behaviors (and uses) are prohibited or at least require specific permissions. This approach can impede normal business operations if appropriate options emerge but cannot be incorporated into policy until subsequent revisions are made. 2. “That which is not prohibited is permitted.” Also known as the “blacklist” approach, this alternate approach specifies what actions, behaviors, and uses are prohibited and then allows all others by default. While easier to implement, this approach can result in issues as more and more areas that should be prohibited are discovered by users.

•

Design Phase:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

o

Note that this is the first task in the design phase and drafting of the actual document. Most times this is done by a single author but can be a committee sometimes. The following resources are often available: 1. The Web: You can search for other similar policies. The point here is not to advocate wholesale copying of these policies but to encourage you to look for ideas for your own policy. For example, dozens of policies available on the Web describe fair and responsible use of various technologies. What you may not find, however, are policies that relate to sensitive internal documents or processes. 2. Government sites: Sites such as http://csrc.nist.gov contain numerous sample policies and policy support documents, including SP 800-100, “Information Security Handbook: A Guide for Managers.” While these policies are typically applicable to federal government Web sites, you may be able to adapt some sections to meet your organization’s needs. 3. Professional literature: Several authors have published books on the subject. Of particular note is Charles Cresson Wood’s Information Security Policies Made Easy series, which not only provides more than 1,000 pages of policies, but it also makes those policies available in electronic format, complete with permission to use them in internal documents. Exercise caution when using such resources, however; it is extremely easy to take large sections of policy and end up with a massive, unwieldy document that is neither publishable nor enforceable. 4. Peer networks: Other InfoSec professionals must write similar policies and implement similar plans. Attend meetings like those offered by the Information Systems Security Association (www.issa.org) or the Information Systems Audit and Control Association (www.isaca.org) and ask your peers. 5. Professional consultants: Policy is one area of InfoSec that can certainly be developed in-house. However, if your organization does not have the requisite expertise, or if your team simply cannot find the time to develop your own policy, then hiring an outside consultant may be your best option. Keep in mind that no consultant can know your organization as well as you do; you may decide to have the consultant design generic policies that you can then adapt to your specific needs.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

23

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

o

•

•

After the document is drafted and the document has committee approval, this is then sent to the approving manager or executive for sign-off.

Implementation Phase: o

This is the step during which the team must create a strategic plan to distribute and verify the distribution of policies. In most cases, the simplest way to document acknowledgment of a written policy is to attach a cover sheet that states “I have received, read, understood, and agreed to this policy.” The employee’s signature and date provide a paper trail of his or her receipt of the policy.

o

Emphasize that a stronger form of acknowledgement requires personnel to take a quiz to test their knowledge on the policy.

o

This phase should also include the ability for any automated tool used for the creation and management of policy documents and revisions to feasibility analysis reports based on improved costs and benefits as designs are clarified.

Maintenance Phase: o

This is when the policy team monitors, maintains, and modifies existing policies and procedures.

o

Options should be available for personnel to anonymously report issues or problems of policies published. This is to ensure uniform policy development and enforcement.

Policy Management I. Describe the purpose of policy management and stress that they are living documents that must be managed and nurtured, as they constantly change and grow. These documents must be properly disseminated and managed. II. Assess situations where special considerations should be made. Give examples of this being organizations undergoing mergers, takeovers, and partnerships. III. Relate that viable security policies must have a responsible manager, a schedule of reviews, a method for making recommendations for reviews, and a policy issuance and revision date.

Responsible Manager I.

Detail that a policy administrator is the person that is responsible for the creation, revision, distribution, and storage of a policy in an organization.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

24

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

II.

Stress that this person does not have to have proficient knowledge in the technologies, but rather policy administration requires only a moderate technical background.

III.

The policy administrator must be clearly identified in the policy document as the primary point of contact for additional information or suggested revisions to the policy.

Schedule of Reviews I.

Organize understanding that policies can be only so effective provided they are kept current. Hence, an organization must actively seek to meet the requirements of the market they operate in.

II.

Justify that once a year for policy review is a minimum baseline, but it is up to the leadership to determine if it needs to be more frequent.

Review Procedures and Practices I.

Explain that to facilitate policy reviews, the policy manager should implement a mechanism by which people can comfortably make recommendations for revisions, whether via e-mail, office mail, or an anonymous drop box.

II.

Assess the benefits of using automation, which can streamline the repetitive steps of writing policy, tracking the workflow of policy approvals, publishing policy once it is written and approved, and tracking when employees have read the policy.

Policy, Review, and Revision Dates I.

Comment that a simple action of not including a date on a policy can cause mass confusion for an organization.

II.

Stress that without the dates, it will be nearly impossible to determine which version of a policy is the most current or if a past version needs to be referenced, which one that is.

III.

Emphasize that some policies may need a sunset clause that contains an expiration date.

Automated Policy Management I. II.

III.

Explain that this is a new practice in the workplace, which can assist with some of the busywork policy managers have to deal with. Outline that automation streamlines the repetitive steps of writing policy, tracking the workflow of policy approvals, publishing policy once it is written and approved, and tracking when employees have read the policy. Quantify to students that some of the benefits that can be achieved from this include being able to train staff through computer-based training (CBT) and increased awareness of policies and procedures, among other benefits.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

25

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Security Education, Training, and Awareness Program (3.4, PPT Slides 31–36) I.

Explain that as soon as the policies outlining the general security policy have been drafted, policies to implement security education, training, and awareness (SETA) programs in the organization should follow.

II.

Describe the SETA program, which is a control measure designed to reduce the incidences of accidental security breaches by employees. SETA programs are designed to supplement the general education and training programs that many organizations have in place to educate staff on information security.

III.

Identify that the SETA program consists of three elements: security education, security training, and security awareness.

IV.

Present that the purpose of SETA is to enhance security by the following three ways:

V.

•

Improving awareness of the need to protect system resources

•

Developing skills and knowledge so computer users can perform their jobs more securely

•

Building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems

Recommend students review Table 3-4, as it provides a comparative framework of SETA that can be applied to in-class discussions and potential projects.

Security Education I.

Emphasize that everyone in an organization needs to be trained and aware of information security, but not every member of the organization needs a formal degree or certificate in information security.

II.

Discuss that when formal education for appropriate individuals in security is needed, with the support of management, an employee can identify curriculum available from local institutions of higher learning or continuing education.

Security Training I.

Relate how security training involves providing members of the organization with detailed information and hands-on instruction designed to prepare them to perform their duties securely.

II.

Present how management of information security can develop customized in-house training or outsource the training program. This is beneficial to the organization, as it is specific to themselves, although the likelihood of it needing to be adjusted would occur with changes in material.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

26

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Security Awareness I.

Stress that a security awareness program is one of the least frequently implemented but most beneficial programs in an organization.

II.

Explain that a security awareness program is designed to keep information security at the forefront of the users’ minds as they work daily. This helps stimulate them to care about security as well.

III.

Establish that if the program is not actively implemented, employees begin to “tune out,” and the risk of employee accidents and failures increases.

Information Security Blueprint, Models, and Frameworks (3.5, PPT Slides 39–52 and 55–58) I.

State how the security blueprint is the basis for the design, selection, and implementation of all security program elements.

II.

Explain that the blueprint builds on top of the organization’s information security policies and that it is a scalable, upgradeable, comprehensive plan to meet the organization’s current and future information security needs.

III.

Discuss how the blueprint is a detailed version of the information security framework, which is an outline of the overall information security strategy for the organization and a roadmap for planned changes to the information security environment of the organization.

IV.

Summarize that one approach to selecting a methodology is to adapt or adopt a published model, or framework, for information security.

The ISO 27000 Series I.

Explain that one of the most widely referenced and often discussed security models is the Information Technology—Code of Practice for Information Security Management, which was originally published as the British Standard BS7799.

II.

Outline that in 2000, this code of practice was adopted as an international standard by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as ISO/IEC 17799. Further explain that it was renamed as ISO 27002 in 2007 to align it with ISO 27001.

III.

Discuss and present the core sections of ISO/IEC 27002:2013, as outlined in Table 35 within the textbook.

IV.

Evaluate Figure 3-9 and the core steps and deliverables that make up procedure ISO/IEC 27001:2013.

NIST Security Models © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

27

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

I.

Reference that an alternate approach is available as mentioned in the textbook, which provides numerous documents available for reference from the Computer Security Resource Center of the National Institute for Standards and Technology (http://csrc.nist.gov).

II.

Emphasize that NIST documents are publicly available at no charge and have been available for some time. They have been broadly reviewed by government and industry professionals, and they are among the references cited by the federal government when it decided not to select the ISO/IEC 17799 standards.

III.

Explain how SP 800-12, “An Introduction to Computer Security,” is an excellent reference and guide for the security manager or administrator in the routine management of information security.

IV.

Describe SP 800-14, “Generally Accepted Principles and Practices for Securing Information Technology Systems,” which provides best practices and security principles that can direct the security team in the development of a security blueprint.

V.

List the following NIST documents that can assist in the design of a security framework: •

SP 800-12, Rev. 1: “An Introduction to Information Security”

•

SP 800-18, Rev. 1: “Guide for Developing Security Plans for Federal Information Systems”

•

SP 800-30, Rev. 1: “Guide for Conducting Risk Assessments”

•

SP 800-37, Rev. 2: “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy”

•

SP 800-39: “Managing Information Security Risk: Organization, Mission, and Information System View”

•

SP 800-50: “Building an Information Technology Security Awareness and Training Program”

•

SP 800-55, Rev. 1: “Performance Measurement Guide for Information Security”

•

SP 800-100: “Information Security Handbook: A Guide for Managers”

NIST SP 800-12 I.

Recognize that this is an excellent reference and guide for a security manager or administrator in the routine management of information security.

II.

Stress that it, however, provides little guidance for the design and implementation of new security systems, and therefore should be used only as a precursor to understanding an information security blueprint.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

28

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

NIST SP 800-14 I.

Present that this provides the best practices and security principles that can direct the security team in the development of a security blueprint.

II.

Assess and discuss the philosophical principles that the security team should integrate into the entire security process, as described below: •

Security supports the organization.

•

Security is an integral element of sound management.

•

Security should be cost-effective.

•

Systems owners have security responsibilities outside their own organizations.

•

Security responsibilities and accountability should be made explicit.

•

Secure requires a comprehensive and integrated approach.

•

Security should be periodically assessed.

•

Security is constrained by societal factors.

NIST SP 800-18, Rev. 1 I.

State that this document can be used for a comprehensive security blueprint and framework. It can also be a useful guide to the activities described in this module and as an aid in the planning process. It also includes templates for major application security plans.

II.

Stress that a blueprint must be customized to meet the needs of an organization.

NIST and the Risk Management Framework I.

II.

Analyze the following with respect to NIST’s approach to managing risk in the organization. Note that this is discussed in the next module in more detail: •

Building information security capabilities into federal information systems through the application of state-of-the-practice management, operational, and technical security controls

•

Maintaining awareness of the security state of information systems on an ongoing basis through enhanced monitoring processes

•

Providing essential information to help senior leaders make decisions about accepting risk to an organization’s operations and assets, individuals, and other organizations arising from the use of information systems

Examine the characteristics that are part of the Risk Management Framework (RMF):

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

29

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

•

Promotes the concept of near real-time risk management and ongoing information system authorization through the implementation of robust continuous monitoring

•

Encourages the use of automation to provide senior leaders with necessary information to make cost-effective, risk-based decisions about information systems that support an organization’s core missions and business functions

•

Integrates information security into the enterprise architecture and system development life cycle

•

Emphasizes the selection, implementation, assessment, and monitoring of security controls and the authorization of information systems

•

Links risk management processes at the information system level to risk management processes at the organization level through a risk executive function

•

Establishes responsibility and accountability for security controls deployed within an organization’s information systems and inherited by those systems (i.e., common controls)

The NIST Cybersecurity Framework I.

Recognize that in early 2014, the NIST published a new Cybersecurity Framework in response to Executive Order 13636 from President Barack Obama. The purpose of this was to create a voluntary framework that provides an effective approach to “manage cybersecurity risk for those processes, information, and systems directly involved in the delivery of critical infrastructure services.”

II.

Describe that the intent of the framework was to accomplish five things: “1) Describe their current cybersecurity posture; 2) Describe their target state for cybersecurity; 3) Identify and prioritize opportunities for improvement within the context of a continuous and repeatable process; 4) Assess progress toward the target state; and 5) Communicate among internal and external stakeholders about cybersecurity risk.”

III.

Outline and summarize the three fundamental components: •

The framework core: A set of information security activities an organization is expected to perform, as well as their desired results.

•

The framework tiers: A compilation of a self-defined set of four tiers so organizations can relate the maturity of their security programs and implement corresponding measures and functions.

•

The framework profile: Organizations are expected to identify which tier their security programs most closely match and then use corresponding

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

30

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

recommendations within the framework to improve their programs. This framework profile is then used to perform a gap analysis—comparing the current state of information security and risk management to a desired state, identifying the difference, and developing a plan to move the organization toward the desired state. IV. Apply the materials provided in the NIST framework to follow a seven-step approach to implementing or improving their risk management and information security programs. These are provided below: •

Step 1: Prioritize and scope: The organization identifies its business/mission objectives and high-level organizational priorities. With this information, the organization makes strategic decisions regarding cybersecurity implementations and determines the scope of systems and assets that support the selected business line or process.

•

Step 2: Orient: Once the scope of the cybersecurity program has been determined for the business line or process, the organization identifies related systems and assets, regulatory requirements, and overall risk approach. The organization then identifies threats to, and vulnerabilities of, those systems and assets.

•

Step 3: Create a current profile: The organization develops a current profile by indicating which category and subcategory outcomes from the framework core are currently being achieved.

•

Step 4: Conduct a risk assessment: This assessment could be guided by the organization’s overall risk management process or previous risk assessment activities. The organization analyzes the operational environment in order to discern the likelihood of a cybersecurity event and the impact that the event could have on the organization.

•

Step 5: Create a target profile: The organization creates a target profile that focuses on the assessment of the framework categories and subcategories describing the organization’s desired cybersecurity outcomes.

•

Step 6: Determine, analyze, and prioritize gaps: The organization compares the current profile and the target profile to determine gaps. Next, it creates a prioritized action plan to address those gaps that draws upon mission drivers, a cost-benefit analysis, and understanding of risk to achieve the outcomes in the target profile. The organization then determines resources necessary to address the gaps.

•

Step 7: Implement action plan: The organization determines which actions to take regarding the gaps, if any, identified in the previous step. It then monitors its current cybersecurity practices against the target profile.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

31

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Other Sources of Security Frameworks I.

Review the text, as it offers several professional societies and organizations that have Web sites and resources that can assist with building strong security frameworks.

Design of the Security Architecture I.

Examine the overview of different types of security architectures that can help with blueprint construction, implementation, and maintenance. These include spheres of security, levels of controls, defense in depth, and security perimeters.

Spheres of Security I.

Establish that spheres of security are the core of a security framework. Figure 3-10 illustrates how information is under attack from several sources, both internally and externally.

II.

Illustrate that the left side of the graphic illustrates that a layer of protection must exist between each layer of the sphere of use.

III.

Relate that there are often three layers to information security implementation: policies, people, and technology. These layers are commonly referred to as PPT. Each layer contains controls and safeguards to protect the information and information system assets that the organization values.

IV.

Emphasize before moving forward that before any technical controls are in place, policies must be in place and solidified.

Levels of Controls I.

Summarize that information security safeguards offer three levels of controls: managerial, operational, and technical.

II.

Managerial controls are security processes that are designed by strategic planners and implemented by the security administration of the organization. Management controls set the direction and scope of the security process, and they provide detailed instructions for its conduct, while addressing the design and implementation of the security planning process and security program management.

III.

Operational controls are management and lower-level planning functions that deal with the operational functionality of security in the organization, such as disaster recovery and incident response planning. Operational controls also address personnel security, physical security, and the protection of production inputs and outputs.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

32

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

IV.

Technical controls are the tactical and technical implementations of security in the organization. Technical controls are the components put in place to protect an organization’s information assets.

V.

Compare and contrast the differences between the three level of controls. Focus on the fact that managerial controls influence operational and technical controls that must be in place for security to be effective.

Defense in Depth I.

Distinguish that a basic tenet of security architectures is layered implementation of security. Thus, an organization must establish multiple layers of security controls and safeguards, which can be organized into policy, training and education, and technologies, as shown in the CNSS model presented in the first module.

II.

Demonstrate that to achieve defense in depth, an organization must establish multiple layers of security controls and safeguards, which can be organized into policy, training and education, and technology.

III.

Recall that while policy may not prevent attacks, it prepares the organization to handle them, and coupled with other layers, it can deter attacks.

IV.

Implementing multiple types of technology and thereby preventing the failure of one system from compromising the security of information is referred to as redundancy.

Security Perimeter I.

Describe the purpose a security perimeter. This is the boundary between the outer limit of an organization’s security and the beginning of the outside world. It is the level of security that protects all internal systems from outside threats.

II.

Relate that the security perimeter does not protect against internal attacks from employee threats or on-site physical threats.

III.

Explain that the key components of the security perimeter are firewalls, DMZs, proxy servers, and IDPSs.

Quick Quiz 2 1. Which of the following terms best describes a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls? a. blueprint b. the NIST handbook c. information security framework d. security plan © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

33

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Answer: c 2. Which document is an excellent reference for security managers involved in the routine management of information security? a. SP 800-12, “An Introduction to Computer Security” b. SP 800-14, “Generally Accepted Principles and Practices for Securing Information Technology” c. SP-800-30 Rev. 1: “Guide for Conducting Risk Assessments” d. SP-800-50: “Building an Information Technology Security Awareness and Training Program” Answer: a 3. True or False: SP 800-18, “Guide for Developing Security Plans for Federal Information Systems,” is considered the foundation for a comprehensive security blueprint and framework. Answer: True 4. As indicated earlier, one of the foundations of security architectures is the requirement to implement security in layers. This layered approach is referred to as which of the following? a. framework b. security perimeter c. security domain d. defense in depth Answer: d 5. Which of the following defines the edge between the outer limit of an organization’s security and the beginning of the outside world? a. framework b. security perimeter c. security domain d. defense in depth Answer: b [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

34

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Discussion Questions You can assign these questions several ways: in a discussion forum in your LMS, as wholeclass discussions in person, or as a partner or group activity in class. These questions are separate from the review questions and exercises in the textbook. For answers to the textbook questions, see the associated solutions for this module. Additional class discussion options: 1. There are several management functions that apply to information security. Have the class discuss which ones that were outlined were the most important and least important and why. (3.1, PPT Slides 3–12) Duration 15 minutes. 2. Keeping policy current is critical. Have the class discuss how policy needs to be updated to accommodate current events. (3.4, 3.5, PPT Slides 39–52 and 55–58) Duration 15 minutes. 3. Enact a discussion with students in the course with respect to management figures and their roles in policy development. Should a CEO be involved in the policy development, or should they take a hands-off approach? Divide the course up into two camps: one that supports the CEO being a part and the other that does not. (3.5, PPT Slides #15, 18–36, and 39–52) Duration 15 minutes. [return to top]

Suggested Usage for Lab Activities A series of hands-on labs has been developed to complement the text material for this course and are available for download at the Instructor Center. The labs do not depend on specific chapter content, so instructors can insert them where they best suit the syllabus. The following is a list of lab titles, objectives, and approximate durations to assist with lesson planning. Lab Title Ethical Considerations in IT and Detecting Phishing Attacks

Web Browser Security

Objective Upon completion of this activity, you will: • have a better understanding of the ethical expectations of IT professionals; and • be able to identify several types of social engineering attacks that use phishing techniques. Upon completion of this activity, the student will be able to: • Review and configure the security

Duration Ethical Considerations lab in 15 to 20 minutes. Phishing E-Mail lab in 60 to 75 minutes.

1 to 1.5 hours

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

35

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Malware Defense

Windows Password Management

Backup and Recovery and File Integrity Monitoring

OS Processes and Services

Log Management & Security

and privacy settings in the most popular web browsers. Upon completion of this activity, the student will be able to: • Understand the basic setup and use of an open-source AV product. • Install and use Clam AV on a Windows system. • Using a USB storage device create a portable AV scanner. • Understand what a YARA file is and how it is used. Upon completion of this activity, the student will be able to: • Review and configure password management policies in a Windows client computer. Upon completion of this activity, you will be able to: • Describe backup and recovery processes and will be aware of basic backup activities using Windows 10 or another desktop operating system (OS). • Perform file integrity monitoring using file hash values. Upon completion of this activity, the student will be able to: • Review available and enabled OS services. • Review available and enabled OS processes. • Review current system resource utilization. Upon completion of this activity, the student will be able to: • Access and review the various logs present in a Windows 10 computer.

1 to 1.5 hours

30 minutes to 1 hour

15–20 minutes

60–90 minutes

30 minutes to 1 hour

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

36

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Footprinting, Scanning, and Enumeration

AlienVault OSSIM

Image Analysis Using Autopsy

Upon completion of this activity, the student will be able to: • Identify network addresses associated with an organization. • Identify the systems associated with the network addresses. Upon completion of this activity, the student will be much more knowledgeable about the AlienVault OSSIM software and how to install, configure, and operate it. You will use the software more extensively in a subsequent lab. Upon completion of this activity, the student will be able to perform basic drive image analysis using the Autopsy software package.

40–60 minutes

2–3 hours

45–70 minutes

[return to top]

Additional Activities and Assignments Please see associated solutions for the Closing Scenario at the end of the textbook module. Additional project options include: 1. Engage students to search the Web for examples of technology-specific security policies. What types of technology are being controlled? 2. Direct students go to the library, find a journal or magazine article on defense in depth, and write a short summary to share with the class. [return to top]

Additional Resources Cengage Video Resources • •

MindTap Video: Goverance MindTap Video: Information Security Policy

Internet Resources • • •

A Guide to Security Metrics COBIT Framework for IT Governance and Control ITIL

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

37

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

• •

Information Security Governance Strategic Planning (in a nonprofit and for-profit organization)

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

38

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 3: Information Security Management

Appendix Grading Rubrics Providing students with rubrics helps them understand expectations and components of assignments. Rubrics help students become more aware of their learning process and progress, and they improve students’ work through timely and detailed feedback. Customize these rubrics as you wish. The grading rubric suggests a 4-point scale, and the discussion rubric indicates 30 points. Grading Rubric These grading criteria can be applied to open-ended Review Questions, Real-World Exercises, Case Studies, and Security for Life activities 3 2 1 0 Exceeds Expectations Meets Expectations Needs Improvement Inadequate • Student • Student • Student’s • Student’s response demonstrates demonstrates response is missing or accurate accurate demonstrates a incomplete. understanding of understanding of gap in • Student’s response the concept. the concept. understanding of demonstrates a • Student applies the • Student applies the concept. critical gap in concept the concept • Student applies understanding. appropriately. appropriately. the concept • Student is unable • Student uses • Student develops incorrectly. to apply the sound critical a complete • Student’s concept. analysis to develop response to the response is poorly an insightful and prompt. developed or comprehensive incomplete. response to the prompt. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

39

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Instructor Manual Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 2 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 5 Module Outline .............................................................................................................................. 6 Discussion Questions .................................................................................................................. 24 Suggested Usage for Lab Activities ............................................................................................ 25 Additional Activities and Assignments ....................................................................................... 27 Additional Resources................................................................................................................... 27 Cengage Video Resources ....................................................................................................................... 27 Internet Resources .................................................................................................................................. 27 Appendix ...................................................................................................................................... 28 Grading Rubrics ....................................................................................................................................... 28

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Purpose and Perspective of the Module The purpose of this module is to examine the processes necessary to undertake formal risk management activities in the organization. Risk management is the process of identifying, assessing, and reducing risk to an acceptable level and implementing effective control measures to maintain that level of risk. This is done with a number of processes from risk analysis through various types of feasibility analyses, including quantitative and qualitative assessment measures and evaluation of security controls.

