1) Why is information security a management problem?

What can
management do that technology cannot?
Management is responsible for implementing information security to protect the ability of the
organization to function. They must set policy and operate the organization in a manner that
complies with the laws that govern the use of technology. Technology alone cannot solve
information security issues. Management must make policy choices and enforce those policies to
protect the value of the organization

2) Why is data the most important asset an organization possesses?

What other assets in the organization require protection?
Data is important to an organization because without it an organization will lose its record
of transactions and/or its ability to furnish valuable deliverables to its customers. Other assets that
require protection include the ability of the organization to function, the safe operation
of applications, and technology assets.3.

3) Which management groups are responsible for implementing

information security to protect? The organizations ability to
function?

Both general management and IT management are responsible for implementing

informationsecurity.4.

4) Has the implementation of networking technology created more or

less risk for businesses that use information technology? Why?
The implementation of networking technology has created more risk for businesses that use
information technology because business networks are now connected to the internet and other
networks external to the organization. This has made it easier for people to gain unauthorized
access to the organization
 5) What is information extortion? Describe how such an attack can
cause losses, using an example not found in the text.
Information extortion occurs when an attacker steals information from a computer system and
demands compensation for its return or for an agreement not to disclose it. For example, if a
Hacker gains unauthorized access to a celebritys computer and discovers embarrassing photos
Or videos of the star, he could then blackmail the star into giving him money in exchange for
keeping the photos quiet. This causes not only a monetary loss for the celebrity but also a loss of
privacy and security.

6) Why do employees constitute one of the greatest threats to

information security?
Employees constitute one of the greatest threats to information security because employee
mistakes can lead to the revelation of classified data, entry of erroneous data, accidental deletion
or modification of data, the storage of data in unprotected areas, or they could fail to follow
procedures to protect data.

7) What measures can individuals take to protect against shoulder

surfing?
Individuals can protect themselves against shoulder surfing by not accessing personal or private
information when another person is present and can see what is being entered.8.

8) How has the perception of the hacker changed over recent years?
What is the profile of a hacker today?
The perception of a hacker has evolved from being a male, age 13-18, with limited parental
supervision who spends all his free time at the computer to the current profile of being male or
female, aged 12-60, with varying technical skill who could be internal or external to
anorganization.9.

9) What is the difference between a skilled hacker and an unskilled

hacker (other than skill levels)? How does the protection against
each differ?
An expert hacker is one who develops software scripts and codes to exploit unknown
vulnerabilities. An expert hacker is a master of several programming languages, networking
protocols, and operating systems. An unskilled hacker is one who uses scripts and code
developed by skilled hackers. They rarely create or write their own hacks, and are unskilled in
programming languages, networking protocols, and operating systems. Protecting against expert
hackers is difficult because they use newly developed attack code not yet detectable anti-virus
programs. Protecting against unskilled hackers is easier because they use hacking codes that are
publicly available and can be thwarted by simply staying up-to-date on the latest software patches
and being aware of the latest tools being published by expert hackers.

10) What are the various types of malware? How do worms differ
from viruses? Do Trojan horses carry viruses or worms?
The various types of malware include viruses, worms, Trojan horses, logic bombs, and
backdoors. Worms differ from viruses in that they do not require a programming environment to
replicate itself. Trojan horses can disguise both viruses and/or worms as a non-threatening piece
of software to get it into a computer network.

11) Why does polymorphism cause greater concern than

traditional malware? How does it affect detection?
Polymorphism causes greater concern than traditional malware because of the malicious code
changes the way it appears over time which makes these threats harder to detect. Anti-virus
software is not able to detect the signature of the virus after it changes making the anti-virus
software ineffective.

12) What is the most common form of violation of intellectual

property? How does an organization protect against it? What
agencies fight it?
The most common form of violation of intellectual property involves the unlawful use or
duplication of software-based intellectual property or software piracy. Some ways that an the
organization can protect against it are digital watermarks, embedded code, copyright codes, and
requiring an online registration to be able to use all of the software features.There are two
organizations that investigate software piracy, the Software and InformationIndustry Association
(SIIA) and the Business Software Alliance (BSA).
 13) What are the various types of force majeure? Which type
might be of greatest concern to an organization in Las Vegas?
Oklahoma City? Miami? Los Angeles?
Force majeure refers to forces of nature, or acts of God, that people do not have control
over.Some examples of force majeure include fires, floods, earthquakes, lightning strikes,
landslides, tornados, windstorms, hurricanes, tsunamis, electrostatic discharge, and dust
contamination.The greatest concern for an organization in Las Vegas might be dust
contamination, in OklahomaCity tornados, in Miami hurricanes, and in Los Angeles
earthquakes.

14) How does technological obsolescence constitute a threat to

information security? How can an organization protect against it?
Technological obsolescence occurs when an organizations computer infrastructure becomes
outdated, which leads to unreliable and untrustworthy systems. As a result, there is a risk of loss
of data integrity from attacks. Two ways to prevent against this is through proper planning by
management and systematic replacement of outdated technologies.

