Exam 6: Information Systems Security

A disaster recovery plan should include

Since many personal computer users do not properly back up their files,a system that centralizes the backup process is essential.A backup of all files on a given disk is known as a(n)

You are the chief security officer for the Astra Corporation.You have decided that the risk of viruses is too great to allow employees to install and run games on the company's computer system. Required: a.What types of controls are required,and what is the objective of the required controls? b.List three procedures that you can implement to guard against the unauthorized installation of software (and the inadvertent installation of viruses)on company computers.

A type of processing that writes a transaction to disk only if it has been completed successfully is

One recovery strategy in the event of a disaster is an alternative processing arrangement using a backup site.A site which contains the wiring for computers and also having the equipment is a

To detect unauthorized direct changes to master files,the auditor traces these changes back to the underlying

Information security is broader in concept than computer security and deals with all information,not just computerized information.

Describe the similarities and differences between a quantitative and a qualitative approach to computer risk assessment.

Input ________ is an example of a system attack method.

White hat hackers legitimately probe systems for weaknesses in order to help with security control procedures.

The most important personnel policy and practice regarding information systems security is that

New Millennium Company is concerned about the security of its information system.It hosts a company Web site that is accessible through the Internet.Certain employees can access New Millennium's private network through the Internet as well.Employees can also access the Internet through the private network.The chief security officer for the company is worried about hackers and intruder attacks on both its Web site as well as the private network. Required: a.What Internet-related vulnerabilities may be present in New Millennium's information system? b.What procedures or steps might be implemented to strengthen system security?

The most basic security procedure in system-access controls is the

Controls can be designed to provide a defense from both active and passive threats.An example of a passive threat is

In the following,which source of information security frameworks or standards targets managers rather than IP professionals?

The least common method used to commit computer fraud is ________ ________.

The best security ________ will not help if the system ________ do not enforce the policies.

Presented below is a list of terms relating to accounting information systems,followed by definitions of those terms. Required: Match the letter next to each definition with the appropriate term.Each answer will be used only once. ________ 1.Database shadowing ________ 2.Logic bomb ________ 3.Information security system ________ 4.Risk management ________ 5.File-access controls ________ 6.Site-access controls ________ 7.Piracy ________ 8.Incremental backup ________ 9.Piggybacking ________ 10.Risk-seeking perpetrator A.Prevents unauthorized access to both data and program controls B.A duplicate of all transactions is automatically recorded C.All files whose archive bit is set to 1 are backed up D.One who will take risks "just because," without significant monetary gain E.A dormant piece of code placed in a computer program for later activation by a later event F.The copying and distributing of copyrighted software or files without permission G.The process of assessing and controlling computer system risks H.The interception of legitimate information and substitution of fraudulent information in its place I.The subsystem of the organization that controls these risks J.These separate unauthorized individuals from computer resources

The problem with Web server attacks is that the Web server is essentially an extension of the operating system.