Cengage Supplements The following product-level supplements provide additional information that may help you in preparing your course. They are available in the Instructor Resource Center. • • • • •

PowerPoint slides Test banks, available in Word, as LMS-ready files, and on the Cognero platform MindTap Educator Guide Solution and Answer Guide This instructor’s manual

Module Objectives The following objectives are addressed in this module: 4.1

Define risk management and describe its importance.

4.2

Explain the risk management framework and process model, including major components.

4.3

Define risk appetite and explain how it relates to residual risk.

4.4

Describe how risk is identified and documented.

4.5

Discuss how risk is assessed based on likelihood and impact.

4.6

Describe various options for a risk treatment strategy.

4.7

Discuss conceptual frameworks for evaluating risk controls and formulating a costbenefit analysis.

4.8

Compare and contrast the dominant risk management methodologies.

Complete List of Module Activities and Assessments For additional guidance refer to the MindTap Educator Guide. Module Objective

PPT slide

Activity/Assessment

Duration

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

4.1 and 4.2 4.3–4.5 4.3–4.5 4.1–4.8

7–8 29–30 61–62 86 MindTap MindTap MindTap

Knowledge Check Activity 1 Knowledge Check Activity 2 Knowledge Check Activity 3 Self-Assessment Module 04 Review Questions Module 04 Case Exercises Module 04 Exercises

MindTap MindTap

Module 04 Security for Life Module 04 Quiz

2 minutes 2 minutes 2 minutes 5 minutes 30–40 minutes 30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: risk management: The process of identifying risk, assessing its relative magnitude, and taking steps to reduce it to an acceptable level. risk assessment: The identification, analysis, and evaluation of risk as initial parts of risk management. risk treatment: The application of safeguards or controls to reduce the risks of an organization’s information assets to an acceptable level. risk control: See risk treatment. RM framework: The overall structure of the strategic planning and design for the entirety of the organization’s RM efforts. RM process: The identification, analysis, evaluation, and treatment of risk to information assets, as specified in the RM framework. risk management (RM) plan: A document that contains specifications for the implementation and conduct of RM efforts. residual risk: The risk to information assets that remains even after current controls have been applied. risk appetite: The quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility. risk tolerance: The assessment of the amount of risk an organization is willing to accept for a particular information asset, typically synthesized into the organization’s overall risk appetite.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

risk threshold: See risk tolerance. zero-tolerance risk exposure: An extreme level of risk tolerance whereby the organization is unwilling to allow any successful attacks or suffer any loss to an information asset. risk appetite statement: A formal document developed by the organization that specifies its overall willingness to accept risk to its information assets, based on a synthesis of individual risk tolerances. risk identification: The recognition, enumeration, and documentation of risks to an organization’s information assets. data classification scheme: A formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it. threat assessment: An evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack. risk analysis: A determination of the extent to which an organization’s information assets are exposed to risk. likelihood: The probability that a specific vulnerability within an organization will be attacked by a threat. impact: An understanding of the potential consequences of a successful attack on an information asset by a threat. uncertainty: The state of having limited or imperfect knowledge of a situation, making it less likely that organizations can successfully anticipate future events or outcomes. risk evaluation: The process of comparing an information asset’s risk rating to the numerical representation of the organization’s risk appetite or risk threshold to determine if risk treatment is required. mitigation risk treatment strategy: The risk treatment strategy that attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards in an effort to change the likelihood of a successful attack on an information asset, also known as the defense strategy. risk defense: See mitigation risk treatment strategy. risk mitigation: See mitigation risk treatment strategy transference risk treatment strategy: The risk treatment strategy that attempts to shift risk to other assets, processes, or organizations. risk sharing: See transference risk treatment strategy.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

risk transfer: See transference risk treatment strategy. acceptance risk treatment strategy: The risk treatment strategy that indicates the organization is willing to accept the current level of residual risk, and as a result, the organization makes a conscious decision to do nothing else to protect an information asset from risk and to “live with” the outcome from any resulting exploitation. risk acceptance: See acceptance risk treatment strategy. termination risk treatment strategy: The risk treatment strategy that eliminates all risk associated with an information asset by removing it from service. risk avoidance: See termination risk treatment strategy. risk termination: See termination risk treatment strategy. process communications: The necessary information flow within and between the governance group, RM framework team, and RM process team during the implementation of RM. process monitoring and review: The data collection and feedback associated with performance measures used during the conduct of the process. cost avoidance: The financial savings from using the mitigation risk treatment strategy to implement a control and eliminate the financial ramifications of an incident. cost-benefit analysis (CBA): The formal assessment and presentation of the economic expenditures needed for a particular security control, contrasted with its projected value to the organization, also known as an economic feasibility study. asset valuation: The process of assigning financial value or worth to each information asset. single loss expectancy (SLE): In a cost-benefit analysis, the calculated value associated with the most likely loss from an attack (impact); the SLE is the product of the asset’s value and the exposure factor. annualized rate of occurrence (ARO): In a cost-benefit analysis, the expected frequency of an attack, expressed on a per-year basis. annualized loss expectancy (ALE): In a cost-benefit analysis, the product of the annualized rate of occurrence and single loss expectancy. [return to top]

What's New in This Module The following elements are improvements in this module from the previous edition:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

●

This Module was Chapter 5 in the 6th edition.

●

Risk Management methodology has been updated to reflect the ISO model.

●

Module content has been refined and restructured.

●

Module has been updated to include new NIST SP content.

[return to top]

Module Outline Introduction to Risk Management (4.1, PPT Slides 3 and 4) I.

Emphasize how as aspiring information security professionals your students will have a key role to play in risk management.

II.

Remind your students that the IT community must serve the information technology needs of the broader organization, and at the same time, leverage the special skills and insights of the information security community.

III.

Explain how the information security team must lead the way with skill, professionalism, and flexibility as it works with the other communities of interest to appropriately balance the usefulness and security of the information system.

IV.

Discuss how in the past an organization could establish a competitive business model, method, or technique to provide a product or service that was superior and create a competitive advantage.

V.

Explain that in order to keep up with the competition, organizations must design and create a safe environment in which business processes and procedures can function. This environment must maintain the confidentiality, privacy, and integrity of organizational data.

Sun Tzu and the Art of Risk Management I.

Explain how risk management is the process of identifying vulnerabilities in an organization’s information systems and taking carefully reasoned steps to ensure the confidentiality, integrity, and availability of all the components in the organization’s information system.

II.

Emphasize how risk management requires three major undertakings: risk identification, risk assessment, and risk control.

III.

Define risk identification, which is the process of examining and documenting the security posture of an organization’s information technology and the risks it faces.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

IV.

Define risk control, which is the application of controls that reduce the risks to an organization’s information systems.

Know Yourself I.

Emphasize how we must first know ourselves by identifying, examining, and understanding the information and systems currently in place.

II.

Explain how in order to protect our assets, defined here as the systems that use, store, and transmit information, we have to understand everything about the information.

III.

Note that the policies, education and training programs, and technologies that protect information must be carefully maintained and administered to ensure they remain effective.

Know the Enemy I.

Emphasize how for information security knowing the enemy means identifying, examining, and understanding the threats that most directly affect our organization and the security of our organization’s information assets.

II.

Discuss how we can use our understanding of these aspects to create a list of threats prioritized by importance to the organization.

The Risk Management Framework (4.2, PPT Slides 5–6 and 9–12) I.

Explain how to identify the risk.

II.

Explain how to determine the current level of risk (risk analysis).

III.

Discuss how to determine if the current level of risk is acceptable (risk evaluation).

IV.

Determine how to treat the risk to bring it to an acceptable level.

The Roles of the Communities of Interest I.

Explain how each community of interest must manage the risks the organization encounters.

II.

Explain how information security understands the threats and attacks that introduce risk into the organization, so they often take a leadership role.

III.

Explain how management and users play a part in the early detection and response process and ensure that sufficient resources are allocated

IV.

Explain how the information technology community assists in building secure systems and operating them safely.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

V.

Emphasize how general management, IT management, and information security management are collectively accountable for identifying and classifying all levels of risk.

VI.

Explain that the three communities of interest that are also responsible for the following: a. Evaluating current and proposed risk controls b. Determining which control options are cost effective for the organization c. Acquiring or installing the needed controls d. Ensuring that the controls remain effective

Quick Quiz 1 1. Risk identification is performed within a larger process of identifying and justifying risk controls that is called which of the following? a. risk assessment b. risk management c. risk control d. risk identification Answer: c 2. The application of controls that reduce the risks to an organization’s information assets to an acceptable level is known as which of the following? a. risk assessment b. risk management c. risk control d. risk identification Answer: c 3. For information security purposes, which of the following terms is used to describe the systems that use, store, and transmit information? a. inventory b. threats c. controls d. assets Answer: d

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

4. True or False: The information technology community of interest must assist in risk management by configuring and operating information systems in a secure fashion. Answer: True 5. True or False: The information technology community of interest must ensure sufficient resources are allocated to the risk management process. Answer: False

The RM Policy I.

Explain that the RM policy is a strategic document that formalizes much of the intent of the governance group.

II.

Explain that the RM policy must include purpose and scope, RM intent and objectives, roles and responsibilities, resource requirements, risk appetite and tolerances, RM program development guidelines, special instructions and revision information and references to other key policies, plans, standards, and guidelines.

Framework Design I.

Explain that designing the RM program means defining and specifying the details tasked to be performed by the framework team and the process team.

II.

Understand that the framework team must also formally document and define the organization’s risk appetite and draft the RM plan.

Defining the Organization’s Risk Tolerance and Risk Appetite I.

Explain that the RM Framework team needs to understand and determine residual risk.

II.

Document risk appetite.

Framework Implementation I.

Explain how the organization may distribute the plan to managers for a desk check prior to deployment.

II.

Understand that the organization could pilot-test the plan and use a phased approach to implement the plan.

III.

Understand that the RM framework team should carefully monitor, communicate, and review the implementation plan.

Framework Monitoring and Review I.

Introduce that the framework team continues to monitor the conduct of the RM process while simultaneously reviewing the success of the framework planning.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

II.

Understand that the framework team is concerned with the oversight of the RM framework and plan.

The Risk Management Process (4.3–4.5, PPT Slides 13–28 and 31–54) I.

Introduce how to establish the context, which includes understanding the organization’s internal and external operating environments and other factors that could impact the RM process.

II.

Identify the risk: a. Create an inventory of information assets b. Classify and organize assets meaningfully c. Assign a value to teach information asset d. Identify threats to the cataloged assets. e. Pinpoint vulnerable assets by tying specific threats to specific assets.

III.

Analyze the risk: a. Determining the likelihood that vulnerable systems will be attacked. b. Assessing the relative risk facing the organization’s information assets c. Calculating the risks to which assets are exposed. d. Looking at controls that might come into play for identified vulnerabilities and how to control those risks. e. Documenting and reporting the findings of risk identification and assessment.

IV.

Evaluate the risk by comparing identified uncontrolled risks against the risk appetite.

V.

Treat the unacceptable risk.

VI.

Discuss summarizing the findings and stating the conclusions of the investigation.

VII.

Explain how a risk management strategy calls on information security professionals to identify, classify, and prioritize their organizations’ information assets.

RM Process Preparation – Establishing the Context I.

Introduce the RM process as preparing for the risk process by performing the following tasks: •

Identify the purpose of the assessment.

•

Identify the scope of the assessment.

•

Identify the assumptions and constraints associated with the assessment.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

•

Identify the sources of information to be used as inputs to the assessment.

•

Identify the risk model and analytic approaches (i.e., assessment and analysis approaches) to be employed during the assessment.

External Context I.

Understand that the external context means understanding the impact the following external factors could have on the RM process, its goals, and its objectives: • • • • •

The business environment and its customers, suppliers, competitors. The legal/regulatory/compliance environment: laws, regulations, industry standards. The threat environment: threats, known vulnerabilities, attack vectors. The support environment: government agencies like NIST and DHS, professional associations like ISSA, and service agencies such as SecurityFocus. Perhaps other factors known to the subject-matter experts that make up the team.

Internal Context I.

Understand the internal factors that could impact or influence the RM process: • • • • •

The organization’s governance structure (or lack thereof). The organization’s internal stakeholders. The organization’s culture. The maturity of the organization’s information security program. The organization’s experience in policy, planning, and risk management in general.

Risk Assessment: Risk Identification I.

Understand that risk identification begins with the process of self-examination.

Identification of Information Assets I.

Describe the iterative process, which begins with the identification of assets, including all of the following elements of an organization’s system: people, procedures, data, software, hardware, and networking components.

II. Discuss the identification of people, procedures, and data assets. Identifying human resources, documentation, and data information is more difficult than identifying hardware and software assets. • As the people, procedures, and data assets are identified, they should be recorded using a reliable data-handling process. III. Explain that when deciding which information assets to track, consider the following asset attributes: •

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

People: Position name/number/ID (try to avoid names and stick to identifying positions, roles, or functions); supervisor; security clearance level; special skills • Procedures: Description; intended purpose; relationship to software, hardware, and networking elements; storage location for reference; storage location for update • Data: Classification; owner, creator, and manager; size of data structure; data structure used (sequential or relational); online or offline; location; backup procedures employed IV. Describe the identification of hardware, software, and network assets. •

•

Depending on the needs of the organization and its risk management efforts, as well as the preferences and needs of the management of the information security and information technology communities, when deciding which information assets to track, you may want to consider including these asset attributes: o

Name

o

IP address

o

MAC address

o

Element type ▪

DeviceClass = S (server)

▪

DeviceOS = W2K (Windows 2000)

▪

DeviceCapacity = AS (advanced server)

o

Serial number

o

Manufacturer’s name

o

Manufacturer’s model number or part number

o

Software version, update revision, or FCO number

o

Physical location

o

Logical location

o

Controlling entity

V. Discuss automated risk identification tools. • •

Automated tools can sometimes identify the system elements that make up the hardware, software, and network components. Once stored, typically in a database or in a form that can be exported to a database, the inventory list must be kept current by using a tool that periodically refreshes the data.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

In the later steps of risk management, which require involved calculations, the case is strong for the use of automated risk management tools for tracking information assets. At this point in the process, however, simple wordprocessing, spreadsheet, and database tools can provide adequate record keeping. VI. When discussing asset categorization, point out the several new subdivisions of risk management categorizations. •

Prioritizing (Rank-Ordering) Information Assets I.

Define data classification schemes as a formal access control methodology used to assign a level of confidentiality to an information asset, restricting the number of people who can access it.

II. Point out examples of data classification categories: confidential, internal, and public. Mention that any classification method must be specific enough to enable determination of priority levels. III. Discuss data classification and management. •

Corporate and military organizations use a variety of data classification schemes.

•

The typical information classification scheme has three categories: o

Confidential: Used for corporate information that must be tightly controlled, even within the company. Access to this information is strictly on a need-toknow basis or as required by the terms of a contract.

o

Internal: Used for internal information that does not meet the criteria for the confidential category. It is to be viewed only by corporate employees, authorized contractors, and other third parties.

o

External: This includes all information that has been approved by management for public release.

•

Many developments in data communications and information security are the result of government-sponsored research. For most information, the government uses a three-level classification scheme: Confidential, Secret, and Top Secret.

•

Federal agencies such as the FBI and CIA also use specialty classification schemes, like Need-to-Know and Named Projects.

•

Most organizations do not need the detailed level of classification used by the military or federal agencies.

IV. Describe security clearances.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

•

The other side of the data classification scheme is the personnel security clearance structure. For each user of data in the organization, a single level of authorization must be assigned that indicates the level of classification he or she is authorized to view.

•

Before an individual is allowed access to a specific set of data, he or she must meet the need-to-know standard. This extra level of protection ensures that the confidentiality of information is properly maintained.

V. Discuss the management of classified data. I.

Management of classified data includes its storage, distribution, transportation, and destruction.

II. Information that is not unclassified or public must be clearly marked as such.

Use Figure 5-5 in your explanation. III. When classified data is stored, it must be available only to authorized

individuals. IV. When an individual carries classified information, it should be transported via

inconspicuous means, such as in a locked briefcase or portfolio. V. The clean desk policy requires employees to secure all information in

appropriate storage containers at the end of each day. VI. When copies of classified information are no longer valuable or excessive copies

exist, proper care should be taken to destroy them by means of shredding, burning, or transferring to an authorized document destruction service. •

It is important to enforce policies to ensure that no classified information is disposed of in trash or recycling areas since some individuals would not hesitate to engage in dumpster diving to retrieve information that could embarrass an organization or compromise information security.

Threat Assessment I.

Identify and assess threats for individual organizations.

II. Understand how much danger a threat possesses to information assets. III. Determine how probable and severe a threat is to an organization.

The TVA Worksheet I.

Explain that the TVA worksheet serves as the starting point for the next step in the risk management process-risk assessment. Refer students to the sample TVA spreadsheet in Table 5-8 and discuss how to use the worksheet.

Risk Assessment: Risk Analysis

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

I.

Explain how we can determine the relative risk for each of the vulnerabilities through a process called risk assessment.

II. Discuss risk assessment, which assigns a risk rating or score to each information asset, which is useful in gauging the relative risk to each vulnerable information asset and making comparative ratings later in the risk control process.

Mitigation of Applicable Controls I.

Explain how mitigation is the control approach that attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.

II. Explain how mitigation begins with early detection of an attack in progress and relies on the ability of the organization to respond quickly, efficiently, and effectively. III. Discuss the three types of plans in this approach: the incident response plan (IRP), the disaster recovery plan (DRP), and the business continuity plan (BCP).

Determining the Likelihood of a Threat Event I.

Explain how after identifying and performing the preliminary classification of an organization’s information assets, the analysis phase examines the threats facing the organization.

II. Emphasize how each threat must be examined to assess its potential impact on the organization. This is referred to as a threat assessment. III. Explain how to begin a threat assessment by answering a few questions: •

Which threats present a danger to the organization’s assets in the given environment?

•

Which threats represent the most danger to the organization’s information?

•

How much would it cost to recover from a successful attack?

•

Which of these threats would require the greatest expenditure to prevent?

IV. Emphasize how answering these questions helps establish a framework for the discussion of threat assessment. An organization's guidelines and/or policies should influence this process and may require the posing of additional questions.

Assessing Potential Impact on Asset Value I.

Explain that after identification of the organization’s information assets and documentation of criteria for beginning to assess the threats it faces, review each information asset for each threat it faces and create a list of vulnerabilities.

II. Discuss vulnerabilities, which are specific avenues that threat agents can exploit to attack an information asset.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

III. Explain how a list of the organization’s assets and their vulnerabilities is created. This process works best when groups of people with diverse backgrounds within the organization work iteratively in a series of brainstorming sessions. Use Table 5-7 in your explanation. IV. Define threats-vulnerabilities-assets (TVA) worksheet as a document that shows a comparative ranking of prioritized assets against prioritized threats with an indication of any vulnerabilities in the asset/threat pairings. V. Explain that the TVA worksheet serves as the starting point for the next step in the risk management process-risk assessment. Refer students to the sample TVA spreadsheet in Table 5-8 and discuss how to use the worksheet.

Aggregation I.

Explain that organizations may use risk aggregation to roll up several discrete or lower-level risks into a more general or higher-level risk. II. Explain that organizations may also use risk aggregation to efficiently manage the scope and scale of risk assessments involving multiple information systems and multiple mission/business processes with specified relationships and dependencies among those systems and processes.

Uncertainty I.

For the purpose of relative risk determination, explain that risk equals loss frequency times loss magnitude plus an element of uncertainty. Discuss the risk calculation examples given in the text.

Risk Determination I.

For the purpose of relative risk determination, explain that risk equals loss frequency times loss magnitude plus an element of uncertainty. Discuss the risk calculation examples given in the text.

Risk Evaluation I.

Explain how for each threat and its associated vulnerabilities that have residual risk we need to create a ranking of their relative risk levels. II. Explain that when the organization’s risk appetite is less than the asset’s residual risk, it must move to the next stage of risk control and look for additional strategies to further reduce the risk. III. Explain how the goal of this process has been to identify the organization’s information assets that have specific vulnerabilities and list them, ranked according to those that most need protection. IV. Discuss how in preparing this list, we have collected and preserved a wealth of factual information about the assets, the threats they face, and the vulnerabilities

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

they expose, as well as some information about the controls that are already in place. V. Describe the final summarized document, which is the ranked vulnerability risk worksheet and contains the following data: •

Asset: Each vulnerable asset.

•

Asset relative value: Shows the results for this asset from the weighted factor analysis worksheet.

•

Vulnerability: Each uncontrolled vulnerability.

•

Loss frequency: The likelihood of the realization of the vulnerability by a threat agent, as noted in the vulnerability analysis step.

•

Loss magnitude: The figure calculated from the asset impact multiplied by loss frequency.

VI. Discuss the ranked vulnerability risk worksheet, which is the working document for the next step in the risk management process: assessing and controlling risk.

Documenting the Results of Risk Assessment I.

Discuss how the results of risk assessment activities can be delivered. There are a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment. II. Explain that when the organization is pursuing an overall risk management program, it requires a systematic report that enumerates the opportunities for controlling risk. This report documents a series of proposed controls, each of which has been justified by one or more feasibility or rationalization approaches. III. Explain how another option is to document the outcome of the control strategy for each information asset-threat pair in an action plan. This action plan includes concrete tasks, each with accountability assigned to an organizational unit or to an individual. IV. Remind students that sometimes a risk assessment is prepared for a specific IT project at the request of the project manager, either because it is required by organizational policy or because it is good project management practice. The project risk assessment should identify the sources of risk in the finished IT system with suggestions for remedial controls as well as those risks that might impede the completion of the project. V. Explain how when management requires details about a specific risk to the organization, risk assessment may be documented in a topic-specific report. These are usually demand reports that are prepared at the direction of senior management and are focused on a narrow area of information systems operational risk.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Evaluating Risk I. Discuss the process for evaluating risk. II. Explain that evaluating risk requires extensive input from the RM process team,

along with recommendations and cost estimates.

Risk Treatment/Risk Response (4.6, PPT Slides 55–60 and 63) I.

Introduce the four strategies to treat risks for assets: a. Mitigation: Applying controls and safeguards that eliminate or reduce the remaining uncontrolled risk. b. Transference: Shifting risks to other areas or to outside entities. c. Acceptance: Understanding the consequences of choosing to leave an information asset’s vulnerability facing the current level of risk but only after a formal evaluation and intentional acknowledgement of this decision. d. Termination: Removing or discontinuing the information asset from the organization’s operating environment.

Risk Mitigation I.

Explain how mitigation is the control approach that attempts to reduce the impact caused by the exploitation of vulnerability through planning and preparation.

II. Explain how mitigation begins with early detection of an attack in progress and relies on the ability of the organization to respond quickly, efficiently, and effectively. III. Discuss the three types of plans in this approach: the incident response plan (IRP), the disaster recovery plan (DRP), and the business continuity plan (BCP).

Risk Transference I.

Explain that the transfer control strategy attempts to shift the risk to other assets, other processes, or other organizations. II. Mention that this principle should be considered whenever an organization begins to expand its operations. III. Explain that if an organization does not already have quality security management and administration experience, it should hire individuals or firms that provide such expertise. IV. Point out that it is up to the owner of the information asset, IT management, and the information security team to ensure that the disaster recovery requirements of the outsourcing contract are sufficient and have been met before they are needed for recovery efforts.