15) Does the intellectual property owned by an organization

usually have value? If so, how can attackers threaten that value?
The intellectual property owned by an organization does have value. The weight of the value
depends on the type and popularity of the intellectual property. Attackers can threaten that value
because they can gain access to that data and make the property public so that the organization
does not have exclusive use of the intellectual property anymore.

16) What are the types of password attacks? What can a systems
administrator do to protect against them?
The types of password attacks are password cracks, brute force, and dictionary attacks. To protect
against password attacks, security administrators can implement controls that limit the number of
password entry attempts allowed, require the use of numbers and special characters in passwords,
and restrict the use of passwords that are found in a dictionary.17.
 17) What is the difference between a denial-of-service attack and
a distributed denial-of-service attack? Which is more dangerous?
Why?
A denial-of-service attack is accomplished when an attacker sends a large number of connection
information requests to a target and therefore overloading the system. A distributed denial-of-
service attack is where an attacker coordinates a stream of requests for a target from many
different locations and overloading the system. Distributed denial-of-service attacks are more
dangerous because there are no definitive controls that an organization can implement to defend
against such an attack.

18) For a sniffer attack to succeed, what must the attacker do?
How can an attacker gain access to a network to use the sniffer
system?
In order for a sniffer attack to succeed, an attacker must gain access to a network in order to install
the sniffer. An attacker could use social engineering to trick an employee of an organization into
giving him access to the network.

19) What methods does a social engineering hacker use to gain

information about a users login id and password? How would this
method differ if it were targeted towards an administrators
assistant versus a data-entry clerk?
Social engineering is the process of using social skills to convince people to reveal access
information and/or other important information. An example of this could be a hacker posing as
an executive of an organization calling to retrieve information. The hacker could also pose as a
new hire or another employee of the organization begging for information to prevent getting
fired.An attack targeted toward a data-entry clerk could be successful by just mentioning an
executives name and threatening the wrath of the executive if they do not get certain
information. An attack targeting an administrative assistant would probably need more details
and other information to make the inquiries more credible.
 20) What is a buffer overflow, and how is it used against a Web
server?
A buffer overflow is an application error that occurs when more data is sent to a program buffer
than it can handle. These types of errors can be used against a web server by attaching malicious
code at the end of the extra data allowing the attacker to take over the server and run any code
that the attacker wants.

Chapter 4 Review Questions

Tokin ShresthaInformation Systems SecurityAssignment 404/10/20121. What is risk
management? Why is the identification of risks, by listing assets and their vulnerabilities, so
important to the risk management process?Risk management is the process of identifying risk, as
represented by vulnerabilities, to
an organizations
information assets and infrastructure, and taking steps to reduce this risk to an acceptable level2.
According to Sun Tzu, what two key understandings must you achieve to be successfulin
battle?According to Sun Tzu, the two key understandings we must achieve to be successfulin
battle are Know Yourself and know the enemy.Know yourself First, you must identify, examine,
and understand the information and systems currently inplace within your organization. This is
self-evident. To protect
assets
, which are defined hereas information and the systems that use, store, and transmit information,
you must knowwhat they are, how they add value to the organization, and to which vulnerabilities
they aresusceptible. Once you know what you have, you can identify what you are already doing
toprotect it. Just because a control is in place does not necessarily mean that the asset is
protected.Frequently, organizations implement control mechanisms but then neglect the
necessaryperiodic review, revision, and maintenance. The policies, education and training
programs,and technologies that protect information must be carefully maintained and
administered toensure that they remain effective.Know the Enemy
Having identified your organizations assets and weaknesses, you move on to Sun Tzus second
step: Know the enemy. This means identifying, examining, and understanding the
threats
facingthe organization. You must determine which threat aspects most directly affect the security
of the organization and its information assets, and then use this information to create a listof
threats, each one ranked according to the importance of the information assets that it threatens.3.
Who is responsible for risk management in an organization? Which community of interest
usually takes the lead in information security risk management?4. In risk management strategies,
why must periodic review be a part of the process?5. Why do networking components need more
examination from an information securityperspective than from a systems development
perspective?6. What value does an automated asset inventory system have for the risk
identificationprocess?

7. What information attribute is often of great value for local networks that use staticaddressing?8.
Which is more important to the systems components classification scheme: that theasset
identification list be comprehensive or mutually exclusive?9. W
hats the difference between an assets ability to generate revenue and its ability to
generate profit?10. What are vulnerabilities? How do you identify them?11. What is competitive
disadvantage? Why has it emerged as a factor?12. What are the strategies for controlling risk as
described in this chapter?
13. Describe the defend strategy. List and describe the three common methods.