Risk Acceptance © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Emphasize that the acceptance of risk is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation. This may or may not be a conscious business decision. II. Clarify how the only acceptance strategy that is recognized as valid occurs when the organization has done the following: I.

●

Determined the level of risk.

●

Assessed the probability of attack.

●

Estimated the potential damage that could occur from these attacks.

●

Performed a thorough cost-benefit analysis.

●

Evaluated controls using each appropriate type of feasibility.

●

Decided that the particular function, service, information, or asset did not justify the cost of protection.

V. Explain how if every vulnerability identified in the organization is handled by means of acceptance, it may reflect an inability to conduct proactive security activities and an apathetic approach to security in general.

Risk Termination I.

Remind students that the final risk control strategy directs the organization to avoid business activities that introduce uncontrollable risks.

Process Communications, Monitoring, and Review I. Define process communications. II. Define process monitoring and review. III. Explain that the process team needs to give continual feedback to the framework team about the relative success and challenges of its RM activities.

Mitigation and Risk I.

Explain that this form of mitigation is part of contingency planning (CP), which students will learn about in Module 5. II. Note that CP mitigation derives its value from the ability to detect, react to, respond to, and recover from incidents and disasters as quickly as possible, thus minimizing the damage to an information asset.

Managing Risk (4.6, 4.7, PPT Slides 64–70) I.

Discuss the actual and perceived advantages to implementing a control as opposed to the actual and perceived disadvantages.

II.

Discuss how a risk management process requires applying the organization’s project management principles to the risk management process.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

III.

Explain that the process will need a proper project plan with periodic deliverables, including a task list and appropriate assignments.

IV.

Explain how planned expenditures to implement a control strategy must be justified, and budget authorities must be convinced to spend the necessary amount to protect a particular asset from an identified threat.

V.

Note that another factor to consider is that each control or safeguard affects more than one asset-threat pair. Information security professionals manage a dynamic matrix covering a broad range of threats, information assets, controls, and identified vulnerabilities.

VI.

Explain how if a new safeguard is implemented, there is a risk decrease associated with all subsequent control evaluations. The action of implementing a control may change the values assigned or calculated in a prior estimate.

VII.

Emphasize how there is an ongoing search for ways to design security architectures that go beyond the direct application of specific controls in which each is justified for a specific information asset vulnerability, to safeguards that can be applied to several vulnerabilities at once.

VIII.

Discuss how the results of risk assessment activities can be delivered. There are a number of ways: a report on a systematic approach to risk control, a project-based risk assessment, or a topic-specific risk assessment.

IX.

Explain that when the organization is pursuing an overall risk management program, it requires a systematic report that enumerates the opportunities for controlling risk. This report documents a series of proposed controls, each of which has been justified by one or more feasibility or rationalization approaches.

X.

Explain how another option is to document the outcome of the control strategy for each information asset-threat pair in an action plan. This action plan includes concrete tasks, each with accountability assigned to an organizational unit or to an individual.

XI.

Remind students that sometimes a risk assessment is prepared for a specific IT project at the request of the project manager, either because it is required by organizational policy, or because it is good project management practice. The project risk assessment should identify the sources of risk in the finished IT system with suggestions for remedial controls as well as those risks that might impede the completion of the project.

XII.

Explain how when management requires details about a specific risk to the organization, risk assessment may be documented in a topic-specific report. These are usually demand reports that are prepared at the direction of senior

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

management and are focused on a narrow area of information systems operational risk.

Feasibility and Cost-Benefit Analysis I.

Discuss that before deciding on the treatment strategy for a specific TVA triple, an organization should explore all readily accessible information about the economic and noneconomic consequences of a vulnerability’s exploitation when the threat causes a loss to the asset. II. Explain that some of the techniques of cost-benefit analysis use dollar-denominated expenses and savings from economic cost avoidance while others use noneconomic feasibility criteria.

Cost I.

Discuss the factors that help to determine the cost of safeguarding information: • Cost of development or acquisition—Hardware, software, and services. • Training fees—Cost to train personnel. • Cost of implementation—Installing, configuring, and testing hardware, software, and services. • Service costs—Vendor fees for maintenance and upgrades or from outsourcing the information asset’s protection and/or insurance. • Cost of maintenance—Labor expense to verify and continually test, maintain, train, and update. • Potential cost from the loss of the asset—Either from removal of service (termination) or compromise by attack.

Benefit I.

Define benefit as the value to the organization of using controls to prevent losses associated with a specific vulnerability. II. Explain that this result is expressed as the annualized loss expectancy (ALE).

Asset Valuation I.

Discuss what needs to be considered as each asset of the organization is assigned to a category. The following questions assist in developing the weighting criteria to be used for asset valuation. These questions include the following: •

Which information asset is the most critical to the success of the organization?

•

Which information asset generates the most revenue?

•

Which of these assets plays the biggest role in generating revenue or delivering services?

•

Which information asset would be the most expensive to replace?

•

Which information asset would be the most expensive to protect?

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

•

Which information asset would most expose the company to liability or embarrassment if revealed?

II. Discuss what is necessary to calculate, estimate or derive values for information

assets; consideration might be given to the following: •

Value retained from the cost of creating the information asset.

•

Value retained from past maintenance of the information asset.

•

Value implied by the cost of replacing the information.

•

Value from providing the information.

•

Value incurred from the cost of protecting the information.

•

Value to owners.

•

Value of intellectual property.

•

Value to adversaries.

III. Note how additional company-specific criteria may add value to the asset evaluation

process and should be identified, documented, and added to the process. IV. Explain that to finalize this step the organization should assign a weight to each

asset based on their given answers. V. Discuss information asset prioritization. •

Once the process of inventorying and assessing value is complete, you can prioritize each asset using weighted factor analysis. Use Table 5-2 in your explanation.

•

In this process, each information asset is assigned a score for each critical factor. In addition, each critical factor is also assigned a weight (ranging from 1 to 100) to show that criteria’s assigned importance for the organization.

Alternative Risk Management Methodologies (4.8, PPT Slides 71–77) I.

Explain there are alternative approaches to risk management, including international and national standards and methodologies from industry-leading organizations.

The OCTAVE Methods I.

Define the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) method.

FAIR

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

I.

Explain how Factor Analysis of Information Risk (FAIR) can help organizations understand, analyze, and measure information risk.

II.

Discuss the four major stages of the FAIR methodology, which consist of 10 steps in four stages.

ISO Standards for InfoSec Risk Management I.

Discuss how the International Organization for Standardization (ISO) has standards related to information security and risk management.

NIST Risk Management Framework (RMF) I.

Investigate the National Institute of Standards and Technology (NIST) risk management framework. https://csrc.nist.gov/publications/sp.

Selecting the Best Risk Management Model I.

Determine how to select the best risk management model.

Quick Quiz 2 1. True or False: The process an organization uses to assign a risk rating or score to each information asset is a risk evaluation. Answer: False 2. The probability that a specific vulnerability within an organization will be the target of an attack is known as which of the following? a. probability b. manageability c. likelihood d. practicality Answer: c 3. Which risk control strategy attempts to reduce the impact of a successful attack through planning and preparation? a. Transference b. Defense c. Acceptance d. Mitigation Answer: d

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

23

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

4. Which risk control strategy attempts to shift residual risk to other assets, other processes, or other organizations? a. Transference b. Defense c. Acceptance d. Mitigation Answer: a 5. The calculation of the value associated with the most likely loss from an attack is called which of the following? a. ARO b. ALE c. CBA d. SLE Answer: d 6. Which of the following terms best describes comparing an organization’s efforts against practices of a similar organization or an industry-developed standard to produce results it would like to duplicate? a. baselining b. performance gap c. benchmarking d. feasibility reporting Answer: c [return to top]

Discussion Questions You can assign these questions several ways: in a discussion forum in your LMS, as wholeclass discussions in person, or as a partner or group activity in class. These questions are separate from the review questions and exercises in the textbook. For answers to the textbook questions, see the associated solutions for this module. Additional class discussion options:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

24

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

1. What is the best value that should be assessed when evaluating the worth of an information asset to the organization—replacement cost or lost income while repairing or replacing? (4.1, PPT Slides 3–6, 25, 79, and 81) Duration 15 minutes. 2. What is the likelihood value of a vulnerability that no longer must be considered? (4.6, PPT Slides 33, 35–37, 40, 42, and 46–60) Duration 15 minutes. 3. In what instances is baselining or benchmarking superior to cost benefit analysis? (4.7, PPT Slides 64–70) Duration 15 minutes. [return to top]

Suggested Usage for Lab Activities A series of hands-on labs has been developed to complement the text material for this course and are available for download at the Instructor Center. The labs do not depend on specific chapter content, so instructors can insert them where they best suit the syllabus. The following is a list of lab titles, objectives, and approximate durations to assist with lesson planning. Lab Title Ethical Considerations in IT and Detecting Phishing Attacks

Web Browser Security

Malware Defense

Objective Upon completion of this activity, you will: • have a better understanding of the ethical expectations of IT professionals; and • be able to identify several types of social engineering attacks that use phishing techniques. Upon completion of this activity, the student will be able to: • Review and configure the security and privacy settings in the most popular web browsers. Upon completion of this activity, the student will be able to: • Understand the basic setup and use of an open-source AV product. • Install and use Clam AV on a Windows system. • Using a USB storage device create a portable AV scanner. • Understand what a YARA file is and how it is used.

Duration Ethical Considerations lab in 15 to 20 minutes. Phishing E-Mail lab in 60 to 75 minutes.

1 to 1.5 hours

1 to 1.5 hours

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

25

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Windows Password Management

Backup and Recovery and File Integrity Monitoring

OS Processes and Services

Log Management & Security

Footprinting, Scanning, and Enumeration

AlienVault OSSIM

Upon completion of this activity, the student will be able to: • Review and configure password management policies in a Windows client computer. Upon completion of this activity, you will be able to: • Describe backup and recovery processes and will be aware of basic backup activities using Windows 10 or another desktop operating system (OS). • Perform file integrity monitoring using file hash values. Upon completion of this activity, the student will be able to: • Review available and enabled OS services. • Review available and enabled OS processes. • Review current system resource utilization. Upon completion of this activity, the student will be able to: • Access and review the various logs present in a Windows 10 computer. Upon completion of this activity, the student will be able to: • Identify network addresses associated with an organization. • Identify the systems associated with the network addresses. Upon completion of this activity, the student will be much more knowledgeable about the AlienVault OSSIM software and how to install, configure, and operate it. You will use the software more extensively in a subsequent lab.

30 minutes to 1 hour

15–20 minutes

60–90 minutes

30 minutes to 1 hour

40–60 minutes

2–3 hours

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

26

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Image Analysis Using Autopsy

Upon completion of this activity, the student will be able to perform basic drive image analysis using the Autopsy software package.

45–70 minutes

[return to top]

Additional Activities and Assignments Please see associated solutions for the Closing Scenario at the end of the textbook module. Additional project options include: 1. Have students review the information assets in a campus departmental office and estimate the value of each asset. 2. Have students list the hardware assets found in a computing lab and then list the attributes of those assets. They should provide as many facts about each asset as possible. 3. Provide your students with a list of information security controls. Have them classify them as preventive or detective. [return to top]

Additional Resources Cengage Video Resources • •

MindTap Video: Risk Assessment MindTap Video: Risk Control

Internet Resources • • • •

Cultivating a Risk Intelligent Culture Creating a Culture of Risk Avoidance Effective IT Risk Management An Introduction to Cost Benefit Analysis

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

27

Instructor Manual: Whitman and Mattord, Principles of Information Security 7e, ISBN 978-0-357-50643-1; Module 4: Risk Management

Appendix Grading Rubrics Providing students with rubrics helps them understand expectations and components of assignments. Rubrics help students become more aware of their learning process and progress, and they improve students’ work through timely and detailed feedback. Customize these rubrics as you wish. The grading rubric suggests a 4-point scale and the discussion rubric indicates 30 points. Grading Rubric These grading criteria can be applied to open-ended Review Questions, Real-World Exercises, Case Studies, and Security for Life activities 3 2 1 0 Exceeds Expectations Meets Expectations Needs Improvement Inadequate • Student • Student • Student’s • Student’s response demonstrates demonstrates response is missing or accurate accurate demonstrates a incomplete. understanding of understanding of gap in • Student’s response the concept. the concept. understanding of demonstrates a • Student applies the • Student applies the concept. critical gap in concept the concept • Student applies understanding. appropriately. appropriately. the concept • Student is unable • Student uses • Student develops incorrectly. to apply the sound critical a complete • Student’s concept. analysis to develop response to the response is poorly an insightful and prompt. developed or comprehensive incomplete. response to the prompt. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

28

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Instructor Manual Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 2 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 8 Module Outline .............................................................................................................................. 8 Discussion Questions .................................................................................................................. 42 Suggested Usage for Lab Activities ............................................................................................ 43 Additional Activities and Assignments ....................................................................................... 45 Additional Resources................................................................................................................... 45 Cengage Video Resources ....................................................................................................................... 45 Internet Resources .................................................................................................................................. 45 Appendix ...................................................................................................................................... 47 Grading Rubrics ....................................................................................................................................... 47

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Purpose and Perspective of the Module Interruptions within an organization are bound to happen. The question is when and what can be done to mitigate the damage it causes. Within this module, students will gain an understanding of the purpose and need for contingency planning. Alternately, this is referred to as disaster recovery and business continuity planning. Incident responses are an additional major theme here, as the authors comprehensively provide the components of them and processes used in digital forensics to determine why these events occurred. Toward the conclusion of this module, a discussion is held on how the organization would prepare and execute a test of contingency plans. This is essential to ensure that they work in the event something was to happen.

Cengage Supplements The following product-level supplements provide additional information that may help you in preparing your course. They are available in the Instructor Resource Center. •

PowerPoint slides

•

Test banks, available in Word, as LMS-ready files, and on the Cognero platform

•

MindTap Educator Guide

•

Solution and Answer Guide

•

This instructor’s manual

Module Objectives The following objectives are addressed in this module: 5.1

Discuss the need for contingency planning.

5.2

Describe the major components of incident response, disaster recovery, and business continuity.

5.3

Identify the processes used in digital forensics investigations.

5.4

Define the components of crisis management.

5.5

Discuss how the organization would prepare and execute a test of contingency plans.

Complete List of Module Activities and Assessments For additional guidance, refer to the MindTap Educator Guide. Module Objective 5.1

PPT slide

Activity/Assessment

Duration

6–7

Knowledge Check Activity 1

2 minutes

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

5.2 5.3–5.4 5.4–5.5 5.1–5.5

47–48 79–80 92–93 103 MindTap MindTap MindTap

Knowledge Check Activity 2 Knowledge Check Activity 3 Knowledge Check Activity 4 Self-Assessment Module 05 Review Questions Module 05 Case Exercises Module 05 Exercises

MindTap MindTap

Module 05 Security for Life Module 05 Quiz

2 minutes 2 minutes 2 minutes 5 minutes 30–40 minutes 30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: adverse event: An event with negative consequences that could threaten the organization’s information assets or operations; also referred to as an incident candidate. contingency planning (CP): The actions taken by senior management to specify the organization’s efforts and actions if an adverse event becomes an incident or disaster; CP typically includes incident response, disaster recovery, and business continuity efforts, as well as preparatory business impact analysis. contingency planning management team (CPMT): The group of senior managers and project members organized to conduct and lead all CP efforts. incident response planning team (IRPT): The team responsible for designing and managing the IR plan by specifying the organization’s preparation, reaction, and recovery from incidents. disaster recovery planning team (DRPT): The team responsible for designing and managing the DR plan by specifying the organization’s preparation, response, and recovery from disasters, including reestablishment of business operations at the primary site after the disaster. business continuity planning team (BCPT): The team responsible for designing and managing the BC plan of relocating the organization and establishing primary operations at an alternate site until the disaster recovery planning team can recover the primary site or establish a new location. crisis management planning team (CMPT): The individuals from various functional areas of the organization assigned to develop and implement the CM plan.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

business impact analysis (BIA): An investigation and assessment of adverse events that can affect the organization, conducted as a preliminary phase of the contingency planning process; it includes a determination of how critical a system or set of information is to the organization’s core processes and its recovery priorities. business process: A task performed by an organization or one of its units in support of the organization’s overall mission and operations. recovery time objective (RTO): The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported business processes, and the maximum tolerable downtime. recovery point objective (RPO): The point in time before a disruption or system outage to which business process data can be recovered after an outage, given the most recent backup copy of the data. maximum tolerable downtime (MTD): The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption. The MTD includes all impact considerations. work recovery time (WRT): The amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered. This recovery time is identified by the RTO. incident response (IR): An organization’s set of planning and preparation efforts for detecting, reacting to, and recovering from an incident. incident response planning (IRP): The actions taken by senior management to develop and implement the IR policy, plan, and computer security incident response team. incident candidate: See adverse event. incident: An adverse event that could result in a loss of information assets but does not threaten the viability of the entire organization. incident response plan (IRP): The documented product of incident response planning; a plan that shows the organization’s intended efforts in the event of an incident. computer security incident response team (CSIRT): An IR team composed of technical IT, managerial IT, and InfoSec professionals who are prepared to detect, react to, and recover from an incident; may include members of the IRPT. IR policy: The policy document that guides the development and implementation of IR plans and the formulation and performance of IR teams. IR procedures: Detailed, step-by-step methods of preparing, detecting, reacting to, and recovering from an incident.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

electronic vaulting: A backup strategy that transfers data in bulk batches to an off-site facility. remote journaling: A backup strategy that transfers only transaction data in near real time to an off-site facility. database shadowing: A backup strategy that transfers duplicate online transaction data and duplicate databases to a remote site on a redundant server combining electronic vaulting with remote journaling by writing multiple copies of the database simultaneously to two locations. 3-2-1 backup rule: A backup strategy that recommends the creation of at least three copies of critical data (the original and two copies) on at least two different media, with at least one copy stored off-site. incident classification: The process of examining an adverse event or incident candidate and determining whether it constitutes an actual incident. incident detection: The identification and classification of an adverse event as an incident, accompanied by the notification of the CSIRT and the activation of the IR reaction phase. alert roster: A document that contains contact information for personnel to be notified in the event of an incident or disaster. alert message: A description of the incident or disaster that usually contains just enough information so that each person knows what portion of the IR or DR plan to implement without slowing down the notification process. after-action review (AAR): A detailed examination and discussion of the events that occurred during an incident or disaster, from first detection to final recovery. protect and forget: The organizational CP philosophy that focuses on the defense of information assets and preventing reoccurrence rather than the attacker’s identification and prosecution; also known as “patch and proceed.” apprehend and prosecute: The organizational CP philosophy that focuses on an attacker’s identification and prosecution, the defense of information assets, and preventing reoccurrence; also known as “pursue and punish.” digital forensics: Investigations that involve the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and root cause analysis, following clear, well-defined methodologies. forensics: The coherent application of methodical investigatory techniques to present evidence of crimes in a court or similar setting. evidentiary material (EM): Any information that could potentially support an organization’s legal or policy-based case against a suspect; also known as items of potential evidentiary value. © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

digital malfeasance: A crime involving digital media, computer technology, or related components. root cause analysis: The determination of the source or origin of an event, problem, or issue like an incident. affidavit: Sworn testimony that certain facts are in the possession of an investigating officer and that they warrant the examination of specific items located at a specific place; the affidavit specifies the facts, the items, and the place. search warrant: Permission to search for evidentiary material at a specified location or to seize items to return to an investigator’s lab for examination. chain of evidence: The detailed documentation of the collection, storage, transfer, and ownership of evidentiary material from the crime scene through its presentation in court and its eventual disposition. chain of custody: See chain of evidence. disaster recovery (DR): An organization’s set of planning and preparation efforts for detecting, reacting to, and recovering from a disaster. disaster recovery planning (DRP): The actions taken by senior management to develop and implement the DR policy, plan, and recovery teams. disaster recovery plan (DR plan): The documented product of disaster recovery planning; a plan that shows the organization’s intended efforts in the event of a disaster. DR policy: The policy document that guides the development and implementation of DR plans and the formulation and performance of DR teams. disaster classification: The process of examining an adverse event or incident and determining whether it constitutes an actual disaster. slow-onset disasters: Disasters that occur over time and gradually degrade the capacity of an organization to withstand their effects. rapid-onset disasters: Disasters that occur suddenly, with little warning, taking people’s lives and destroying the means of production. business continuity (BC): An organization’s set of efforts to ensure its long-term viability when a disaster precludes normal operations at the primary site; typically includes temporarily establishing critical operations at an alternate site until operations can be resumed at the primary site or a new permanent site. business continuity planning (BCP): The actions taken by senior management to develop and implement the BC policy, plan, and continuity teams.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

BC plan: The documented product of business continuity planning; a plan that shows the organization’s intended efforts to continue critical functions when operations at the primary site are not feasible. BC policy: The policy document that guides the development and implementation of BC plans and the formulation and performance of BC teams. business resumption planning (BRP): The actions taken by senior management to develop and implement a combined DR and BC policy, plan, and set of recovery teams. hot site: A fully configured BC facility that includes all computing services, communications links, and physical plant operations. warm site: A BC facility that provides many of the same services and options as a hot site, but typically without installed and configured software applications. cold site: A BC facility that provides only rudimentary services, with no computer hardware or peripherals. timeshare: A continuity strategy in which an organization co-leases facilities with a business partner or sister organization, which allows the organization to have a BC option while reducing its overall costs. service bureau: A BC strategy in which an organization contracts with a service agency to provide a facility for a fee. mutual agreement: A BC strategy in which two organizations sign a contract to assist the other in a disaster by providing BC facilities, resources, and services until the organization in need can recover from the disaster. rolling mobile site: A BC strategy that involves contracting with an organization to provide specialized facilities configured in the payload area of a tractor-trailer. crisis management (CM): An organization’s set of planning and preparation efforts for dealing with potential human injury, emotional trauma, or loss of life as a result of a disaster. crisis management policy (CM policy): The policy document that guides the development and implementation of CM plans and the formulation and performance of CM teams. crisis management plan (CM plan): The documented product of crisis management planning; a plan that shows the organization’s intended efforts to protect its personnel and respond to safety threats. crisis management planning (CMP): The actions taken by senior management to develop and implement the CM policy, plan, and response teams.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

desk check: The CP testing strategy in which copies of the appropriate plans are distributed to all individuals who will be assigned roles during an actual incident or disaster; each individual reviews the plan and validates its components. structured walk-through: The CP testing strategy in which all involved individuals walk through a site and discuss the steps they would take during an actual CP event; can also be conducted as a conference room talk-through. talk-through: A form of structured walk-through in which individuals meet in a conference room and discuss a CP plan rather than walking around the organization. simulation: The CP testing strategy in which the organization conducts a role-playing exercise as if an actual incident or disaster had occurred. The CP team is presented with a scenario in which all members must specify how they would react and communicate their efforts. full-interruption testing: The CP testing strategy in which all team members follow each IR/DR/BC procedure, including those for interruption of service, restoration of data from backups, and notification of appropriate individuals. [return to top]

What's New in This Module The following elements are improvements in this module from the previous edition: •

This module was not present in the 6th edition.

•

The contingency planning content that was previously found in Chapter 4 was expanded and enhanced to include incident response technologies, SOCs, CSIRTs, and response strategies.

•

The content on digital forensics was pulled from Chapter 12 and placed into the context of incident response.

[return to top]

Module Outline Introduction to Incident Response and Contingent Planning (5.1, PPT Slide 3) I.

Emphasize that the purpose of this module focuses on plants that are made for adverse events and when the technologies an organization uses are disrupted, and business comes to a halt.

II.

Stress that often the information technology (IT) and information security (InfoSec) communities assess the entire technological infrastructure of the organization using

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

the mission statement and current organizational objectives to drive their planning activities. Emphasize that they must be sanctioned and actively support the general business community of interest. III.

Direct learners to reference the National Institute of Standards and Technology (NIST) Special Publication 800-34, which is a contingency planning guide for federal information systems. Although this is for a government entity, the information included in it applies to a number of topics discussed in the module.

IV.

Present the fact that organizations of every size and purpose should also prepare for the unexpected. Note that incidents or disasters happen in several ways and can be over time or suddenly with no notice.

V.

Emphasize strongly that the development of a plan for handling unexpected events must be a high priority for all managers. Note that key members of the organization must be factored in as not present should an issue or emergency occur for maximum benefit.

VI.

Compare to past efforts that there is a growing interest and emphasis on comprehensive and robust planning for adverse circumstances. Apply that sound risk management practices are essential for an organization to be ready for anything that may come their way operationally.

Fundamentals of Contingency Planning (5.2, PPT Slide 4–28) I.

Define the terms of adverse events and contingency planning (CP) and how the IT and InfoSec communities of interest position themselves to prepare, defend, detect, react, and recover from events that threaten the security of resources and assets. The assets mentioned not only include information but people and capital assets as well.

II.

Outline the four components of a CP:

III.

•

Business impact analysis (BIA)

•

Incident response plan (IR plan)

•

Disaster recovery plan (DR plan)

•

Business continuity plan (BC plan)

Recall that the BIA is a preparatory activity common to both CP and risk management, as this was covered in the fourth module of the course. This also assists an organization to determine which business functions and information systems are the most critical to the success of the organization.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

IV.

Clarify that the most likely individuals that are responsible for contingency planning are the chief information officer (CIO), system administrations, the chief information security officer (CISO), and key IT and business managers.

V.

Review and develop the foundation of a contingency planning management team (CMPT) and their CP document as recommended by the NIST. Remember that effective CP begins with effective policies. The following steps are mandatory to follow to have a solid plan, as provided in the text:

VI.

•

Develop the CP policy statement: A formal policy provides the authority and guidance necessary to develop an effective contingency plan.

•

Conduct the BIA: The BIA helps identify and prioritize information systems and components critical to supporting the organization’s mission/business processes. A template for developing the BIA is provided to assist the user.

•

Identify preventive controls: Measures taken to reduce the effects of system disruptions can increase system availability and reduce contingency life cycle costs.

•

Create contingency strategies: Thorough recovery strategies ensure that the system may be recovered quickly and effectively following a disruption.

•

Develop a contingency plan: The contingency plan should contain detailed guidance and procedures for restoring damaged organizational facilities unique to each business unit’s impact level and recovery requirements.

•

Ensure plan testing, training, and exercises: Testing validates recovery capabilities, whereas training prepares recovery personnel for plan activation, and exercising the plan identifies planning gaps; when combined, the activities improve plan effectiveness and overall organization preparedness.

•

Ensure plan maintenance: The plan should be a living document that is updated regularly to remain current with system enhancements and organizational changes.

Examine and explain the recommended sections that a CP policy should contain as recommended by the NIST and its Special Publication (SP) 800-34: •

An introductory statement of philosophical perspective by senior management as to the importance of CP to the strategic, long-term operations of the organization

•

A statement of the scope and purpose of the CP operations, stipulating the requirement to cover all critical business functions and activities

•

A call for periodic (e.g., yearly) risk assessment and BIA by the CPMT, to include identification and prioritization of critical business functions (while the need for

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

such studies is well understood by the CPMT, the formal inclusion in policy reinforces that need to the rest of the organization)

VII.

•

A description of the major components of the CP to be designed by the CPMT, as described earlier

•

A call for, and guidance in, the selection of recovery options and continuity strategies

•

A requirement to test the various plans on a regular basis (e.g., annually, semiannually, or more often as needed)

•

Identification of key regulations and standards that impact CP and a brief overview of their relevance

•

Identification of key individuals responsible for CP operations, such as establishment of the chief operations officer (COO) as CPMT lead, the CISO as IR team lead, the manager of business operations as DR team lead, the manager of information systems and services as BC team lead, and legal counsel as crisis management team lead

•

An appeal to the individual members of the organization, asking for their support and reinforcing their importance as part of the overall CP process

•

Additional administrative information, including the original date of the document, revision dates, and a schedule for periodic review and maintenance

Recall that the CPMT collects information about the organization and the threats it faces internally and externally. However, in order to plan for incident responses, disasters and their recoveries, and business continuity, list the personnel that should be on these teams for maximum effectiveness and application of the plans created: •

Champion: As with any strategic function, the CP project must have a high-level manager to support, promote, and endorse the findings of the project. This champion could be the chief operation officer (COO) or (ideally) the CEO/president.

•

Project manager: A champion provides the strategic vision and the linkage to the power structure of the organization but does not manage the project. A project manager—possibly a mid-level operations manager or even the CISO— leads the project, putting in place a sound project planning process, guiding the development of a complete and useful project, and prudently managing resources.

•

Team members: The team members should be the managers or their representatives from the various communities of interest: business, IT, and

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

InfoSec. Business managers supply details of their activities and insight into functions that are critical to running the business. IT managers supply information about the at-risk systems used in the development of the BIA and the IR, DR, and BC plans. Some select team member departments that should be involved include: i.

Corporate communications department/public relations

ii.

Legal affairs and/or attorneys

iii.

Supplemental teams from the incident response planning team (IRPT), disaster recovery planning team (DRPT), business continuity planning team, (BCPT), and the crisis management planning team (CMPT)

VIII.

Comment that larger organizations often have distinct groups with little or no overlap, whereas by contrast, smaller businesses often have persons who are responsible for multiple duties on the aforementioned teams above. This can create a major obstacle or challenge if something were to occur.

IX.

Strongly emphasize to students that contingency plans often get little attention or a high priority and, in most cases, don’t address it at all.

Components of Contingency Planning I.

Guide students to review Figures 5-1 and 5-2 in the textbook for a visual aid of contingency planning hierarchies and a contingency planning life cycle.

II.

Recognize that the authors provide extensive detail on how to determine which plan is best suited for the identification, containment, and resolution of an unexpected event throughout the module.

Business Impact Analysis I.

Define the purpose of the business impact analysis (BIA). Stress that this document is the first major component of the CP process and what it is intended for. As mentioned in the text, it serves as an investigation and assessment of the impact that various adverse events can have on the organization.

II.

Compare and contrast the difference between risk management and a BIA. A BIA specifically assumes that controls that are in place have been bypassed or failed or were ineffective to stop the attack from occurring. Critique the approach stating that it is best to assume the worst to be able to recover quickly back to normal operation.

III.

Assemble the considerations that should be included in the BIA document, as provided in the text. These are the following:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

IV.

•

Scope: Carefully consider which parts of the organization to include in the BIA; determine which business units to cover, which systems to include, and the nature of the risk being evaluated.

•

Plan: The needed data will likely be voluminous and complex, so work from a careful plan to ensure that the proper data is collected to enable a comprehensive analysis. Getting the correct information to address the needs of decision makers is important.

•

Balance: Weigh the information available; some information may be objective in nature, while other information may only be available as subjective or anecdotal references. Facts should be weighted properly against opinions; however, sometimes the knowledge and experience of key personnel can be invaluable.

•

Objective: Identify in advance what the key decision makers require for making choices. Structure the BIA to bring them the information they need and to facilitate consideration of those choices.

•

Follow-up: Communicate periodically to ensure that process owners and decision makers will support the process and result of the BIA.

Order and present the three stages that the NIST SP 800-34, Rev. 1, recommend that should be in a BIA: •

Determine mission/business processes and recovery criticality.

•

Identify resource requirements.

•

Identify recovery priorities for system resources.

Determine Mission/Business Processes and Recovery Critically I.

State that the first major BIA task that should be developed is the analysis and prioritization of businesses processes that are in an organization. These should be based on their relationship with the mission of the firm.

II.

Clarify that the term mission or business process is strictly talking about business processes that occur in an organization. Relate the understanding that the NIST uses the terms interchangeably and may cause unnecessary confusion.

III.

Describe to students when information is being gathered, collecting critical information about each business unit before prioritizing functions that must be sustained is a mandatory starting point.

IV.

Recommend the use of a weighted table analysis (WTA) as provided in Table 5-1, which can resolve issues of which business function(s) are the most critical. This likely provides the most accurate assessment of what is critical and what is not as important but essential to the organization’s operations.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

V.

VI.

Align students to the recommendation from the NIST about using simple qualitative categories for recovery criticality. They include: •

Low impact

•

Moderate impact

•

High impact

Review the four terms provided within the section with respect to how much of an asset is needed to recover and the time it takes to do that. These are the following: •

recovery time objective (RTO): The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources, supported business processes, and the maximum tolerable downtime.

•

recovery point objective (RPO): The point in time before a disruption or system outage to which business process data can be recovered after an outage, given the most recent backup copy of the data.

•

maximum tolerable downtime (MTD): The total amount of time the system owner or authorizing official is willing to accept for a business process outage or disruption. The MTD includes all impact considerations.

•

work recovery time (WRT): The amount of effort (expressed as elapsed time) needed to make business functions work again after the technology element is recovered. This recovery time is identified by the RTO.

VII.

Stress that there are often situations where nontechnical tasks are required in order for an organization to make information assets usable again for applicable business functions.

VIII.

Express concerns as aligned with the NIST that failing to determine MTD “could leave contingency planners with imprecise direction on (1) selection of an appropriate recovery method and (2) the depth of detail that will be required when developing recovery procedures, including their scope and content.”

IX.

Disseminate Figure 5-5 and provide guidance to learners that the cost balance point provides an optimal point between disruption and recovery costs. Note that this cost will greatly vary from one organization to another.

X.

Establish the knowledge that as the CPMT executes the BIA, they will have asset priorities and relative values for mission and/or business processes.

XI.

Consequentially, critique the fact to students that the presence of high-value information assets may influence the valuation of a particular business process. In any event, once the business processes have been prioritized, the organization should identify, classify, and prioritize the information assets both across the

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

organization and within each business process, placing classification labels on each collection or repository of information to better understand its value and to prioritize its protection.

Identify Recovery Resource Requirements I.

State that once the organization has the list of mission/business processes in place, it will need to recover those processes and the assets that are critical to them.

II.

Review Table 5-2 and walk students through the process of identifying the business process or mission, the required resource components, additional resources that may be needed, and a description of what it would take to get it up and running, as well as estimated costs.

Identify System Resource Recovery Priorities I.

Recall that the final step of the BIA is to prioritize the resources associated with the mission/business processes. This is best done to determine what needs to be recovered first, even with the most critical processes at hand.

II.

Relate that multiple weighted tables can and may need to be created so that the resources can be properly or fairly allocated. This can also assign values to each resource more accurately.

III.

Establish that persons who oversee the team should not get so bogged down in the process that you lose sight of the objective.

Contingency Planning Policies I.

Identify that the CP team should work to develop the policy environment that will enable the BIA process and should provide specific policy guidance toward authoring the creation of each of the planning components (IR, DR, and BC) before documents are created.

II.

Describe the nature of documents that are developed. Here each of the documents that are part of the CP must include a policy that is similar in structure to all other policies used in the organization.

Incident Response (5.2, PPT Slides 29–59) I.

Define what an incident response is and how it is similar or different to an adverse event.

II.

Express concern that incident responses depend on the quick, efficient, and timely containment of an issue that occurs and the resolution of it.

III.

Summarize the purpose of incident response planning (IR plan) and who is primarily responsible for carrying these out, which is often senior management.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

IV.

Describe when an IR plan is activated and give an example or two of simple situations when that would happen. In truth, it is any incident regardless of how minor or major the effect it.

Getting Started I.

Correlate the process mentioned earlier in the module that the CPMT is responsible for creating the IRPT. This team then is tasked with creating the computer security incident response team (CSIRT).

II.

Display and discuss the NIST incident response life cycle as outlined in Figure 5-6. The following steps are included in this process: •

Preparation

•

Detection and analysis

•

Containment eradication and recovery

•

Post-incident activity

Note that detection and analysis as well as the containment eradication and recovery steps are cyclical and can happen multiple times in the life cycle. III.

Translate the NIST Cybersecurity Framework in Figure 5-7. Detail the five stages that are part of this framework: •

Identify: Relates to risk management and governance

•

Protect: Relates to implementation of effective security controls (policy, education, training and awareness, and technology)

•

Detect: Relates to the identification of adverse events

•

Respond: Relates to reacting to an incident

•

Recover: Relates to putting things “as they were before” the incident

Mention to students that the third, fourth, and fifth steps apply to the NIST’s IR strategy in SP 800-61.

Incident Response Policy I.

Present the purpose of the IR policy as a document that provides guidance for developing and implementing IR plans and the formulation and performance of incident response teams.

II.

Analyze the core components of the IR policy as denoted in NIST’s SP 800-61, Rev. 2: •

Statement of management commitment

•

Purpose and objectives of the policy

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

III.

•

Scope of the policy (to whom and what it applies and under what circumstances)

•

Definition of InfoSec incidents and related terms

•

Organizational structure and definition of roles, responsibilities, and levels of authority; should include the authority of the incident response team to confiscate or disconnect equipment and to monitor suspicious activity, the requirements for reporting certain types of incidents, the requirements and guidelines for external communications and information sharing (e.g., what can be shared with whom, when, and over what channels), and the handoff and escalation points in the incident management process

•

Prioritization or severity ratings of incident

•

Performance measures

•

Reporting and contact forms

Identify that top management must fully be on board and clearly understand the policies being created, as changes to IT infrastructure may be required to prevent or mitigate incidents.

Incident Response Planning I.

Interpret the three characteristics that an InfoSec incident must have in order to be considered a threat (credible or not): •

It is directed against information assets.

•

It has a realistic chance of success.

•

It threatens the confidentiality, integrity, or availability of information resources and assets.

II.

Recognize that IR is a reactive measure and not a preventive one.

III.

Identify the core organization personnel who is responsible for IR planning. These are commonly the CIO, the CISO, or an IT manager with security responsibilities. Other managers may be involved but are likely to be members from the community of interests in the organization.

IV.

Stress that not only the roles of responsibilities of people on the team are clearly defined but also the plan must include an alert roster. This is important because these are the go-tos who must be contacted when an incident occurs.

V.

Outline the following elements an IR plan must include. This is like the CP process but with a few adjustments: •

Mission

•

Strategies and goals

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

VI.

•

Senior management approval

•

Organizational approach to incident response

•

How the incident response team will communicate with the rest of the organization and with other organizations

•

Metrics for measuring incident response capability and its effectiveness

•

Roadmap for maturing incident response capability

•

How the program fits into the overall organization

Detail the three sets of incident handling procedures that are classified in tandem as IR procedures: •

During the incident: The planners develop and document the procedures that must be performed during the incident. These procedures are grouped and assigned to individuals. Systems administrators’ tasks differ from managerial tasks, so members of the planning committee must draft a set of functionspecific procedures.

•

After the incident: Once the procedures for handling an incident are drafted, the planners develop and document the procedures that must be performed immediately after the incident has ceased. Again, separate functional areas may develop different procedures.

•

Before the incident: The planners draft a third set of procedures: those tasks that must be performed to prepare for the incident, including actions that could mitigate any damage from the incident. These procedures include details of the data backup schedules, disaster recovery preparation, training schedules, testing plans, copies of service agreements, and BC plans, if any. At this level, the BC plan could consist just of additional material about a service bureau that stores data off-site via electronic vaulting, with an agreement to provide office space and lease equipment as needed.

VII.

Propose to students that an incident and the responses that are required to mitigate it must be a product of the comprehensive understanding of the information systems and the threats the organization faces.

VIII.

Establish the responsibilities of the CSIRT team with respect to incidents. •

They are the required group that executes the IR plan.

•

Persons that are part of this team must be available when an incident is detected or a suspicious one is detected. Regardless of the severity, everyone on the team has a specific role to perform to squash the threat as quickly as possible with minimal damage to the organization.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

• IX.

Decisions are made as a team, as their success is dependent on their participation and cooperation with others.

Recall the three phases of incident response actions: •

Detection: Recognition that an incident is under way

•

Reaction: Responding to the incident in a predetermined fashion to contain and mitigate its potential damage (the new NIST CSF refers to this stage as “Respond” in its Detect, Respond, Recover approach)

•

Recovery: Returning all systems and data to their state before the incident. Table 5-3 provides a sample incident handling checklist from NIST SP 800-61, Rev 2.

Data Protection in Preparation in Incidents I.

II.

Detail the four options that organizations can use to get operations back up and running in a timely manner: •

Traditional data backups: The organization can use a combination of on-site and off-site tape-drive, hard-drive, and cloud backup methods, in a variety of rotation schemes; because the backup point is sometime in the past, recent data is potentially lost. Most common data backup schemes involve a redundant array of independent disks (RAID) or disk-to-disk-to-cloud methods.

•

Electronic vaulting: The organization can employ bulk batch transfer of data to an off-site facility, usually via leased lines or secure Internet connections.

•

Remote journaling: The organization can transfer live transactions to an off-site facility. Remote journaling differs from electronic vaulting in two ways: (1) Only transactions are transferred, not archived data, and (2) the transfer takes place online and in much closer to real time. While electronic vaulting is akin to a traditional backup, with a dump of data to the off-site storage, remote journaling involves online activities on a systems level, much like server fault tolerance, where data is written to two locations simultaneously.

•

Database shadowing: The organization can store duplicate online transaction data, along with duplicate databases, at the remote site on a redundant server; database shadowing combines electronic vaulting with remote journaling by writing multiple copies of the database simultaneously to two separate locations.

Explain the 3-2-1 backup rule and why it is important for organizations to apply this method to their data backup plan (or rhythm).

Detecting Incidents

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

I.

Summarize the practice of incident classification and why it is important for an IR plan to have this included to determine the severity of threats that may occur.

II.

Recall that incidents are the responsibility of the CSIRT except for an organization having a security operations center (SOC).

III.

Review the first step in the IR process, which is to detect the incident (termed as incident detection in the text).

IV.

Relate that Donald Pipkin identified three categories of incident indicators: possible, probable, and definite.

Possible Indicators I.

II.

Outline indicators that may warrant an incident to be investigated but may be common within an organization depending on one’s interpretation: •

Presence of unfamiliar files

•

Presence or execution of unknown programs or processes

•

Unusual consumption of computing resources

•

Unusual system crashes

Give examples of each of the possible indicators outlined in the text to enhance the meeting and purpose of each one in a real-world environment.

Probable Indicators I.

Compare and contrast probable indicators to possible indicators and explain how they are different from one another.

II.

Review the list of incident candidates as outlined in the text that are considered probable indicators of actual incidents:

III.

•

Activities at unexpected times

•

Presence of new accounts

•

Reported attacks

•

Notification from an intrusion detection and prevention system (IDPS)

Summarize that probable indicators have a greater chance of an incident result but still require some investigation prior to that conclusion being made.

Definite Indicators I.

Stress that definite indicators are incident candidates of something that is happening or has happened. Better put, they are clear signals.

II.

Establish an understanding that the IR plan must be activated immediately in a situation like this, and the CSIRT must act.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

III.

Review the list of incident candidates that are red flags and are considered definite indicators of an actual incident: •

Use of dormant accounts

•

Changes to logs

•

Presence of hacker tools (both physical and digital)

•

Notifications by a partner or peer

•

Notifications by a hacker

Probable Incident Results I.

Focus students’ attention that regardless of whether an incident indicator was possible, probable, or definite, action still must be taken because consequences can still result that could be detrimental for an organization.

II.

Review the five most likely outcomes that an incident can cause. Whether it is a credible threat or a system having issues, these can all result: •

Loss of availability: Information or information systems become unavailable.

•

Loss of integrity: Users report corrupt data files, garbage where data should be, or data that just looks wrong.

•

Loss of confidentiality: There is a notification of a sensitive information leak, or information that was thought to be protected has been disclosed.

•

Violation of policy: There is a violation of organizational policies addressing information or InfoSec.

•

Violation of law or regulation: The law has been broken, and the organization’s information assets are involved.

Reacting to Incidents I.

Recall that once an incident has been confirmed and classified properly, the IR plan moves into the detection phase.

II.

Summarize the action steps for reacting to incidents. They include: •

Notifying key personnel

•

Documenting the incident(s)

•

Strategizing an incident containment plan to minimize impact to the organization

•

Escalating the incident, if applicable

Notification of Key Personnel

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

I.

Emphasize the use of an alert roster as the first line of defense and step that is taken once a CSIRT determines that an incident is in progress.

II.

Examine the two ways an alert roster is activated: •

Sequentially: This option requires that a designated contact person initiate contact with each person on the roster using the identified method.

•

Hierarchical: The alternate option is where the roster requires a specific number of people to be contacted who, in turn, do the same thing, and so on until all are notified.

III.

Compare and contrast the advantages and disadvantages of sequentially or hierarchically contacting people within the CSIRT when an incident is in progress.

IV.

Detail the purpose of an alert message and why it is important to broadcast to persons within the CSIRT so the incident can be dealt with quickly and efficiently. Note that other departments such as general management, legal, communications, and human resources are notified prior to external sources using this method.

V.

Report that other organizations may be required to be notified should the incident be part of a larger-scale assault, or it may affect them as a result.

Documenting an Incident I.

Emphasize that once an incident has been confirmed, the team should begin to document it.

II.

Detail that the who, what, when, where, why, and how of each action that is taken should be noted while the incident is ongoing and up until it has concluded.

III.

Note that legally, the standards of due care may offer some protection to the organization if an incident adversely affects individuals inside and outside the organization, or if it affects other organizations that use the target organization’s systems.

Incident Containment Strategies I.

Conclude that the most critical component of an IR plan is to stop the incident and contain the sco0pe and/or impact to the organization. With time being of the essence, detailed analyses here are not the best use of resources as it may prolong the attack and its result.

II.

Propose the following containment strategies that were provided in the text that the CSIRT can execute to slow or stop an incident in progress: •

Disabling compromised user accounts

•

Reconfiguring a firewall to block the problem traffic

•

Temporarily disabling compromised processes or services

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

III.

•

Taking down the conduit application or server—for example, the e-mail server

•

Disconnecting affected networks or network segments

•

Stopping (powering down) all computers and network devices

Justify that the last strategy outlined above is a last-ditch effort to preserve data stored on computers so that operations can resume normally once the incident has concluded.

Incident Escalation I.

Recall that one of the challenges of the CSIRT is determining when an incident requires escalation up to a disaster or when to transfer it to an outside authority to handle. This may be to authorities or another public response unit.

II.

Give an example of when an incident has become too large that an IR plan would be ineffective.

III.

Relate that once this action has been completed, it cannot be undone, so it should only be done when there is proper justification to do this.

Recovering from Incidents I.

Explain that once an incident has been contained and system control has been regained within the organization, the recovery can begin.

II.

Describe that the appropriate human resources must be notified once an incident has been terminated, and, at the same time, the CSIRT team must go into action to do an immediate damage assessment to determine the severity of the breach.

III.

To get a comprehensive picture of what happened and what resulted from the incident, system logs, intrusion detection logs, configuration logs, and other documents, as well as the documentation from the incident response, provide information on the type, scope, and extent of damage.