14. Describe the transfer strategy. Describe how outsourcing can be used for this purpose.

15. Describe the mitigate strategy. What three planning approaches are discussed in the
text as opportunities to mitigate risk?16. How is an incident response plan different from a
disaster recovery plan?
The DR plan and the IR plan overlap to a degree. In many respects, the DR plan is the
subsectionof the IR plan that covers disastrous events. The IR plan is also flexible enough to
beuseful in situations that are near disasters, but that still require coordinated, planned
actions.While some DR plan and IR plan decisions and actions are the same, their urgency and
outcomescan differ dramatically. The DR plan focuses more on preparations completed
beforeand actions taken after the incident, whereas the IR plan focuses on intelligence
gathering,information analysis, coordinated decision making, and urgent, concrete actions.
17. What is risk appetite? Explain why risk appetite varies from organization to organization.Risk
appetite defines the quantity and nature of risk that organizations are willing toacceptas they
evaluate the tradeoffs between perfect security and unlimited accessibility. Forinstance, a
financial services company, regulated by government and conservative by nature,may seek to
apply every reasonable control and even some invasive controls to protect itsinformation assets.
Other, nonregulated organizations may also be conservative by nature,seeking to avoid the
negative publicity associated with the perceived loss of integrity from theexploitation of a
vulnerability. Thus, a firewall vendor may install a set of firewall rulesthat are far stricter than
normal because the negative consequence of being hacked would becatastrophic in the eyes of
its customers. Other organizations may take on dangerous risksthrough ignorance. The reasoned
approach to risk is one that balances the expense (in termsof finance and the usability of
information assets) of controlling vulnerabilities against thelosses possible if these vulnerabilities
were exploited.18. What is a cost benefit analysis?In its simplest definition, CBA (or
economicfeasibility) determines whether or not a particular control is worth its cost. CBAs maybe
calculated before a control or safeguard is implemented to determine if the control isworth
implementing. CBAs can also be calculated after controls have been functioning for atime.
Observation over time adds precision to the evaluation of the benefits of the safeguardand the
determination of whether the safeguard is functioning as intended. While many

techniques exist, the CBA is most easily calculated using the ALE from earlier assessmentsbefore
the implementation of the proposed control, which is known as ALE(prior). Subtractthe revised
ALE, estimated based on the control being in place, known as ALE(post). Completethe
calculation by subtracting the annualized cost of the safeguard (ACS).CBA ALE(prior)
ALE(post) ACS19. What is the definition of single loss expectancy? What is annual loss
expectancy?A single loss expectancy (SLE) is the calculation of the value associated with the
mostlikelyloss from an attack. It is a calculation based on the value of the asset and the exposure
factor(EF), which is the expected percentage of loss that would occur from a particular attack,
asfollows:SLE asset value exposure factor (EF)where EF equals the percentage loss that would
occur from a given vulnerability beingexploited.Once those values areestablished, the equation
can be completed to determine the overall lost potential per risk.This is usually determined
through an annualized loss expectancy (ALE), which is calculatedfrom the ARO and SLE, as
shown here:ALE SLE ARO20. What is residual risk?Even when vulnerabilities have been
controlled as much as possible, there is often stillsome risk that has not been completely removed,
shifted, or planned for. This remainder
is called residual risk. To express it another way, residual risk is a combined function of
a threat less the effect of threat-reducing safeguards, (2) a vulnerability less the effect
of vulnerability-reducing safeguards, and (3) an asset less the effect of asset value-
reducingsafeguards.

WK6D1:Chapter 4 Case Questions:Did Charlie effectively organize the work before the
meeting? Why or why not?Yes! Charlie organized the work by sending out preliminary planning
information to therespective team members and others involved.Make a list of the important
issues you think should be covered by the work plan. For each issue,provide a short explanation.1.
Deliverables, to identify specific elements2. Stakeholders,to identify responsibilities and
departmental requirements3. Meeting schedules to discuss progress and milestones met.4. Teams
and members.5. Project guidelines to determine proper qualification of milestones6. Work
processes and guidelines to guide teams and members in responsibilities.2. Will the company get
useful information from the team it has assembled? Why or why not?Yes! The team assembled
includes reps from all the various departments of the company whichis necessary to begin a risk
management project

Horace Smith
CST-200 WEEK3 DAY3
Chapter 4 Case Exercises
Case exercise: 4
1. Did Charlie effectively organize the work before the meeting? Why or why not?
Make a list of the important issues you think should be covered by the work plan.
For each issue, provide a short explanation.
Yes, Charlie can organize the work before the meeting because he identified the
needs of the work and prepared a work plan for design and submitted it to each
employee. He planned everything properly, and assessed the needs of the group and
indentified key aspects of the work plan and how it affected each individual.
A work plan is a tool for planning. During a specific period of time, it identifies the
problems to be solved and ways to solve them through a defined guideline within
the plan that specifically addresses the key aspects of the problem and the solution.
Important issues for a work plan are:
Teams, Tasks, and schedules
Teams: Once the solution has been selected then the team is appointed, and it is
guided to prepare a work plan. The team is composed of key players that contribute
to the different aspect of the security posture and its effects on the organization.
Tasks: A task is a work item, which includes only the main activities for the required
resources. Timescales, and milestones. It identifies and determines what outputs are
to be drawn based on the goals.
Schedules: Once the project plan is over the it is decided at what time it will be
complete, this includes planning documents, status reports and deliverables.
2. Will the company get useful information from the team it has assembled? Why or
why not?
Yes, the company can get useful information from the team. First of all, the team
identifies the assets and most valuable assets that generate profits and are more
expensive to replace, etc. Then the team can move to identify the risks faced by those
assets. Finally the team can work towards solutions to reduce/eliminate the...