IV.

Apply information provided by Donald Pipkin as to what the recovery process should entail. His recommendations are the following: •

Identify the vulnerabilities that allowed the incident to occur and spread. Resolve them.

•

Address the safeguards that failed to stop or limit the incident or were missing from the system in the first place. Install, replace, or upgrade them.

•

Evaluate monitoring capabilities (if present). Improve detection and reporting methods or install new monitoring capabilities.

•

Restore the data from backups, as needed. The IR team must understand the backup strategy used by the organization, restore the data contained in backups,

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

23

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

and then use the appropriate recovery processes, from incremental backups or database journals, to recreate any data that was created or modified since the last backup. •

Restore the services and processes in use. Compromised services and processes must be examined, cleaned, and then restored. If services or processes were interrupted while regaining control of the systems, they need to be brought back online.

•

Continuously monitor the system. If an incident happened once, it could easily happen again. Hackers frequently boast of their exploits in chat rooms and dare their peers to match their efforts. If word gets out, others may be tempted to try the same or different attacks on your systems. It is therefore important to maintain vigilance during the entire IR process.

•

Restore the confidence of the organization’s communities of interest. The CSIRT, following a recommendation from management, may want to issue a short memorandum outlining the incident and assuring everyone that it was handled, and the damage was controlled. If the incident was minor, say so. If the incident was major or severely damaged systems or data, reassure users that they can expect operations to return to normal as soon as possible. The objective of this communication is to prevent panic or confusion from causing additional disruption to the operations of the organization.

V.

Apply content from NIST SP 800-184 such that every organization, regardless of their size, function, or location, should have a recovery plan to guide specific efforts after an incident has occurred.

VI.

Identify that prior to returning to their routine duties, the CSIRT should conduct an after-action review (AAR). Note that a designated moderator is assigned to complete the document so that it can be shared with internal and external organizations that were directly involved in the containment of the incident.

VII.

List the 10 common mistakes that an organization’s CSIRs make in incident response (IR): •

Failure to appoint a clear chain of command with a specified individual in charge

•

Failure to establish a central operation center

•

Failure to “know their enemy”

•

Failure to develop a comprehensive IR plan with containment strategies

•

Failure to record IR activities at all phases, especially help-desk tickets to detect incidents

•

Failure to document the events as they occur in a timeline

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

24

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

VIII.

•

Failure to distinguish incident containment from incident remediation (as part of reaction)

•

Failure to secure and monitor networks and network devices

•

Failure to establish and manage system and network logging

•

Failure to establish and support effective antivirus and antimalware solutions

Differentiate the recommendations that NIST SP 800-61, Rev. 2, makes with respect to handling incidents: •

Acquire tools and resources that may be of value during incident handling.

•

Prevent incidents from occurring by ensuring that networks, systems, and applications are sufficiently secure.

•

Identify precursors and indicators through alerts generated by several types of security software.

•

Establish mechanisms for outside parties to report incidents.

•

Require a baseline level of logging and auditing on all systems and a higher baseline level on all critical systems.

•

Profile networks and systems.

•

Understand the normal behaviors of networks, systems, and applications.

•

Create a log retention policy.

•

Perform event correlation.

•

Keep all host clocks synchronized.

•

Maintain and use a knowledge base of information.

•

Start recording all information as soon as the team suspects that an incident has occurred.

•

Safeguard incident data.

•

Prioritize handling of incidents based on relevant factors.

•

Include provisions for incident reporting in the organization’s incident response policy.

•

Establish strategies and procedures for containing incidents.

•

Follow established procedures for evidence gathering and handling.

•

Capture volatile data from systems as evidence.

•

Obtain system snapshots through full forensic disk images, not file system backups.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

25

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

•

Hold lessons-learned meetings after major incidents.

Organizational Philosophy on Incident and Disaster Handling I.

Compare and contrast the two approaches that an organization must choose from with respect to their IR and DR approach as well as involvement with digital forensics and law enforcement agencies. The options are protect and forget and apprehend and prosecute. •

Protect and forget: This approach, also known as “patch and proceed,” focuses on the defense of data and the systems that house, use, and transmit it. An investigation that takes this approach focuses on the detection and analysis of events to determine how they happened and to prevent reoccurrence. Once the current event is over, the questions of who caused it and why are almost immaterial.

•

Apprehend and prosecute: This approach, also known as “pursue and punish,” focuses on the identification and apprehension of responsible individuals, with additional attention paid to the collection and preservation of potential evidentiary material that might support administrative or criminal prosecution. This approach requires much more attention to detail to prevent contamination of evidence that might hinder prosecution.

II.

Stress that an organization may experience difficulties having enough data to administer penalties but rather pursue formal punishment should an employee challenge it.

III.

Emphasize that without notifying individuals of data breaches, companies put themselves seriously at risk for criminal charges or corporate negligence lawsuits.

Quick Quiz 1 1. What is the term called for which actions taken by management specify the organization's efforts and actions if an adverse event becomes an incident or disaster? a. CSIRT plan b. contingency planning c. business continuity plan d. business process Answer: b 2. Which of the following is NOT a stage as described in NIST’s SP 800-34, Rev. 1? a. Determine mission/business process and recovery critically.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

26

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

b. Identify resource requirements. c. Identify recovery priorities for system requirements. d. There is no wrong answer, as these are the three stages described in this document. Answer: d 3. Providing customer billing as mentioned in the text is an example of what? a. potential incident that can occur in an organization b. additional resource detail c. mission/business process d. description and estimated cost Answer: c 4. True or False: The NIST Cybersecurity Framework has a total of four processes that are cyclical in nature. Answer: False 5. True or False: Remote journaling is the process in which an organization can transfer live transactions to an off-site facility. Answer: True 6. True or False: An alert roster often is done one of two ways: sequentially or hierarchically. Answer: True

Digital Forensics (5.3, PPT Slides 60–69) I.

Comprehend that when the asset attacked is in the purview of the CISO, they are expected to understand how policies and laws require the matter to be managed. The investigation of what happened and how is called digital forensics.

II.

Detail how digital forensics is based on the field of traditional forensics. Mention to students that forensics is the coherent application of methodical investigatory techniques to present evidence of crimes in a court or court-like setting.

III.

Define digital forensics in the respect that it involves the preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and/or root cause analysis. Like traditional forensics, it follows clear, well-defined methodologies, but still tends to be as much art as science.

IV.

Outline how digital forensics is often used for two key purposes:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

27

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

V.

•

To investigate allegations of digital malfeasance: Such an investigation requires digital forensics to gather, analyze, and report the findings.

•

To perform root cause analysis: If the organization suspects an attack was successful, digital forensics can be used to examine the path and methodology used to gain unauthorized access, as well as to determine how pervasive and successful the attack was.

Relate that depending on the circumstances, some investigations are undertaken by organization personnel, whereas more severe cases require the immediate involvement of law enforcement. This is specific to cases with allegations of digital malfeasance, for example.

The Digital Forensics Team I.

Emphasize that most organizations cannot sustain a permanent digital forensics team. Even so, there should be people in the information security group trained to understand and manage the forensics process.

II.

Recall that this expertise can be obtained by sending staff members to a regional or national information security conference with a digital forensics track or to dedicated digital forensics training. Organizations should be aware that this may be a costly action to take, but depending on their industry and frequency of attacks that may come in, it could be a good investment to do.

Affidavits and Search Warrants I.

Label that an affidavit is sworn testimony that certain facts are in the possession of the investigating officer that they feel warrant the examination of specific items located at a specific place.

II.

Distinguish that when an approving authority signs the affidavit or creates a synopsis form based on this document, it becomes a search warrant.

III.

Stress that in corporate environments, the names of these documents may change and, in many cases, may be verbal in nature, but that the process should be the same. Formal permission is obtained before an investigation occurs.

Digital Forensics Methodology I.

Broadcast that all investigations applying the use of digital forensics apply the same basic methodology below: •

Identify relevant EM.

•

Acquire (seize) the evidence without alteration or damage.

•

Take steps to assure that the evidence at every step is verifiably authentic and is unchanged from the time it was seized.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

28

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

•

Analyze the data without risking modification or unauthorized access.

•

Report the findings to the proper authority.

II.

Recommend that to support the selection and implementation of a methodology, legal counsel with local or state law enforcement is a likely option an organization should use.

III.

Recommend that students review the following resources provided in the text that should be part of an organization’s library: •

Electronic Crime Scene Investigation: A Guide for First Responders, 2nd Edition, April 2008 (https://www.ncjrs.gov/pdffiles1/nij/219941.pdf)

•

Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations (www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf)

•

Scientific Working Group on Digital Evidence: Published Guidelines and Best Practices (https://www.swgde.org/documents/published)

•

First Responders Guide to Computer Forensics (https://resources.sei.cmu.edu/asset_files/Handbook/2005_002_001_14429.p df)

•

First Responders Guide to Computer Forensics: Advanced Topics (http://resources.sei.cmu.edu/asset_files/handbook/2005_002_001_14432.pd f)

Identifying Relevant Items I.

Explain that the affidavit and/or warrant that has been issued authorizes a search but must identify which items of evidence can be seized and their locations.

II.

Emphasize that EM that fits the description on the authorization can be seized.

III.

Note, though, that the search and seizures often come under stressful conditions and strict time restrictions.

Acquiring the Evidence I.

Emphasize to students that the principal responsibility of the response team is to get the information without making any adjustments or alterations to it.

II.

Present two options that can be used to acquire evidence from a system: a. Offline: This is when an investigator removes the power source and then uses a utility or special device to make a bit-stream sector-by-sector copy of the hard drives contained in the system.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

29

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

b. Online (or live): Alternately, this is when investigators use network-based tools to acquire a protected copy of the information. Classify that the only key difference between the two options is that the source system cannot be taken offline, and the tools required do not alter the system while acquiring data. III.

Present Table 5-4 to students, showing them a summary of methods employed to acquire forensic data.

IV.

State that not all evidentiary material is on a perpetrator’s hard drive, as that would make it too obvious to find out their motive and net acquisition. A technically savvy attacker is more likely to store incriminating evidence on other digital media, such as removable drives, CDs, DVDs, flash drives, memory chips or sticks, or other computers accessed across the organization’s networks or via the Internet.

V.

Relate that once evidence has been acquired, both the copy image and the original drive should be handled so as to ward off legal challenges based on authenticity and preservation of integrity.

VI.

Identify how chain of evidence or chain of custody is defined as the detailed documentation of the collection, storage, transfer, and ownership of collected evidence from the crime scene through its presentation in court.

VII.

Educate learners that the copy or image is typically transferred to the laboratory for the next stage of authentication. The team must be able to demonstrate that any analyzed copy or image is a true and accurate replica of the source EM. This is accomplished using cryptographic hash tools.

VIII.

Justify that the most difficult and often complex part of an investigation is the analysis of the copy or image for potential EM. While the process can be performed manually using simple utilities, two industry-leading applications dominate the market for digital forensics. Recommend students research the following software titles and summarize their findings: a. Guidance Software’s EnCase (www.guidancesoftware.com) b. AccessData Forensic Toolkit (FTK, at www.accessdata.com) c. OSForensics (www.osforensics.com)

IX.

Evaluate the first component of the analysis phase. In the case here, this is indexing. Mention that that tools organize files into categories, such as documents, images, and executables.

X.

Explain that once investigators have found a suitable amount of information, they can summarize their findings with a synopsis of their investigatory procedures in a

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

30

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

report and submit it to the appropriate authority. Point out that the authority might be law enforcement or management.

Evidentiary Procedures I.

Compare and contrast how in information security, most operations focus on policies—those documents that provide managerial guidance for ongoing implementation and operations. In digital forensics, however, the focus is on procedures instead.

II.

Establish an understanding that strong procedures for handling evidentiary material minimize the chance an organization would lose a legal challenge.

III.

Outline the core components of specific procedures and how to use these with regard to evidence-based practices:

IV.

•

Who may conduct an investigation

•

Who may authorize an investigation

•

What affidavits and related documents are required

•

What search warrants and related documents are required

•

What digital media may be seized or taken offline

•

What methodology should be followed

•

What methods are required for chain of custody or chain of evidence

•

What format the final report should take, and to whom it should it be given

Explain how the policy document should be supported by a procedures manual, developed based on the documents discussed earlier, along with guidance from law enforcement or consultants.

Disaster Recovery (5.3, PPT Slides 70–80) I.

Differentiate disaster recovery from incident planning and explain what is involved in a disaster recovery plan (DR plan). Explain that, at times, incidents are escalated to disasters depending on their severity.

II.

Refresh one’s memory that the CP team creates the DR planning team (DRPT) and in turn organizes the DR response team (DRRT) should a disaster strike.

III.

Review the responsibilities that a DRRT would need to execute to bring an organization back online in the event of a disaster: •

Recover information assets that are salvageable from the primary facility after the disaster.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

31

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

IV.

•

Purchase or otherwise acquire replacement information assets from appropriate sources.

•

Reestablish functional information assets at the primary site if possible or at a new primary site, if necessary.

Assemble the common elements of a DRRT as provided in the text: •

DR management team: Coordinates the on-site efforts of all other DRRTs.

•

Communications team: With representatives from the public relations and legal departments, provides feedback to anyone who wants additional information about the organization’s efforts in recovering from the disaster.

•

Computer recovery (hardware) team: Works to recover any physical computing assets that might be usable after the disaster and acquire replacement assets for resumption of operations.

•

Systems recovery (OS) team: Works to recover operating systems and may contain one or more specialists on each operating system that the organization employs; may be combined with the applications recovery team as a “software recovery team” or with the hardware team as a “systems recovery team” or “computer recovery team.”

•

Network recovery team: Works to determine the extent of damage to the network wiring and hardware (hubs, switches, and routers) as well as to Internet and intranet connectivity.

•

Storage recovery team: Works with the other teams to recover storage-related information assets; may be subsumed into other hardware and software teams.

•

Applications recovery team: Works to recover critical applications.

•

Data management team: Works on data restoration and recovery, whether from on-site, off-site, or online transactional data.

•

Vendor contact team: Works with suppliers and vendors to replace damaged or destroyed materials, equipment, or services, as determined by the other teams.

•

Damage assessment and salvage team: Specialized individuals who provide initial assessments of the extent of damage to materials, inventory, equipment, and systems on-site.

•

Business interface team: Works with the remainder of the organization to assist in the recovery of nontechnology functions.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

32

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

•

Logistics team—Responsible for providing any needed supplies, space, materials, food, services, or facilities at the primary site; may be combined with the vendor contact team.

•

Other teams as needed.

The Disaster Recovery Process I.

Examine the two pieces of criteria that classify that a disaster has occurred: the organization is unable to contain or control the impact of an incident, or the level of damage or destruction from an incident is so severe that the organization cannot quickly recover from it.

II.

Emphasize it rests on the DRPT’s shoulders to determine if an event is an incident or a disaster. Whatever is decided provides direction as to which plan will be activated should it occur.

III.

Construct the eight-step sequence of creating a disaster recovery process: •

Organize the DR team: The initial assignments to the DR team, including the team lead, will most likely be performed by the CPMT; however, additional personnel may need to be assigned to the team as the specifics of the DR policy and plan are developed, and as individual roles and responsibilities are defined and assigned.

•

Develop the DR planning policy statement: A formal department or agency policy provides the authority and guidance necessary to develop an effective contingency plan.

•

Review the BIA: The BIA was prepared to help identify and prioritize critical information and its host systems. A review of what was discovered is an important step in the process.

•

Identify preventive controls: Measures taken to reduce the effects of business and system disruptions can increase information availability and reduce contingency life cycle costs.

•

Create DR strategies: Thorough recovery strategies ensure that the system can be recovered quickly and effectively following a disruption.

•

Develop the DR plan document: The plan should contain detailed guidance and procedures for restoring a damaged system.

•

Ensure DR plan testing, training, and exercises: Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness.

•

Ensure DR plan maintenance: The plan should be a living document that is updated regularly to remain current with system enhancements.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

33

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Disaster Recovery Policy I.

Summarize that upon the creation of the DR team, the manager that is placed in charge of the group will begin the creation of the DR policy. Note that this document may have already been created by the CP team, or the DR policy will need to be created from scratch.

II.

Outline the key elements that are included in the DR plan: •

Purpose: The purpose of the DR program is to provide direction and guidance for all DR operations. In addition, the program provides for the development and support of the DR plan. In everyday practice, those responsible for the program must also work to emphasize the importance of creating and maintaining effective DR functions. As with any major enterprise-wide policy effort, it is important for the DR program to begin with a clear statement of executive vision.

•

Scope: This section of the policy identifies the organizational units and groups of employees to which the policy applies. This clarification is important if the organization is geographically dispersed or is creating different policies for different organizational units.

•

Roles and responsibilities: This section of the policy identifies the roles and responsibilities of the key players in the DR operation. It can include a delineation of the responsibilities of executive management down to individual employees. Some sections of the DR policy may be duplicated from the organization’s overall CP policy. In smaller organizations, this redundancy can be eliminated, as many of the functions are performed by the same group.

•

Resource requirements: An organization can allocate specific resources to the development of DR plans here. While this may include directives for individuals, it can be separated from the previous section for emphasis and clarity.

•

Training requirements: This section defines and highlights training requirements for units within the organization and the various categories of employees.

•

Exercise and testing schedules: This section stipulates the testing intervals of the DR plan as well as the type of testing and the individuals involved.

•

Plan maintenance schedule: This section states the required review and update intervals of the plan and identifies who is involved in the review. It is not necessary for the entire DR team to be involved, but the review can be combined with a periodic test of the DR plan as long as the resulting discussion includes areas for improving the plan.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

34

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

•

Special considerations: This section includes such items as information storage and maintenance.

Disaster Classification I.

Examine how disasters can be classified by a DR team and/or in the policies that are created as part of the team.

II.

Recall that disasters can be categorized by severity, type, or the amount of damage they would cause. Recognize the authors split them into two core categories: slowonset disasters and rapid-onset disasters. •

Slow-onset disasters are ones that build up over time and may have been incidents initially and are now disasters.

•

Rapid-onset disasters happen with little or no notice and affect lives, property, and production.

III.

Relate that it is the responsibility of the senior IT or InfoSec manager working with the CSIRT and DR team leads who would classify an incident as a disaster or not.

IV.

Guide learners to review Table 5-5, which has a list of natural disasters, their effects, and mitigation recommendations.

Planning to Recover I.

Emphasize that in the recovery process, information is not the most important asset that should be focused on; rather, it is people.

II.

State that organizations must take a proactive approach to cross-train employees to ensure that an operation will have some sense of normalcy after a disaster strike. This includes periodic testing of the DR plan so the effort can be done quickly and efficiently.

III.

Review the key elements of the DR plan with respect to recovery: •

Clear delegation of roles and responsibilities: Everyone assigned to the DR team should be aware of his or her duties during a disaster. Some team members may be responsible for coordinating with local services, such as fire, police, and medical personnel. Some may be responsible for the evacuation of company personnel, if required. Others may be assigned to simply pack up and leave.

•

Execution of the alert roster and notification of key personnel: These notifications may extend outside the organization to include the fire, police, or medical services mentioned earlier, as well as insurance agencies, disaster teams such as those of the Red Cross, and management teams.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

35

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

IV.

•

Clear establishment of priorities: During a disaster response, the priority is always the preservation of human life. Data and systems protection is subordinate when the disaster threatens the lives, health, or welfare of the employees or members of the community. Only after all employees and neighbors have been safeguarded can the DR team attend to protecting other organizational assets.

•

Procedures for documentation of the disaster: Just as in an incident response, the disaster must be carefully recorded from the onset. This documentation is used later to determine how and why the disaster occurred.

•

Action steps to mitigate the impact of the disaster on the operations of the organization: The DR plan should specify the responsibilities of each DR team member, such as the evacuation of physical assets or making sure that all systems are securely shut down to prevent further loss of data.

•

Alternative implementations for the various system components, should primary versions be unavailable: These components include standby equipment that is either purchased, leased, or under contract with a DR service agency. Developing systems with excess capacity, fault tolerance, auto-recovery, and fail-safe features facilitates a quick recovery. Something as simple as using Dynamic Host Control Protocol (DHCP) to assign network addresses instead of using static addresses can allow systems to regain connectivity quickly and easily without technical support. Networks should support dynamic reconfiguration; restoration of network connectivity should be planned. Data recovery requires effective backup strategies as well as flexible hardware configurations. System management should be a top priority. All solutions should be tightly integrated and developed in a strategic plan to provide continuity. Piecemeal construction can result in a disaster after the disaster, as incompatible systems are unexpectedly thrust together.

Highlight that each employee should always have two sets of emergency information in their possession: emergency information (people to notify if something happens such as next of kin, medical conditions, and a form of identification) and instructions what to do in an emergency (such as a number to contact), emergency service numbers, evacuation, and assembly locations. Recommend that students review Figure 5-11 for an example of an emergency ID card.

Responding to the Disaster I.

Stress to students that the response to a disaster can be a make-or-break moment for the organization and how it is handled.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

36

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

II.

Emphasize that when a primary site has been destroyed by a disaster (humanmade or otherwise), the DR process transitions into a business continuity process.

Business Continuity (5.3, PPT Slides 81–88) I.

Denote to students that the purpose of business continuity is the continued operations of an organization after a disaster has occurred. This may or may not be at the original location where it took place.

II.

Report the purpose of business continuity planning and the BC plan that results from it. However, mention that not every business requires this, depending on their makeup.

III.

Relate that the BP is another component of contingency planning (CP) and the first step is to plan which is in line with other processes outlined in the module.

IV.

Assemble and construct the steps necessary to develop and maintain a viable and strong BC program: •

Form the BC team: As was done with the DR planning process, the initial assignments to the BC team, including the team lead, will most likely be performed by the CPMT; however, additional personnel may need to be assigned to the team as the specifics of the BC policy and plan are developed, and their individual roles and responsibilities will have to be defined and assigned.

•

Develop the BC planning policy statement: A formal organizational policy provides the authority and guidance necessary to develop an effective continuity plan. As with any enterprise-wide policy process, it is important to begin with the executive vision.

•

Review the BIA: Information contained within the BIA can help identify and prioritize critical organizational functions and systems for the purposes of business continuity, making it easier to understand what functions and systems will need to be reestablished elsewhere in the event of a disaster.

•

Identify preventive controls: Little is done here exclusively for BC. Most of the steps taken in the CP and DRP processes will provide the necessary foundation for BCP.

•

Create relocation strategies: Thorough relocation strategies ensure that critical business functions will be reestablished quickly and effectively at an alternate location following a disruption.

•

Develop the BC plan: The BC plan should contain detailed guidance and procedures for implementing BC strategies at predetermined locations in accordance with management’s guidance.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

37

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

V.

•

Ensure BC plan testing, training, and exercises: Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness.

•

Ensure BC plan maintenance: The plan should be a living document that is updated regularly to remain current with system enhancements.

Emphasize that the BC plan must continually be updated, as circumstances and the nature and frequency of disasters can change over time.

Business Continuity Policy I.

Recall that business continuity planning begins with the BC policy as outlined in the text and below.

II.

Outline the key sections that must be included in the BC policy document: •

Purpose: The purpose of the BC program is to provide the necessary planning and coordination to help relocate critical business functions should a disaster prohibit continued operations at the primary site.

•

Scope: This section identifies the organizational units and groups of employees to which the policy applies. This is especially useful in organizations that are geographically dispersed or that are creating different policies for different organizational units.

•

Roles and responsibilities: This section identifies the roles and responsibilities of key players in the BC operation, from executive management down to individual employees. In some cases, sections may be duplicated from the organization’s overall CP policy. In smaller organizations, this redundancy can be eliminated because many of the functions are performed by the same group of individuals.

•

Resource requirements: Organizations can allocate specific resources to the development of BC plans. Although this section may include directives for individual team members, it can be separated from the roles and responsibilities section for emphasis and clarity.

•

Training requirements: This section specifies the training requirements for the various employee groups.

•

Exercise and testing schedules: This section stipulates the frequency of BC plan testing and can include both the type of exercise or testing and the individuals involved.

•

Plan maintenance schedule: This section specifies the procedures and frequency of BC plan reviews and identifies the personnel who will be involved in the review. It is not necessary for the entire BC team to be involved; the review

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

38

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

can be combined with a periodic test of the BC plan (as in a talk-through) as long as the resulting discussion includes areas for plan improvement. •

Special considerations: In extreme situations, the DR and BC plans overlap, as described earlier. Thus, this section provides an overview of the organization’s information storage and retrieval plans. While the specifics do not have to be elaborated on in this document, the plan should at least identify where more detailed documentation is kept, which individuals are responsible, and any other information needed to implement the strategy.

Propose to students that the structure looks like a disaster recovery policy and plan. Stress that these are similar in nature but have some minor differences.

Business Resumption I.

Explain that, depending on the organization, most often the disaster recovery and business continuity plans are merged together into one single function known as the business resumption plan.

II.

Emphasize that the planning that takes place must support the reestablishment of business at two locations (original and alternate) when applicable.

Continuity Strategies I.

Outline the two most commonly used types of facilities that are used post-disaster as part of a recovery process: exclusive use and shared use.

II.

Describe the three types of exclusive use sites: hot, warm, and cold.

III.

Compare and contrast the exclusive use sites with timeshares and service bureaus, as those are shared-use sites. Note that mutual agreements are likely to have to be in place prior to a disaster occurring for a temporary but smooth transition while the existing facility is being rebuilt.

IV.

Propose to students that a mobile site or cloud-based provisioning may be alternate options depending on the needs of an organization and severity of the damage that was caused.

Timing and Sequence of CP Elements I.

Comment that in most cases, DR plans focus on restoring systems after a disaster or incident has occurred. However, if damage is long-term, then additional planning and strategy must be executed for operations to continue.

II.

Summarize to students that arguments are often made with respect to the similarities of IR, DR, and BC planning, but they all have specific components that differentiate them from one another and are critical to contingency planning. Reference Figure 5-14 for the comparisons.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

39

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Crisis Management (5.4, PPT Slides 89–94) I.

Identify that an additional plan that organizations often have in place is a crisis management plan. This is one that deals with human injury, trauma, or loss of life because of a disaster taking place.

II.

Emphasize that the human resource is the most important resource of an organization outside of the information within it.

III.

Outline that the roles the crisis management planning team (CMPT) include:

IV.

•

Supporting personnel and their loved ones during the crisis

•

Keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise

•

Communicating with major customers, suppliers, partners, regulatory agencies, industry organizations, the media, and other interested parties

Describe the responsibilities the CPMT should establish, which includes personnel from all functional parts of an organization: •

Verifying personnel status

•

Activating the alert roster

•

Coordinating with emergency services

V. Comment that a CM policy and plan should follow the similar structure and methodology as other plans discussed in the module (IR, DR, and BC).

Testing Contingency Plans (5.5, PPT Slide 95) I.

Stress that written plans only go so far, and organizations must frequently test their plans to determine vulnerabilities and areas of improvement, and to accommodate additional threats that may occur over time.

II.

Describe the four most common ways contingency plans can be tested:

III.

•

Desk checks

•

Structured walk-throughs

•

Simulations

•

Full-interruption testing

Emphasize the time of when tests take place, as doing them during the business day may cause unnecessary interruptions and potentially panic when it could be avoidable.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

40

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

IV.

V.

Review the recommendations made by former Navy SEAL Richard Marcinko with respect to motivating a team: •

The more you sweat to train, the less you bleed in combat.

•

Training and preparation can hurt.

•

Lead from the front, not the rear.

•

You don’t have to like it; you just have to do it.

•

Keep it simple.

•

Never assume.

•

You are paid for results, not methods

Stress the importance of cross-training so that if a real disaster occurs, people assigned to roles that aren’t available can be filled in with like-minded individuals who can assist much in the same way effectively.

Final Thoughts on CP (PPT Slide 96) I.

Propose to students that a critical component of the NIST-based methodologies presented in this module is continuous process improvement (CPI). Each time the organization rehearses its plans, it should learn from the process, improve the plans, and then rehearse again. Each time an incident or disaster occurs, the organization should review what went right and what went wrong.

Quick Quiz 2 1. Which of the following is NOT part of the disaster recovery policy? a. financing b. purpose c. exercise and testing schedules d. scope Answer: a 2. What type of data acquisition is done where information is taken off as a protected copy while a system is actively live for the purpose of business continuity? a. offline b. online c. transitory d. slow-dripping Answer: b © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

41

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

3. A ________ is sworn testimony that certain facts are in the possession of an investigating officer, and they warrant the examination of specific items located in a location. a. memorandum b. piece of evidence c. legal directive d. affidavit Answer: d 4. In a ________, the organization creates a role-playing exercise in which the CP team is presented with a scenario of an actual incident or disaster and is expected to react as if it had occurred. a. desk check b. simulation c. full-interruption test d. structured walk-through Answer: b 5. Which of the following is a primary responsibility of the CPMT? a. conducting a building walk-through during an emergency b. securing financing so that physical infrastructure can be immediately replaced c. coordinating with emergency services in the event someone is injured or killed d. gathering criminal evidence of wrongdoing Answer: c 6. True or False: The term chain of evidence is also known as a chain of custody. Answer: True 7. True or False: An example of a disaster classification plan is a scale that has Minor, Moderate, Severe, and Critical categories. Answer: True [return to top]

Discussion Questions You can assign these questions several ways: in a discussion forum in your LMS, as wholeclass discussions in person, or as a partner or group activity in class.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

42

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

These questions are separate from the review questions and exercises in the textbook. For answers to the textbook questions, see the associated solutions for this module. Additional class discussion options: 1. Compare and contrast the different plans that were described in the module. Split the class into two. On one side, they should explain how they are like each other and why some companies only have one master plan. Have the other side argue how they are different and the importance to have separate plans as part of a contingency plan for an organization. (5.1, 5.2, 5.4, PPT Slides 3–5, 8–46, 50–78, and 81–91) Duration 15 minutes. 2. Explain why crisis planning is as important as securing and protecting information that is within an organization. (5.1, 5.5, PPT Slides 3–5, 93–96) Duration 15 minutes. 3. Poll the class and determine which plan they feel is superior to another. Have them justify their reason why one plan is more important than others described in the module. Although they are all equally important, some may have more applicability to an organization than others. (5.2, 5.3, 5.5, PPT Slides 8–46, 50–78, 81–91, and 94– 96) Duration 15 minutes. [return to top]

Suggested Usage for Lab Activities A series of hands-on labs has been developed to complement the text material for this course and are available for download at the Instructor Center. The labs do not depend on specific chapter content, so instructors can insert them where they best suit the syllabus. The following is a list of lab titles, objectives, and approximate durations to assist with lesson planning. Lab Title Ethical Considerations in IT and Detecting Phishing Attacks

Web Browser Security

Malware Defense

Objective Upon completion of this activity, you will: • have a better understanding of the ethical expectations of IT professionals; and • be able to identify several types of social engineering attacks that use phishing techniques. Upon completion of this activity, the student will be able to: • Review and configure the security and privacy settings in the most popular web browsers. Upon completion of this activity, the

Duration Ethical Considerations lab in 15 to 20 minutes. Phishing E-Mail lab in 60 to 75 minutes.

1 to 1.5 hours

1 to 1.5 hours

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

43

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Windows Password Management

Backup and Recovery and File Integrity Monitoring

OS Processes and Services

Log Management & Security

Footprinting, Scanning, and Enumeration

student will be able to: • Understand the basic setup and use of an open-source AV product. • Install and use Clam AV on a Windows system. • Using a USB storage device create a portable AV scanner. • Understand what a YARA file is and how it is used. Upon completion of this activity, the student will be able to: • Review and configure password management policies in a Windows client computer. Upon completion of this activity, you will be able to: • Describe backup and recovery processes and will be aware of basic backup activities using Windows 10 or another desktop operating system (OS). • Perform file integrity monitoring using file hash values. Upon completion of this activity, the student will be able to: • Review available and enabled OS services. • Review available and enabled OS processes. • Review current system resource utilization. Upon completion of this activity, the student will be able to: • Access and review the various logs present in a Windows 10 computer. Upon completion of this activity, the student will be able to: • Identify network addresses associated with an organization.

30 minutes to 1 hour

15–20 minutes

60–90 minutes

30 minutes to 1 hour

40–60 minutes

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

44

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Identify the systems associated with the network addresses. Upon completion of this activity, the student will be much more knowledgeable about the AlienVault OSSIM software and how to install, configure, and operate it. You will use the software more extensively in a subsequent lab. Upon completion of this activity, the student will be able to perform basic drive image analysis using the Autopsy software package. •

AlienVault OSSIM

Image Analysis Using Autopsy

2–3 hours

45–70 minutes

[return to top]

Additional Activities and Assignments Please see associated solutions for the Closing Scenario at the end of the textbook module. Additional project options include: 1. Have students create a simple contingency plan for a business of their choice. Ask them to apply the information from the text as well as outside resources. Group the persons in the class into small teams and designate one from each team as the spokesperson that explains their plan for the business chosen. 2. Direct students to review a contingency plan for a local business or their school. Compare and contrast the strengths and weaknesses of the plan and how it can be improved upon. Ask them to explain how they would share their findings on what improvements need to be made to executives outlined in the module. [return to top]

Additional Resources Cengage Video Resources •

MindTap Video: Contingency Planning

Internet Resources • • •

American Society of Digital Forensics Automated Notification System Review Incident Handlers Handbook by Patrick Kral

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

45

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

•

NIST Cybersecurity Framework

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

46

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 5: incident Response and Contingency Planning

Appendix Grading Rubrics Providing students with rubrics helps them understand expectations and components of assignments. Rubrics help students become more aware of their learning process and progress, and they improve students’ work through timely and detailed feedback. Customize these rubrics as you wish. The grading rubric suggests a 4-point scale, and the discussion rubric indicates 30 points. Grading Rubric These grading criteria can be applied to open-ended Review Questions, Real-World Exercises, Case Studies, and Security for Life activities. 3 2 1 0 Exceeds Expectations Meets Expectations Needs Improvement Inadequate • Student • Student • Student’s • Student’s response demonstrates demonstrates response is missing or accurate accurate demonstrates a incomplete. understanding of understanding of gap in • Student’s response the concept. the concept. understanding of demonstrates a • Student applies the • Student applies the concept. critical gap in concept the concept • Student applies understanding. appropriately. appropriately. the concept • Student is unable • Student uses • Student develops incorrectly. to apply the sound critical a complete • Student’s concept. analysis to develop response to the response is poorly an insightful and prompt. developed or comprehensive incomplete. response to the prompt. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

47

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

Instructor Manual Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 2 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 4 Module Outline .............................................................................................................................. 4 Discussion Questions .................................................................................................................. 25 Suggested Usage for Lab Activities ............................................................................................ 26 Additional Activities and Assignments ....................................................................................... 27 Additional Resources................................................................................................................... 28 Cengage Video Resources ....................................................................................................................... 28 Internet Resources .................................................................................................................................. 28 Appendix ...................................................................................................................................... 29 Grading Rubrics ....................................................................................................................................... 29

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

Purpose and Perspective of the Module Personnel in an organization is the lifeblood that makes it run daily. Maintaining the business and having the right people on the information security team is even more important to ensure data is always kept safe and secure. In this module, students will review where and how information security should be positioned within an organization. This includes the people responsible for it and their role and credentials they could receive to gain more credibility within the industry. Near the end of the module, students will gain an understanding of how employment policies and practices can support the effort. This includes special security controls and considerations that apply to personnel management.

Cengage Supplements The following product-level supplements provide additional information that may help you in preparing your course. They are available in the Instructor Resource Center. •

PowerPoint slides

•

Test banks, available in Word, as LMS-ready files, and on the Cognero platform

•

MindTap Educator Guide

•

Solution and Answer Guide

•

This instructor’s manual

Module Objectives The following objectives are addressed in this module: 6.1

Explain the differences between laws and ethics.

6.2

Describe the relevant laws, regulations, and professional organizations of importance to information security.

6.3

Identify major national and international laws that affect the practice of information security.

6.4

Discuss the role of privacy as it applies to law and ethics in information security.

6.5

Explain the roles of some U.S. law enforcement agencies with an interest in information security.

Complete List of Module Activities and Assessments For additional guidance, refer to the MindTap Educator Guide. Module Objective 6.1 and 6.2

PPT slide

Activity/Assessment

Duration

8–9

Knowledge Check 1

2 minutes

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

6.2 6.2 6.2–6.5 6.1–6.5

18–19 24–25 53–54 58 MindTap MindTap MindTap

Knowledge Check 2 Knowledge Check 3 Knowledge Check 4 Self-Assessment Module 06 Review Questions Module 06 Case Exercises Module 06 Exercises

MindTap MindTap

Module 06 Security for Life Module 06 Quiz

2 minutes 2 minutes 2 minutes 5 minutes 30–40 minutes 30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: laws: Rules that mandate or prohibit certain behavior and are enforced by the state. ethics: The branch of philosophy that considers nature, criteria, sources, logic, and the validity of moral judgment. cultural mores: The fixed moral attitudes or customs of a particular group. liability: An entity’s legal obligation or responsibility. restitution: A legal requirement to make compensation or payment resulting from a loss or injury. due care: Reasonable and prudent measures that an organization takes to ensure it is in compliance with a law, regulation, or requirement. due diligence: Measures taken to ensure that an organization continues to meet the obligations imposed by laws, regulations, and requirements; the management of due care. Jurisdiction: The power to make legal decisions and judgments; also, the domain or area within which an entity such as a court or law enforcement agency is empowered to make legal decisions and perform legal actions. long-arm Jurisdiction: The ability of a legal entity to exercise its influence beyond its normal boundaries by asserting a connection between an out-of-jurisdiction entity and a local legal case. privacy: In the context of information security, the right of individuals or groups to protect themselves and their information from unauthorized access, providing confidentiality.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

aggregate information: Collective data that relates to a group or category of people and that has been altered to remove characteristics or components that make it possible to identify individuals within the group. Not to be confused with information aggregation. information aggregation: Pieces of nonprivate data that, when combined, may create information that violates privacy. Not to be confused with aggregate information. identity theft: The unauthorized taking of personally identifiable information with the intent of committing fraud and abuse of a person’s financial and personal reputation, purchasing goods and services without authorization, and generally impersonating the victim for illegal or unethical purposes. personally identifiable information (PII): Information about a person’s history, background, and attributes that can be used to commit identity theft. This information typically includes a person’s name, address, Social Security number, family information, employment history, and financial information. cybersecurity: The affirmation or guarantee of the confidentiality, integrity, and availability of information in storage, processing, and transmission; often used synonymously with “information security.” information assurance: See cybersecurity. [return to top]

What's New in This Module The following elements are improvements in this module from the previous edition: •

This module was Chapter 3 in the 6th edition.

•

The sections on key laws were updated to include recent changes.

•

The section on ethics was rewritten for a more compact treatment using a revised organization.

•

Information on professional organizations was reorganized and updated to reflect changes in the industry.

[return to top]

Module Outline Introduction to Law and Ethics in Information Security (6.1, PPT Slides 3–6) I.

Describe to students that as a future information security professional, they must understand the scope of an organization’s legal and ethical responsibilities.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

II.

Disseminate that the laws and ethics are not the same thing, as laws carry the authority and ethics do not.

III.

Describe ethics, which are based on cultural mores and express the fixed moral attitudes or customs of a particular group. Some ethics are recognized as universal among cultures.

IV.

Explain how to minimize liabilities and reduce risks from electronic and physical threats, and to reduce all losses from legal action, the information security practitioner must understand the current legal environment, stay current with new laws and regulations, and watch for new issues as they emerge.

Organizational Liability and the Need for Counsel I.

Emphasize that even if there is no breach of criminal law, there can still be liability.

II.

Define the term liability. Explain that this is the legal obligation of an entity that extends beyond criminal or contract law; it includes the legal obligation to make restitution or to compensate for wrongs committed by an organization or its employees.

III.

Stress that an organization increases its liability when it refuse to take measures known as due care. Note that due care has been taken when an organization makes sure that every employee knows what acceptable or unacceptable behavior is and knows the consequences of illegal or unethical actions.

IV.

Identify how due diligence requires that an organization make a valid effort to protect others and continually maintain this level of effort.

V.

Recognize the fact that specific to the U.S. legal system, any court can impose its authority over an individual or organization if it can establish jurisdiction—that is, the court’s right to hear a case if the wrong was committed in its territory or involving its citizenry.

VI.

Judge and examine the fact that in most cases when a case is in the injured party’s home area, it is usually more in favor to them than the defendants.

Policy Versus Law I.

Classify the difference between a policy and law and how they are similar and different.

II.

Outline the five criteria for a policy to be enforceable: •

Dissemination (distribution): The organization must be able to demonstrate that the relevant policy has been made readily available for review by the employee. Common dissemination techniques include hard copy and electronic distribution.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

III.

IV.

•

Review (reading): The organization must be able to demonstrate that it disseminated the document in an intelligible form, including versions for employees who are illiterate, reading impaired, and unable to read English. Common techniques include recordings of the policy in English and alternate languages.

•

Comprehension (understanding): The organization must be able to demonstrate that the employee understands the requirements and content of the policy. Common techniques include quizzes and other assessments.

•

Compliance (agreement): The organization must be able to demonstrate that the employee agreed to comply with the policy through act or affirmation. Common techniques include login banners, which require a specific action (mouse click or keystroke) to acknowledge agreement, or a signed document clearly indicating the employee has read, understood, and agreed to comply with the policy.

•

Uniform enforcement: The organization must be able to demonstrate that the policy has been uniformly enforced, regardless of employee status or assignment.

Review and discuss with students the common types of law that are found in the United States: •

Constitutional law: Originates with the U.S. Constitution, a state constitution, or local constitution, bylaws, or charter.

•

Statutory law: Originates from a legislative branch specifically tasked with the creation and publication of laws and statutes.

•

Regulatory or administrative law: Originates from an executive branch or authorized regulatory agency and includes executive orders and regulations.

•

Common law, case law, and precedent: Originates from a judicial branch or oversight board and involves the interpretation of law based on the actions of a previous and/or higher court or board.

Summarize the three different subtypes of statutory law as outlined in the text. •

Civil law: A wide variety of laws pertaining to relationships among individuals and organizations. Civil law includes contract law, employment law, family law, and tort law.

•

Tort law: This is a subset of civil law that allows individuals to seek redress for injury. Those injuries can be personal, physical, or financial.

•

Criminal law: Addresses violations harmful to society and is actively enforced and prosecuted by the state.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

V.

Compare and contrast the differences between private and public laws. Private laws regulate the relationships among individuals and between them and organizations. Public laws include criminal, administrative, and constitutional laws.

VI.

Emphasize that regardless of where a business is located, leadership and employees working there must be aware of the laws and regulations that apply to them.

Types of Law I.

Define civil law, which represents a wide variety of laws that govern a nation or state and deal with the relationships and conflicts between organizational entities and people.

II.

Explain how criminal law addresses violations harmful to society and is actively enforced by the state.

III.

Distinguish the differences of private law. Note that it regulates the relationship between the individual and the organization, and encompasses family law, commercial law, and labor law.

IV.

Describe how public law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments, providing careful checks and balances. Examples of public law include criminal, administrative, and constitutional law.

Relevant U.S. Laws (6.2, PPT Slides 10–17, 20–23, and 26–30) I.

Conclude that the United States has been a leader in the development and implementation of information security legislation that prevents the misuse and exploitation of information and information technology.

General Computer Crime Laws I.

Recognize that the cornerstone of many computer-related federal laws as mentioned in the text is the Computer Fraud and Abuse Act of 1986 (CFA Act or CFAA).

II.

Recall that the CFAA was amended in 1996 and rebranded as the National Information Infrastructure Protection Act of 1996. Stress that punishment for prosecuted offenses includes fines, prison sentences of up to 20 years, or both depending on the severity of the crime committed. Note that penalties are often dependent on the value of the information obtained, whether the offense is conclusive of a commercial advantage, private financial gain, or furtherance of a criminal act.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

III.

Discuss the USA PATRIOT Act of 2001, which modified a wide range of existing laws to provide law enforcement agencies with broader latitude of actions to combat terrorism-related activities.

IV.

Report that further modifications took place and in 2006, the act was amended with the USA PATRIOT Improvement and Reauthorization Act, which made permanent 14 of the 16 expanded powers of the Department of Homeland Security (DHS) and the FBI in investigating terrorist activity. The act also reset the date of expiration written into the law for certain wiretaps under the Foreign Intelligence Surveillance Act of 1978 (FISA) and revised many of the criminal penalties and procedures associated with criminal and terrorist activities.

V.

Explain that the PATRIOT Sunset Extension Act of 2011 provided extension of certain provisions of the USA PATRIOT Act, specifically those related to wiretaps, searching of business records, and the surveillance of suspected terrorists.

VI.

State that in May 2015, the U.S. Senate failed to extend the USA PATRIOT Act, resulting in its expiration on June 1, 2015. However, President Obama signed the USA FREEDOM Act into law in June 2015 as a replacement. Note that this has now since expired but has been indefinitely postponed by Congress at the time of publication in 2020.

VII.

Examine the Computer Security Act of 1987. This law was one of one of the first attempts to protect federal computer systems by establishing minimum acceptable security practices.

VIII.

Evaluate the passage of the Federal Information Security Management Act (FISMA), which mandates all federal agencies to establish information security programs to protect information assets. Note that this has since been updated by the Federal Information Security Modernization Act of 2014 (FISMA Reform) which enhances the federal government’s ability to respond to security attacks on agencies and departments.

IX.

State that in the future, additional laws and regulations are likely to be created, and it is the responsibility of the information security team to be aware of those should they significantly impact the organization, information managed, or other aspects that could require changes.

Privacy I.

Define the term privacy and why it has become one of the hottest topics in information security since the start of the 21st century. The ability to collect information, combine facts from separate sources, and merge it all with other information has resulted in databases of information that were previously impossible to set up.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

II.

Interpret the understanding that as the pressure for privacy protection has significantly increased, so have the number of statutes addressing one’s right to privacy.

III.

Analyze the privacy of customer information. Note that the Privacy of Customer Information Section of the common carrier regulation specifies that any proprietary information shall be used explicitly for providing services, and not for any marketing purposes. It also stipulates those carriers cannot disclose this information except when necessary to provide their services. The only other exception is when a customer requests the disclosure of information and then the disclosure is restricted to that customer’s information only.

IV.

Define the terms aggregate information and information and why both of those terms should not be confused with one another.

V.

Examine the Federal Privacy Act of 1974. Stress to students that it regulates government agencies and holds them accountable if they release private information about individuals or businesses without permission, but there are agencies, regulated businesses, and select individuals that can claim an exemption from this legislation. They are the following: •

Bureau of the Census

•

National Archives and Records Administration

•

Congress

•

Comptroller General

•

Federal courts with regard to specific issues using appropriate court orders

•

Credit reporting agencies

•

Individuals or organizations that demonstrate information is necessary to protect the health or safety of an individual party

VI.

Review the Electronic Communications Privacy Act (ECPA) of 1986. Commonly referred to as the wiretapping act, this is a compilation of statutes that regulates the interception of wire, electronic, and oral communications. These statutes work in conjunction with the Fourth Amendment to the U.S. Constitution, which protects individual citizens from unlawful search and seizure.

VII.

Discuss the purpose of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), also known as the Kennedy–Kassebaum Act, is to protect the confidentiality and security of healthcare data by establishing and enforcing standards and by standardizing electronic data interchange. Summarize the following purposes of the legislation to students as described in the text:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

VIII.

•

This law requires organizations that retain healthcare information to use information security mechanisms to protect this information, as well as policies and procedures to maintain this security.

•

It also requires organizations to have readily available a comprehensive assessment of the organization's information security systems, policies, and procedures.

•

Applicable to the patients that an organization may serve, it provides them the right to know who has access to their information and who has accessed it. The standards also restrict the use of health information to the minimum necessary for the healthcare services required.

•

Identify that this was updated in 2013 with a Department of Health and Human Services Regulatory Action intended to strengthen the act’s privacy and security protections.

Review the five fundamental principles that make up HIPAA legislation: •

Consumer control of medical information

•

Boundaries on the use of medical information

•

Accountability to maintain the privacy of specified types of information

•

Balance of public responsibility for the use of medical information for the greater good measured against impact to the individual

•

Security of health information

IX.

Recall the Financial Services Modernization Act, or Gramm–Leach–Bliley Act of 1999. This requires all financial institutions to disclose their privacy policies on the sharing of nonpublic personal information. It also requires due notice to customers so that they can request that their information not be shared with third parties.

X.

Guide students to Table 6-1, which lists key U.S. laws of interest that information security professionals should be cognizant of when managing information in an organization.

Identity Theft I.

Classify what is considered identity theft and provide examples of what personally identifiable information (PII) are that are often stolen. Note from the text that approximately 10% of persons age 16 or older have been a victim of identity theft at least once in the prior calendar year (12 months).

II.

Reference Tables 6-2 and 6-3 for additional insight and a detailed analysis of the types of identity theft and how they have increased between 2014 and 2016.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

III.

Recognize that in May 2006, President Bush signed an executive order creating the Identity Theft Task Force. The goals of this group are to create a strategic plan to improve efforts of the government and private organizations and individuals in combating identity theft. The group seeks better coordination among groups, more effective prosecution of criminals engaged in these activities, and methods to increase restitution made to victims.

IV.

Discuss the fact that numerous states have laws in place specific to identity theft. However, at the federal level, the primary legislation as described is the Fraud and Related Activity in Connection With Identification Documents, Authentication Features, And Information (Title 18, U.S.C. § 1028). This criminalizes the creation, reproduction, transfer, possession, or use of unauthorized or false identification documents or document-making equipment. Penalties for such offenses range from one to 25 years in prison and fines as determined by the courts.

V.

Outline the four steps individuals can do when there is a suspicion or actual case of identity theft:

VI.

•

Place an initial fraud alert.

•

Order your credit reports.

•

Create an identity theft report.

•

Monitor your progress.

Justify that the most up-to-date version of the CFAA is the Identity Theft Enforcement and Restitution Act, which specifically addressed the malicious use of spyware or keyloggers to steal PII. This act also created a new designation of a level of identity theft that provided much stronger penalties for violators who used 10 or more computers to commit theft. The penalties that may be levied under this act include substantial fines, from which the restitution is paid, and prison terms of up to 10 or 20 years, depending on the severity of the crime.

Export and Espionage Laws I.

Establish an understanding that the federal government enacted legislation attempting to protect American ingenuity, intellectual property, and competitive advantage with the help of Congress by passing the Economic Espionage Act (EEA) in 1996. This law attempts to prevent trade secrets from being illegally shared.

II.

Relate the understanding that to further enhance this previous legislation, an additional law was enacted in 1999, the Security and Freedom Through Encryption Act of 1999 (SAFE), which provides guidance on the use of encryption and provides measures of protection from government intervention. The following provisions apply to this piece of legislation:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

•

Reinforce a person’s right to use or sell encryption algorithms without concern for regulations requiring some form of key registration. Key registration is the storage of a cryptographic key (or its text equivalent) with another party for breaking the encryption of data. This is often called “key escrow.”

•

Prohibit the federal government from requiring the use of encryption for contracts, grants, and other official documents and correspondence.

•

State that the use of encryption is not probable cause to suspect criminal activity.

•

Relax export restrictions by amending the Export Administration Act of 1979.

•

Provide additional penalties for the use of encryption in the commission of a criminal act.

U.S. Copyright Law I.

Illustrate to students that intellectual property is recognized as a protected asset in the United States. U.S. copyright laws extend this privilege to the published word, which includes electronic formats.

II.

Explain how fair use of copyrighted materials includes their use to support news reporting, teaching, scholarship, and many other related activities, provided the use is for educational or library purposes, not for profit, and is not excessive.

III.

Emphasize that if proper acknowledgment is provided to the original author of such works, including a proper citation, and the work is not represented as one’s own, it is entirely permissible to include portions of someone else’s work as reference.

Financial Reporting I.

Recall that the Sarbanes–Oxley Act of 2002, which is a critical piece of legislation that affects the executive management of publicly traded corporations and public accounting firms, seeks to improve the reliability and accuracy of financial reporting, as well as increase the accountability of corporate governance, in publicly traded companies.

II.

Emphasize that executives working in firms covered by this law will seek assurance on the reliability and quality of information systems from senior information technology managers who, in turn, will likely ask information security managers to verify the confidentiality and integrity of those same information systems.

Freedom of Information Act of 1966 I.

Justify that this law provides the right of any person to request access to federal agency records or information not determined to be a matter of national security.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

These requests must be provided to them in writing and are enforceable in court should noncompliance occur. II.

Stress that this does not apply to state or local government agencies, private businesses, or individuals, with exception to states having their own Freedom of Information Act (FOIA).

Payment Card Industry Data Security Standards (PCI DSS) I.

Explain that the Payment Card Industry (PCI) Security Standards Council offers a standard of performance to which participating organizations must comply. Point out that it is not a law, but is a standard designed to enhance the security of customers’ account data.

II.

Review the six areas that the PCI DSS addresses with respect to security policies, procedures, and management, as well as technical software and networking specifications. •

Build and maintain a secure network and systems

•

Protect cardholder data

•

Maintain a vulnerability management program

•

Implement strong access control measures

•

Regularly monitor and test networks

•

Maintain an information security policy

State and Local Regulations I.

Remind students that in addition to the national and international restrictions placed on organizational use of computer technology, each state or locality may have a number of its own applicable laws and regulations.

II.

Apply the examples provided in the text how the state of Georgia passed legislation in 1991 and 1998 (the latter being updated in 2002 and 2010). Stress to students that information security professionals must be aware such legislation to ensure that the organization’s security policies and procedures comply with those laws and regulations.

Quick Quiz 1 1. What is a type of law that represents all laws that apply to a citizen (or subject) of a jurisdiction? a. criminal law b. private law

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

13

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

c. civil law d. public law Answer: c 2. What is a type of law that addresses violations harmful to society and that is enforced by prosecution by the state? a. criminal law b. private law c. public law d. civil law Answer: a 3. Which law regulates the role of the healthcare industry in protecting the privacy of individuals? a. GLB b. FOIA c. HIPAA d. CFAA Answer: c 4. The generally recognized term for the government protection afforded to intellectual property (written and electronic) is called which of the following? a. computer security law b. copyright law c. aggregate information d. data security standards Answer: b 5. True or False: The cornerstone of many current federal computer-related criminal laws is the Computer Fraud and Abuse Act of 1986. Answer: True 6. True or False: Regardless of what information a company manages, it is shielded from local and state laws and regulations because the federal laws supersede them. Answer: False

International Laws and Legal Bodies (6.3, PPT Slides 32–35) © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

14

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

I.

Determine that it is important for IT professionals and information security practitioners to realize that when their organizations do business on the Internet, they do business globally. This is especially true with the advent of the Internet and globalization of the marketplace.

II.

Explain that professionals who conduct business internationally must be sensitive to the laws and ethical values of numerous cultures, societies, and countries.

III.

Stress the facts that there are few international laws applicable to privacy and information security, but the ones that exist are limited in their enforceability. This can potentially create challenges and or issues for an organization that is located in multiple countries.

U.K. Computer Security Laws I.

Compare and contrast laws that are enforceable in the United Kingdom (U.K.) with the ones that have been described in the United States. Ones of importance and described in the text are the following: •

Computer Misuse Act, 1990: Defines three “computer misuse offenses”: unauthorized access to computer material, unauthorized access with intent to commit or facilitate commission of further offenses, and unauthorized acts with intent to impair, or with recklessness as to impairing, operation of computers, etc.

•

Privacy and Electronic Communications (EC Directive) Regulations, 2003: Revoked the Data Protection and Privacy Regulations of 1999 and focuses on protection against unwanted or harassing phone, e-mail, and SMS messages.

•

Police and Justice Act, 2006: Updated the Computer Misuse Act, modified the penalties, and created new crimes defined as “unauthorized acts with intent to impair operation of computers, etc.,” and the manufacture or provision of materials used in computer misuse offenses.

•

Personal Internet Safety, 2007: A report published by the House of Lords Science and Technology Committee provided a public service and criticized the U.K. government’s lack of action in protecting personal Internet safety.

Australian Computer Security Laws I.

Review laws that are currently enforceable in Australia and determine how they are similar yet different to ones that are in place here in the United States. Discuss with students the following laws mentioned in the text as described here: •

Privacy Act, 1988: Regulates the collection, storage, use, and disclosure of personal information. Applies both to private and public sectors. Contains 11 information privacy principles for handling personal information by most public-

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

15

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

sector agencies, and 10 national privacy principles for handling of personal information by nongovernment agencies. •

Telecommunications Act, 1997: Updated as of October 2013; contains regulation related to the collection and storage of privacy data held by telecommunications service providers.

•

Corporations Act, 2001: Updated by the Corporations Regulations of 2001 and 2002; focuses on business relationships but, like SOX, contains provisions related to financial reporting and audits.

•

Spam Act, 2003: Legislation designed to regulate the amount of unwanted commercial marketing materials, especially via e-mail. Requires businesses to obtain consent of recipients, ensure that businesses accurately identify the recipients, and provide a mechanism by which the recipients may unsubscribe from commercial messages.

•

Cybercrime Legislation Amendment Bill, 2011: Designed to align Australian laws with the European Convention on Cybercrime (see next section); the bill specifies information that communications carriers and Internet service providers must retain and surrender when requested by law enforcement.

Council of Europe Convention on Cybercrime I.

Explain that the Council of Europe adopted the Convention on Cybercrime in 2001. It provides for the creation of an international task force to oversee a range of security functions associated with Internet activities for standardized technology laws across international borders. It also attempts to improve the effectiveness of international investigations into breaches of technology law.

II.

Relate that the updated set of laws known as the General Data Protection Regulation (GDPR) has specific requirements regarding the transfer of data from the EU. One of these requirements is that transfers can occur only to countries deemed to have adequate data protection laws. The Privacy Shield is designed to implement a program in which participating companies are deemed as having adequate protection, which will facilitate the transfer of information.

World Trade Organization and the Agreement on Trade-Related Aspects of Intellectual Property Rights I.

Explain how the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS), created by the World Trade Organization (WTO), introduced intellectual property rules into the multilateral trade system.

II.

Outline the five issues that the WTO TRIPS agreement covers, as mentioned in the text:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

16

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

•

How basic principles of the trading system and other international intellectual property agreements should be applied

•

How to give adequate protection to intellectual property rights

•

How countries should enforce those rights adequately in their own territories

•

How to settle disputes on intellectual property between members of the WTO

•

Special transitional arrangements during the period when the new system is being introduced

Digital Millennium Copyright Act I.

Explain how the Digital Millennium Copyright Act (DMCA) is the American contribution to an international effort to reduce the impact of copyright, trademark, and privacy infringement, especially through the removal of technological copyright protection measures.

II.

Discuss with students how in 1995 the European Union had adopted Directive 95/46/EC, which added protection for individuals with regard to the processing of personal data and the use and movement of such data. Note that the United Kingdom has implemented its own version known as the Database Right to comply with this directive.

III.

Classify the provisions of the DMCA:

IV.

•

Prohibits the circumvention of protections and countermeasures implemented by copyright owners to control access to protected content.

•

Prohibits the manufacture of devices to circumvent protections and countermeasures to control access to protected content.

•

Bans trafficking in devices manufactured to circumvent protections and countermeasures to control access to protected content.

•

Prohibits the altering of information attached or imbedded into copyrighted material.

•

Excludes Internet service providers from certain forms of contributory copyright infringement.

Recall that in June 2016, the United States and the European Union (EU) signed an agreement that would supersede the Safe Harbor agreement. This new agreement serves as a data privacy umbrella for EU citizens and allows cooperation between American and European law enforcement agencies in criminal investigations. However, due to the ambiguity of this agreement, companies have considered the adoption of Binding Corporate Rules (BCRs) accreditation.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

17

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

Ethics and Information Security (6.4, PPT Slides 36–41) I.

Justify that many professional groups have explicit rules governing ethical behavior in the workplace. Note that the information technology and security fields do not have a binding code of ethics.

II.

Detail that professional associations (such as the Association for Computing Machinery and the Information Systems Security Association) and accreditation agencies (such as ISC2) work to establish the profession’s ethical codes of conduct instead.

III.

Recall and encourage students to review the Ten Commandments of Computer Ethics provided in the module.

Ethical Differences Across Cultures I.

Discuss cultural differences that can make it difficult to determine what is and is not ethical, especially when it comes to the use of computers. Note that there are challenges that can arise when one nationality’s ethical behavior is seen as unethical in another national group.

II.

Recall that approximately 90 percent of all software is created in the United States, though 37 percent of all software installed was not properly licensed.

III.

Review the study published in 1999 examining computer-use ethics. Discuss the following conclusions from the study, applying the information in Table 6-5: •

The study selected several computer-use vignettes and presented them to students in universities in nine nations.

•

Responses indicated a degree of ethical sensitivity or knowledge about the performance of the individuals in the short case studies.

•

The scenarios were grouped into three categories of ethical computer use: software license infringement, illicit use, and misuse of corporate resources.

Software License Infringement I.

Review the findings from the study and draw conclusions from the following observations from the study results: •

Overall, most of the nations studied had similar attitudes toward software piracy.

•

Statistically speaking, only the United States and the Netherlands had attitudes that differed substantially from those of all other countries examined.

•

The United States was significantly less tolerant of piracy, while the Netherlands was significantly more permissive.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

18

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

•

II.

Peer pressure, the lack of legal disincentives, the lack of punitive measures, or any one of a host of other reasons could also explain why these alleged piracy centers were not oblivious to intellectual property laws.

Emphasize strongly that software license infringement is a serious issue for an information security team, as invalid software on a network can result in numerous financial and nonfinancial consequences for an organization.

Illicit Use I.

Demonstrate that there was a common theme between countries where participants condemned viruses, hacking, and other forms of system abuse.

II.

Establish the fact, though, that there were different degrees of tolerance among groups measured.

Misuse of Corporate Resources I.

Outline that overall, the use of company equipment of personal use was lenient among the groups polled.

II.

Denote that Singapore and Hong Kong were the only countries that viewed the personal use of company equipment as unethical.

III.

Comment that overall, the researchers found that there is a general agreement among nationalities as to what is acceptable or unacceptable computer use.

IV.

There is, however, a range of views as to whether some actions are moderately or highly unacceptable.

Ethics and Education I.

Emphasize that employees must be trained and kept aware of many topics related to information security, not the least of which are the expected behaviors of an ethical employee and cultural differences that can make it difficult to determine what is and is not ethical, especially when it comes to the use of computers.

II.

Recall the fact that it is critically important in information security that many employees may not have the formal technical training to understand that their behavior is unethical or even illegal. Hence, this gap must be closed as promptly as possible with relevant training and knowledge so they can be accountable for unethical actions they may do unknowingly or otherwise.

Deterring Unethical and Illegal Behavior I.

Justify strongly that it is the responsibility of information security personnel to do everything in their power to deter illegal, immoral, or unethical behavior and to use policy, education and training, and technology to protect information and systems.

II.

Compose and describe the three general causes of illegal behavior:

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

19

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

III.

•

Ignorance: Ignorance of the law is no excuse; however, ignorance of policy and procedures is. The first method of deterrence is education, which is accomplished by designing, publishing, and disseminating an organization’s policies and relevant laws, and by obtaining agreement to comply with these policies and laws from all members of the organization. Reminders, training, and awareness programs keep policy information in front of employees to support retention and compliance.

•

Accident: People who have authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident. Careful planning and control help prevent accidental modification to systems and data.

•

Intent: Criminal or unethical intent goes to the state of mind of the person performing the act; it is often necessary to establish criminal intent to successfully prosecute offenders. Protecting a system against those with intent to cause harm or damage is best accomplished by means of technical controls, and vigorous litigation or prosecution if these controls fail.

Relate the three conditions that are present that deter people from executing illegal or unethical behaviors (apply the graphical reference in Figure 6-4 as part of the conversation): •

Penalties: Potential offenders must fear the penalty. Threats of informal reprimand or verbal warnings do not have the same impact as the threat of imprisonment or forfeiture of pay.

•

Apprehension: Potential offenders must have the knowledge that there is a strong chance they will likely be caught.

•

Application of penalties: There must be an awareness of the potential offenders that penalties will likely be administered should something occur.

Code of Ethics of Professional Organizations (6.4, PPT Slides 42–47) I.

Explain how many professional organizations have established codes of conduct or codes of ethics that members are expected to follow.

II.

Stress that codes of ethics often have a positive effect on an individual’s judgment regarding computer use. Comment that the awareness factor is one of many that steers personnel to do the right things, as they know they can be called out or caught.

III.

Guide students to review Table 6-6, as it provides the most common professional organizations applicable to information security professionals.

Major IT and InfoSec Professional Organizations © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

20

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

I.

Explain that most IT and information security organizations have their own codes of ethics, and what is contained in them may vary from one another.

Association for Computing Machinery (ACM) I.

Present that fact that the ACM (www.acm.org) is a respected professional society, originally established in 1947 as “the world's first educational and scientific computing society.”

II.

Summarize that the ACM’s code of ethics requires members to perform their duties in a manner befitting an ethical computing professional. The code contains specific references to protecting the confidentiality of information, causing no harm, protecting the privacy of others, and respecting the intellectual property and copyrights of others.

International Information Systems Security Certification Consortium, Inc. (ISC)2 I.

Distinguish to students that (ISC)2 is a nonprofit organization that focuses on the development and implementation of information security certifications and credentials. Its code of ethics is primarily designed for information security individuals who have earned a certification from the organization.

II.

Describe the four-mandatory ethical canons as outlined in the text with respect to this organization: •

Protect society, the commonwealth, and the infrastructure.

•

Act honorably, honestly, justly, responsibly, and legally.

•

Provide diligent and competent service to principals.

•

Advance and protect the profession.

SANS I.

Describe the System Administration, Networking, and Security Institute (SANS), a professional organization with a large membership group, with over 153,000 members since its inception in 1989, that is dedicated to the protection of information and systems.

II.

Report that SANS offers a set of certifications called the Global Information Assurance Certification, or GIAC.

ISACA I.

Relate that this organization was originally known as the Information Systems Audit and Control Association. ISACA is a professional association that focuses on auditing, control, and security. The membership comprises both technical and managerial professionals.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

21

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

II.

Justify that its main purpose is to provide IT control practices and standards and includes many information security components within its areas of concentration, although it does not focus exclusively on information security.

Information Systems Security Association (ISSA) I.

Comment that this organization is a nonprofit society of information security professionals. As a professional association, its primary mission is to bring together qualified practitioners of information security for information exchange and educational development.

II.

Apply the fact that ISSA also promotes a code of ethics whose focus is “promoting management practices that will ensure the confidentiality, integrity, and availability of organizational information resources.”

EC-Council I.

II.

Explain that this is a security organization founded by Jay Bavisi that offers a variety of security, technical, and managerial certifications. This includes its renowned Certified Ethical Hacker (CEH) and CCISO certifications. Emphasize the organization promotes a 19-point code of ethics for its certificateholding programs and recommend that students visit https://www.eccouncil.org/code-of-ethics/ for more information.

Key U.S. Federal Agencies (6.5, PPT Slides 48–52) I.

Discuss the key U.S. federal agencies charged with the protection of American information resources and the investigation of threats to, or attacks on, these resources.

Department of Homeland Security I.

Describe the Department of Homeland Security (DHS), created in 2003 through the Homeland Security Act of 2002, which was passed in response to the events of September 11, 2001.

II.

Outline the structure of DHS and its five directorates or divisions through which it carries out its mission of protecting the people, as well as the physical and informational assets, of the United States. Note the ones that are applicable to information security in the text:

• III.

The Science and Technology Directorate is responsible for research and development activities in support of homeland defense.

Identify that DHS works with academic institutions nationally, focusing on resilience, recruitment, internationalization, growing academic maturity, and academic research.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

22

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

IV.

Emphasize that its efforts are ensuring the continuing examination of vulnerabilities throughout the nation’s infrastructure. This occurs through the extended role from its cybersecurity and Infrastructure Security Agency (CISA), which offers a variety of services to government, industry and the private sector, academia, nonprofit/NGO organizations, and the general public through its services portal, as illustrated in its services catalog.

US-CERT I.

Explain that the U.S. Computer Emergency Readiness Team (US-CERT) is a division of DHS’s National Cybersecurity and Communications Integration Center (NCCIC). Note that DHS provides mechanisms to report phishing, malware, software vulnerabilities, and other types of security incidents.

U.S. Secret Service I.

Describe the U.S. Secret Service, which was relocated from the Department of the Treasury to the DHS in 2002. They have been charged with the responsibility of safeguarding the nation’s financial infrastructure and payment systems to preserve the integrity of the economy.

II.

Discuss the strategic objectives that address cybersecurity-related activity as mentioned in the text relative to this organization.

Federal Burau of Investigation (FBI) I.

Recognize that this group is the primary U.S. law enforcement agency, and it investigates both traditional crimes and cybercrimes, as well as works with the U.S. Attorney’s Office to prosecute suspects under federal law (the U.S. Code).

II.

Review the focus and priorities of this agency and that computer network intrusions, identity theft, and fraud are the ones for which it is the most concerned with respect to information security crimes.

National InfraGard Program I.

Explain that the national InfraGard program began as a cooperative effort between the FBI’s Cleveland field office and local technology professionals, and it was established in January 2001.

II.

Summarize the following points made in the text with respect to this program, which is used to share information about attacks, vulnerabilities, and threats: •

This is a collaborative effort between public and private organizations as well as the academic community.

•

The national InfraGard program serves its members in four basic ways: maintaining an intrusion alert network using encrypted e-mail; providing and

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

23

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

upkeeping a secure Web site for communication about suspicious activity or intrusions; sponsoring local chapter activities; and operating a help desk for questions.

National Security Agency (NSA) I.

Identify the purpose of the NSA and what it is responsible for within the federal government. Discuss the following with students with respect to this agency: •

The NSA is responsible for signals intelligence and information system security.

II.

Explain that the IAD is responsible for the protection of systems that store, process, and transmit classified information.

III.

Emphasize that the NSA has a program to certify curriculum in information security. •

The Information Assurance Courseware Evaluation process examines information security courses in an institution and, if accepted, provides a threeyear accreditation.

•

Graduates of these programs receive certificates that indicate this accreditation.

Quick Quiz 2 1. Which of the following is an American contribution to an effort to improve copyright protection internationally? a. Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) b. Digital Millennium Copyright Act (DMCA) c. Privacy and Electronic Communications Regulations of 2003 d. Telecommunications Act of 1997 Answer: b 2. Which of the following respected professional society was founded in 1947 as "the world’s first educational and scientific computing society"? a. Council of Europe Convention on Cybercrime b. SANS c. Information Systems Security Association d. Association of Computing Machinery (ACM) Answer: d 3. What is the name of a nonprofit organization that focuses on the development and implementation of information security certifications? a. International Information Systems Security Certification Consortium, Inc

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

24

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

b. Information Systems Audit and Control Association c. System Administration, Networking, and Security Institute d. Information Systems Security Association Answer: a 4. True or False: The Federal Bureau of Investigation (FBI) is the federal agency responsible for signal intelligence and information system security of classified systems. Answer: False 5. True or False: The National Security Agency (NSA) is responsible for the security of all national critical infrastructure. Answer: False [return to top]

Discussion Questions You can assign these questions several ways: in a discussion forum in your LMS, as wholeclass discussions in person, or as a partner or group activity in class. These questions are separate from the review questions and exercises in the textbook. For answers to the textbook questions, see the associated solutions for this module. Additional class discussion options: 1. Compile a list of ethical dilemmas your students might face when they are on the job. Pose them as thought problems or ask students to explain their choices. (6.1, 6.2, PPT Slides 3–7, 10–17, 20–23, and 26–31) Duration 15 minutes. 2. Privacy is a hot-button topic for most students. Discuss how the definition of privacy that is commonly used (freedom from observation) may differ from the definition of privacy from the information security perspective (freedom from unsanctioned intrusion). (6.2, 6.4, PPT Slides 3–7, 10–17, 20–23, 26–52) Duration 15 minutes. 3. Regulation of information and the systems it resides in has increased dramatically over the years. Poll students in the course and ask them if there is (a) not enough regulation, (b) enough regulation, or (c) more regulation needs to be in place, and why? (6.2, 6.3, 6.5, PPT Slides 3–7, 10–17, 20–23, 26–35, and 48–52) Duration 15 minutes. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

25

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

Suggested Usage for Lab Activities A series of hands-on labs has been developed to complement the text material for this course and are available for download at the Instructor Center. The labs do not depend on specific chapter content, so instructors can insert them where they best suit the syllabus. The following is a list of lab titles, objectives, and approximate durations to assist with lesson planning. Lab Title Ethical Considerations in IT and Detecting Phishing Attacks

Web Browser Security

Malware Defense

Windows Password Management

Backup and Recovery and File Integrity Monitoring

Objective Upon completion of this activity, you will: • have a better understanding of the ethical expectations of IT professionals; and • be able to identify several types of social engineering attacks that use phishing techniques. Upon completion of this activity, the student will be able to: • Review and configure the security and privacy settings in the most popular web browsers. Upon completion of this activity, the student will be able to: • Understand the basic setup and use of an open-source AV product. • Install and use Clam AV on a Windows system. • Using a USB storage device create a portable AV scanner. • Understand what a YARA file is and how it is used. Upon completion of this activity, the student will be able to: • Review and configure password management policies in a Windows client computer. Upon completion of this activity, you will be able to: • Describe backup and recovery processes and will be aware of

Duration Ethical Considerations lab in 15 to 20 minutes. Phishing E-Mail lab in 60 to 75 minutes.

1 to 1.5 hours

1 to 1.5 hours

30 minutes to 1 hour

15–20 minutes

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

26

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

OS Processes and Services

Log Management & Security

Footprinting, Scanning, and Enumeration

AlienVault OSSIM

Image Analysis Using Autopsy

basic backup activities using Windows 10 or another desktop operating system (OS). • Perform file integrity monitoring using file hash values. Upon completion of this activity, the student will be able to: • Review available and enabled OS services. • Review available and enabled OS processes. • Review current system resource utilization. Upon completion of this activity, the student will be able to: • Access and review the various logs present in a Windows 10 computer. Upon completion of this activity, the student will be able to: • Identify network addresses associated with an organization. • Identify the systems associated with the network addresses. Upon completion of this activity, the student will be much more knowledgeable about the AlienVault OSSIM software and how to install, configure, and operate it. You will use the software more extensively in a subsequent lab. Upon completion of this activity, the student will be able to perform basic drive image analysis using the Autopsy software package.

60–90 minutes

30 minutes to 1 hour

40–60 minutes

2–3 hours

45–70 minutes

[return to top]

Additional Activities and Assignments Please see associated solutions for the Closing Scenario at the end of the textbook module. Additional project options include: © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

27

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

1. Have each student find a newspaper or magazine article from the past month that shows a conviction or the ongoing prosecution of a cybercrime perpetrator. 2. Invite students who are employed in larger organizations to write a short essay that documents the enforceability of their organization’s information security according to the terms expressed in the “Policy Versus Law” section on page 225. [return to top]

Additional Resources Cengage Video Resources •

MindTap Video: Intellectual Property and Copyright Law

Internet Resources • • • • • • • •

Center for Democracy and Technology Electronic Frontier Foundation Elcomsoft Verdict: Not Guilty FISMA Implementation Project Legal in US: Jailbreaking your iPhone, ripping a DVD for educational purposes National Security Agency (NSA) PCI DSS Summary of the HIPAA Security Rule

[return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

28

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 6: Legal, Ethical, and Professional Issues in Information Security

Appendix Grading Rubrics Providing students with rubrics helps them understand expectations and components of assignments. Rubrics help students become more aware of their learning process and progress, and they improve students’ work through timely and detailed feedback. Customize these rubrics as you wish. The grading rubric suggests a 4-point scale, and the discussion rubric indicates 30 points. Grading Rubric These grading criteria can be applied to open-ended Review Questions, Real-World Exercises, Case Studies, and Security for Life activities. 3 2 1 0 Exceeds Expectations Meets Expectations Needs Improvement Inadequate • Student • Student • Student’s • Student’s response demonstrates demonstrates response is missing or accurate accurate demonstrates a incomplete. understanding of understanding of gap in • Student’s response the concept. the concept. understanding of demonstrates a • Student applies the • Student applies the concept. critical gap in concept the concept • Student applies understanding. appropriately. appropriately. the concept • Student is unable • Student uses • Student develops incorrectly. to apply the sound critical a complete • Student’s concept. analysis to develop response to the response is poorly an insightful and prompt. developed or comprehensive incomplete. response to the prompt. [return to top]

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

29

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

Instructor Manual Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

Table of Contents Purpose and Perspective of the Module ..................................................................................... 2 Cengage Supplements .................................................................................................................. 2 Module Objectives ......................................................................................................................... 2 Complete List of Module Activities and Assessments ................................................................ 2 Key Terms ....................................................................................................................................... 3 What's New in This Module .......................................................................................................... 3 Module Outline .............................................................................................................................. 4 Discussion Questions .................................................................................................................. 27 Suggested Usage for Lab Activities ............................................................................................ 28 Additional Activities and Assignments ....................................................................................... 30 Additional Resources................................................................................................................... 30 Cengage Video Resources ....................................................................................................................... 30 Internet Resources .................................................................................................................................. 31 Appendix ...................................................................................................................................... 32 Grading Rubrics ....................................................................................................................................... 32

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

1

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

Purpose and Perspective of the Module In this module, students will review where and how the information security should be positioned within an organization. This includes the people responsible for it and their role and credentials they could receive to gain more credibility within the industry. Near the end of the module, students will gain an understanding of how employment policies and practices can support the effort. This includes special security controls and considerations that applies to personnel management.

Cengage Supplements The following product-level supplements provide additional information that may help you in preparing your course. They are available in the Instructor Resource Center. •

PowerPoint slides

•

Test banks, available in Word, as LMS-ready files, and on the Cognero platform

•

MindTap Educator Guide

•

Solution and Answer Guide

•

This instructor’s manual

Module Objectives The following objectives are addressed in this module: 7.1

Describe where and how the information security function should be positioned within organizations.

7.2

Explain the issues and concerns related to staffing the information security function.

7.3

List and describe the credentials that information security professionals can earn to gain recognition in the field.

7.4

Discuss how an organization’s employment policies and practices can support the information security effort.

7.5

Identify special security controls and privacy considerations for personnel management.

Complete List of Module Activities and Assessments For additional guidance refer to the MindTap Educator Guide. Module Objective 7.1 7.2

PPT slide

Activity/Assessment

Duration

6–7 15–16

Knowledge Check Activity 1 Knowledge Check Activity 2

2 minutes 2 minutes

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

2

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

7.3 7.4

28–29 45–46 59 MindTap MindTap MindTap

Knowledge Check Activity 3 Knowledge Check Activity 4 Self-Assessment Module 07 Review Questions Module 07 Case Exercises Module 07 Exercises

MindTap MindTap

Module 07 Security for Life Module 07 Quiz

2 minutes 2 minutes 5 minutes 30–40 minutes 30 minutes 10–30 minutes per question; 1+ hour per module 1+ hour 10–15 minutes

[return to top]

Key Terms In order of use: exit interview: A meeting with an employee who is leaving the organization to remind the employee of contractual obligations, such as nondisclosure agreements as well as to obtain feedback about the employee’s tenure. separation of duties: The principle that requires significant tasks to be split up so that more than one employee is required to complete them. two-person control: The organization of a task or process so that at least two employees must work together to complete it. Also known as dual control. job rotation: The requirement that every employee be able to perform the work of another employee. task rotation: The requirement that all critical tasks can be performed by multiple employees. need to know: The principle of limiting users’ access privileges to the specific information required to perform their assigned tasks. least privilege: The data access principle that ensures no unnecessary access to data exists by regulating members so they can perform only the minimum data manipulation needed: least privilege implies a need to know. [return to top]

What's New in This Module The following elements are improvements in this module from the previous edition: •

This module was Chapter 11 in the 6th edition.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

3

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

•

The entire module was refreshed with a general update and given more current examples.

[return to top]

Module Outline Introduction to Security and Personnel (7.1, PPT Slide 3) I.

Review the key tasks specific to security and personnel that must be done as early as possible to implement information security within an organization. •

First, the organization must decide how to position and name the security function.

•

Second, the information security community of interest must plan for the proper staffing for the information security function.

•

Third, the IT community of interest must assess the impact of information security on every IT function and adjust job descriptions and documented practices accordingly.

•

Finally, the general management community of interest must work with the information security professionals to integrate solid information security concepts into the personnel management practices.

II.

Learn that a behavioral feasibility study must be conducted before any program is carried out. This includes getting employee feedback early in the process, so it can be taken up for consideration when the plan is developed.

III.

Express to students three common questions that are brought up when an information security plan is constructed from personnel that will be impacted by it: •

Will management be monitoring my work or my e-mail?

•

Will information security staff go through my hard drive looking for evidence to fire me?

•

Will the information security changes affect how efficient and effective I am in my job?

Positioning the Security Function (7.2, PPT Slide 4) I.

Emphasize that often in large organizations, the information technology (IT) department houses the information security (IS) department and designates a chief information security officer (CISO) or chief security officer (CSO) to operate it.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

4

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

II.

Advocate to learners that according to the 2019 (ISC) Cybersecurity Workforce study, the fewer the people in an organization, the less likely a CISO or CSO would be handling security duties.

III.

Stress that the CISO most commonly reports directly to the company’s top computing executive, the CIO or vice president for IT. Such a structure implies that the goals and objectives of the CISO and CIO are aligned, but this is not always the case.

IV.

Review the core functions that often a CISO or CSO complete daily.

V.

Justify the fact that often a CIO and CISO tend to contradict each other which requires an organization to have to two separate departments to keep the peace.

VI.

Outline the best practices listed in Cresson Wood’s book, Information Security Roles and Responsibilities Made Easy, that an organization should implement so that an information security program is positioned for success within any of the following organizational functions:

VII.

•

IT as a peer of other subfunctions such as networks, applications development, and the help desk.

•

Physical security as a peer of physical security or protective services.

•

Administrative services as a peer of human resources or purchasing.

•

Insurance and risk management.

•

The legal department.

Relate that once a structure has been identified, the next challenge that an organization often faces is the establishment of a reporting structure that balances competing needs of each community of interest they will serve. This balance is between keeping information safe and secure while integrating it into the culture through training, awareness, and support services.

Staffing the Information Security Function (7.2, PPT Slides 8–14 and 19– 22) I.

Discuss the criteria on which selecting information security personnel is based, including the principles of supply and demand. This is likely a combination of experience, certifications, and knowledge.

II.

Recall that most information security (IS) professionals who are wanting to enter the market will do so by gaining the skills, experience, and credentials they need to qualify as a new supply.

III.

Understand that if the new supply of professionals is limited, an organization will have to pay more to get the best talent in the door to meet their needs. Alternately,

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

5

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

the opposite is true once the supply meets or exceeds the demand. That is when an organization that needs to hire these individuals can become selective, and the pay they offer drops. IV.

Quantify the fact that by 2029, it is estimated that there will be a 31 percent increased demand for IS professionals and outpaces the 4 percent growth average for other occupations according to the Bureau of Labor Statistics (BLS).

V.

Recommend students review Figure 7-2 to emphasize where demand for personnel is likely the greatest in the field of information security.

VI.

Assess that with current projections and the pace of hiring, there will be a continued shortfall of personnel which could, in turn, put organizations at risk if they are unable to bring in professionals to maintain and protect their data.

Qualifications and Requirements I.

Justify the fact that with information security being a new field, it is often rife with a lack of understanding about what qualifications applicants need to fit in the roles they fill.

II.

Assess the recommendations provided with respect to how an organization can optimize their hiring practices. As mentioned in the text, they are the following: •

The general management community of interest should learn more about the skills and qualifications for information security positions and IT positions that affect information security.

•

Upper management should learn more about the budgetary needs of information security and its positions.

•

This knowledge will enable management to make sound fiscal decisions for information security and the IT functions that carry out many information security initiatives.

•

The IT and general management communities should grant appropriate levels of influence and prestige to information security, especially to the role of CISO.

III. Examine the fundamentals that an IS professional must understand in order to be, at a minimum, considered for an interview or conversation: •

How an organization operates at all levels.

•

Awareness that information security is usually a management problem and is seldom an exclusively technical problem.

•

How to work with people and collaborate with end users, and the importance of strong communications and writing skills.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

6

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

•

The role of policy in guiding security efforts, and the role of education and training in making employees and other authorized users’ part of the solution rather than part of the problem.

•

Most mainstream IT technologies at a general level, not necessarily as an expert.

•

The terminology of IT and information security.

•

The threats facing an organization and how they can become attacks.

•

How to protect an organization’s information assets from attacks.

•

How business solutions, including technology-based solutions, can be applied to solve specific information security problems.

Entry into the Information Security Profession I.

Outline and classify the two common points of entry that information security professionals come from. These are often ex-law enforcement and military personnel and technical professionals.

II.

Gain awareness that college graduates and upper-division students are selecting and tailoring degree programs to prepare to work in the field of information security.

III.

Assess the common current perception of information security is that a security professional must first be a proven professional in another field of IT. However, IT professionals who move into information security tend to focus on the technology, sometimes in place of general information security issues.

Information Security Positions I.

Applying the use of standard job descriptions can increase the degree of professionalism in the information security field as well as improve the consistency of roles and responsibilities among organizations.

II.

Recommend to students that organizations which are revising the roles and responsibilities of information security staff should consult Wood’s book, Information Security Roles and Responsibilities Made Easy.

III.

Present the common job position categories provided in Figure 7-4 and where they are commonly located in an organization’s IS hierarchy.

Chief Information Security Officer (CISO) I.

Comprehend that a CISO is often the top information security officer in an organization.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

7

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

II.

Recognize the facts that CISO’s are often business managers first and technologists second and may not be in an executive-level position depending on the organization.

III.

Outline the responsibilities of a CISO:

IV.

•

Manages the overall information security program for the organization.

•

Drafts or approves information security policies.

•

Works with the CIO on strategic plans, develops tactical plans, and works with security managers on operational plans.

•

Develops information security budgets based on available funding.

•

Sets priorities for the purchase and implementation of information security projects and technology.

•

Makes decisions or recommendations for the recruiting, hiring, and firing of security staff.

•

Acts as the spokesperson for the information security team.

Recall that the most common certification for this type of position is a Certified Information Security Manager (CISM). Additionally, a graduate degree in one of the following areas is also often required: criminal justice, business, or information technology.

Chief Security Officer (CSO) I. Compare and contrast the differences between a CISO and CSO. Depending on the organization, the CISO’s position may be combined with physical security responsibilities or may even report to a security manager who is responsible for both logical (information) security and physical security. II. Stress to students that a CSO must be capable and knowledgeable in both information security requirements and the “guards, gates, and guns” approach to protecting the physical infrastructure, buildings, and grounds of a place of business. III. Recommend that professional experience a CSO possesses often is being a security manager with planning, policy, and budget experience.

Security Manager I. Apply knowledge presented in the text that security managers are accountable for the day-to-day operation of the information security program. They accomplish the objectives that are identified by the CISO and resolve issues that are identified by technicians.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

8

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

II. Recall that candidates for this position often have a CISSP. Traditionally, managers earn the CISSP, and technical professionals earn the Global Information Assurance Certification (GIAC). III. Identify the facts that security managers must have the ability to draft middle- and lower-level policies as well as standards and guidelines. They must have experience in traditional business matters, including budgeting, project management, and hiring and firing. They must also be able to manage technicians, both in the assignment of tasks and in the monitoring of activities. IV. Gain awareness that general job descriptions for this type of position often create confusion with respect to the title of the position and reporting relationship.

Security Analyst I. Establish that security analysts are often known as security technicians, security architects, and/or security engineers. II. Examine the core duties of security analysts. Based on the need, they are technically qualified employees who configure firewalls, deploy IDPSs, implement security software, diagnose, and troubleshoot problems, and coordinate with administrators to ensure that security is properly implemented. III. Review the fact that this position is often entry-level, but some technical skills are required for professionals in this role to be successful. If they would want to advance, they need to gain experience in at least one major security technology group or specialize in hardware or software packages the organization uses. IV. Identify the highly specialized nature of security analysts as they tend to be specialized, focusing on one major security technology group, and further specializing in one software or hardware package within the group. V. Relate that the technical qualifications and position requirements for a security analyst are varied. Organizations prefer the expert, certified, proficient technician. Regardless of the area, the job description includes some level of experience with a particular hardware and software package. Sometimes familiarity with a technology secures an applicant an interview; however, experience in using the technology is usually required. Quick Quiz 1 I.

To assess the effect that information security changes will have on the organization’s personnel management practices, the organization should conduct which of the following studies before the implementation phase? a. security audit b. project feasibility

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

9

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

c. behavioral feasibility d. employee feedback Answer: c II.

Which of the following positions is typically the top information security employee in the organization? a. CISO b. CEH c. Security Manager d. CSO Answer: c

III.

Which of the information security roles is usually tasked with configuring firewalls, deploying IDSs, implementing security software, diagnosing and troubleshooting problems, and coordinating with systems and network administrators to ensure that security technology is operating to protect the organization? a. Security Analyst b. CISO c. CSO d. Security Manager Answer: d

IV.

Which of the following information security roles is accountable for the day-to-day operation of the information security program? a. Security Analyst b. CISO c. CSO d. Security Manager Answer: a

V.

True or False: In most organizations, the security analyst position is one that is a senior-level position that requires numerous years of experience and certifications. Answer: False

Credentials for Information Security Professionals (7.3, PPT Slides 23– 27 and 30–32) © 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

10

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

I.

Identify that many organizations seek industry-recognized certifications when reviewing the credentials of applicants.

II.

Relate those existing certifications are relatively new and not fully understood by hiring organizations.

III.

Discuss how the certifying bodies are working to educate employers and professionals on the value and qualifications of their certificate recipients.

(ISC)2 Certifications I.

Emphasize that the International Information Systems Security Certification Consortium (ISC)2 is considered the foremost organization offering information security certifications today.

CISSIP I.

Present that the CISSIP certification is considered the ‘gold standard’ and the most prestigious certification for security managers and CISO’s.

II.

Recognize that professionals must possess at least five years of direct, full-time experience as a security professional working in at least two of the eight domains of information security knowledge, or four years of direct security work experience in two or more domains. The candidate must also have a four-year college degree.

III.

Review the eight domains that are included in a 100 to 150 multiple-choice exam that has a completion time of six hours (with exception to accommodations): •

Security and risk management

•

Asset security

•

Security architecture and engineering

•

Communication and network security

•

Identity and access management

•

Security assessment and testing

•

Security operations

•

Software development security

IV.

Understand that, once certified, the CISSP holder must complete 120 hours of continuing professional education (CPE) every three years with a minimum of 20 hours per year.

V.

Examine the CISSP concentrations and stress to students what (ISC)2 offers; several concentrations are available for CISSPs to demonstrate advanced knowledge beyond the CISSP CBK.

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

11

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

•

ISSAP: Information System Security Architecture Professional

•

ISSEP: Information System Security Engineering Professional

•

ISSMP: Information Systems Security Management Professional

SSCP I.

Contrast that, like the CISSP, the SSCP certification applies more to the security manager than the security technician because the SSCP focuses on practices, roles, and responsibilities as defined by experts from major information security industries.

II.

Outline the seven domains SSCP covers in their 125-question exam that participants have three hours to complete: •

Access controls

•

Security operations and administration

•

Risk identification, monitoring, and analysis

•

Incident response and recovery

•

Cryptography

•

Network and communications security

•

Systems and application security

CSSLP I.

Detail that The Certified Secure Software Lifecycle Professional (CSSLP) is another (ISC)2 certification focused on the development of secure applications.

II.

Encourage students to understand that to get this certification a professional must have at least four years of recent experience in one or more of the following eight domains listed below: •

Secure software concepts

•

Secure software requirements

•

Secure software architecture and design

•

Secure software implementation

•

Secure software testing

•

Secure software lifecycle management

•

Secure software deployment, operations, and maintenance

•

Secure software supply chain

© 2022 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

12

Instructor Manual: Whitman and Mattord, Principles of Information Security 9e, ISBN 978-0-359-50643-1; Module 7: Security and Personnel

III. Differentiate this exam to students and compare it to the others as essays are required to be composed in each of the four areas one has expertise in as the exam submission. IV. Provide learners that as an alternative professionals can qualify for a (ISC)2 Associate certification until the criteria for expertise in the aforementioned areas has been satisfied.

CAP I.

Recognize that this certification is geared towards professionals who with the NIST Risk Management Framework, the Certified Authorization Professional is a certification that focuses on the deployment of the RMF, mainly in the government and the Department of Defense, but also in other public or private sectors.

II.

Review the seven domains the CAP covers in their exam:

III.

•

Information security risk management program

•

Categorization of information systems (IS)

•

Selection of security controls

•

Implementation of security controls

•

Assessment of security controls

•

Authorization of information systems (IS)

•

Continuous monitoring

Recall that candidates only need two years of work experience in one or more domains to take and pass the certification exam.

HCISPP I.

Explain that to qualify for the HCISPP you must focus on security management topics and healthcare; this certification requires the candidate to demonstrate knowledge in six specialty domains on its 125-question multiple-choice exam: •

Healthcare industry

•

Regulatory environment

•

Privacy and security in healthcare

•

Information governance and risk management

•

Information risk assessment

•

Third-party risk management