Exam 3 Textbook content

Chpt 12, 13

The ability to mimic or duplicate the functions of the human brain.

artificial intelligence (AI)

The people, procedures, hardware, software, data, and knowledge needed to develop computer systems and machines that can simulate human intelligence processes, including learning (the acquisition of information and rules for using the information), reasoning (using rules to reach conclusions), and self-correction (using the outcome from one scenario to improve its performance on future scenarios).

artificial intelligence (AI) system

Also known as weak AI, it excels at specific, well-defined tasks and is typically trained on large datasets of labeled data.

artificial narrow intelligence (ANI)

Siri, Alexa, and Google Assistant are examples of which category of AI?

artificial narrow intelligence (ANI)

the ability of a computer to learn without being explicitly programmed

machine learning

Machine learning using a labeled data set and examples to produce output that is compared to a predefined correct output.

supervised learning

Machine learning using an unlabeled data set and no examples. The data is labeled through observations, and learning is through observation.

unsupervised learning

Machine learning using trial and error on an unlabeled data set. Learning is gained through positive and negative feedback.

reinforced learning

A subfield of machine learning that allows programs to grow and learn from examples provided by users, either typed or spoken — inspired by the structure and function of the human brain

deep learning

A computer system that can recognize and act on patterns or trends that it detects in large sets of data; developed to operate like the human brain.

artificial neural networks

The part of machine language that allows computers to understand, analyze, manipulate, and generate natural language for processing.

natural language processing (NLP)

A technology that enables computers to interpret and understand visual information from the real world.

computer vision

Applications of computer vision:

facial recognition, image classification, and self-driving cars

Artificial intelligence systems capable of creating new data, such as images, text, or audio, that mimic or resemble human-generated content, often through techniques like deep learning and probabilistic modeling.

generative AI

complex algorithms and system architectures that have been trained on massive datasets of text and code

large language models (LLM)

A statistical technique that aims to predict future events or outcomes by analyzing relevant historical data.

predictive modeling

when a call comes into a bank, medical office, store, or customer service department, the call may be answered by a computer, which offers the caller a menu of options. A caller might be prompted to “say the option or type in the number of the option to continue. This is an example of

natural language processing

An intelligent system designed to work alongside humans, acting as a virtual assistant to enhance efficiency, safety, and decision making.

AI co-pilots

Research focusing on developing methods for understanding how AI models arrive at their outputs in order to find and correct potential biases and improve trust in the systems and the models they produce.

explainable AI (XAI)

A form of artificial intelligence that processes data at the source on devices at the network’s edge.

edge AI

Technology that interacts with a human’s neural structure (brain) and translates the information (thoughts) into activities (actions).

brain–computer interface (BCI)

An AI system can generate factually incorrect outputs presented as truth

hallucinations

The application of technology, programs, robotics, or processes to achieve outcomes with minimal human input.

automation

A combination of mechanical engineering, computer science, AI, and machine learning used to create a device that can perform tasks with a high degree of precision.

robotics

BLANK are designed for speed, accuracy, and safety

industrial robots

typically stationary but have one or more attachments that can move in straight lines along the x, y, and z axes

EX: automated pick-and-place systems for industrial assembly tasks

cartesian robots

robots that have both a lateral movement and a rotary movement. They are often used in the biomedical field because they are fast and have a wide field of movement.

Selective Compliance Assembly Robot Arm (SCARA) robots

made to function like a human arm. These robots may have 10 or more rotary joints that can move up and down like an elbow and can also twist.

EX: frequently used in industrial manufacturing settings, such as on automotive lines, as they can move quickly and with precision

articulated robots

advanced systems with sensors and the capability to safely react to people in their workspace, often isolated from humans for safety reasons. These robots handle large and heavy components, perform welding tasks, or perform other work that could injure a person.

collaborative robots (Cobots)

covers all the hardware, software, networks, databases, and related digital components of security

cybersecurity

is the discipline of protecting information (either digital or physical), information systems, facilities, and other resources against threats to confidentiality, integrity, and availability.

information security

includes all the elements of cybersecurity but adds physical access, fire prevention and suppression, incident response, and much more.

information security

While cyberattacks are dire events with potentially dire consequences for the organization that has been targeted, most cybersecurity events are caused by

simple human error and not by individuals with malicious intent.

The information security principles of confidentiality, integrity, and availability.

CIA triad

Ensuring that data is only accessible by those who have appropriately approved access.

confidentiality

The release of information without appropriate permission; also known as a data breach. A violation of confidentiality.

disclosure

Ensuring that data is not changed without appropriate permission.

integrity

A compromise of data integrity.

alteration

Ensuring that data is accessible without interruption or delay.

availability

Making data inaccessible to those with a need to access it.

denial of service

The number of known cybersecurity vulnerabilities continues to BLANK every year.

increase

The Big Dilemma: Most companies are not in business to be, BLANK but to be in BLANK they must be secure.

secure; business

Global cybersecurity revenue continues to…

grow

A formal process to evaluate the consequences of security incidents on the organization’s critical functions, processes, and operations.

business impact assessment (BIA)

main objective of a business impact assessment (BIA), is to identify and prioritize the organization’s BLANK and determine the effects of disruptions.

essential business activities

A system tied directly to the core mission of an organization, may include order fulfillment, accounts receivable, sales, and manufacturing.

Mission-critical systems

A system needed for the day-to-day operations and profitability of an organization.

Business-critical systems

A fundamental system that allows an organization to carry out basic operations and maintain a minimum level of functionality.

Essential systems

The number of times that a business expects to experience a given type of disruptive event in any given year. Measure of likelihood assessment

annualized rate of occurrence (ARO)

The degree of impact that a given risk would have on a specific information system.

exposure factor (EF)

The financial impact that can be expected in a given year from a particular disaster.

annualized loss expectancy (ALE)

The amount of financial impact that will be experienced if that particular disaster occurs; computed by multiplying the asset value by the exposure factor.

single loss expectancy (SLE)

annualized loss expectancy (ALE) =

single loss expectancy (SLE) * annualized rate of occurrence (ARO)

The overt or tacit decision to do nothing about a risk. (does not make it go away)

risk rejection

Taking steps to eliminate a specific risk.

risk avoidance

Acknowledging that a risk exists but that the response to the risk is too expensive.

risk acceptance

Shifting the operational responsibility of the risk to another party.

risk transference

Principle #1: Never spend more money on security than the asset is worth.

Principle #2: Never spend more money on security than the benefit of the security measures

budget for risk

Using multiple layers of mitigation to maximize protection of an asset.

defense-in-depth

The total time that an information system can be down before the business suffers irreparable harm.

maximum tolerable downtime (MTD)

The limit on how much data loss the business can experience without experiencing harm from an outage event.

recovery point objective (RPO)

The limit on how long it will take to recover the system after an outage event.

recovery time objective (RTO)

An individual or group with the intention and ability to carry out malicious activities, exploit vulnerabilities, or compromise information systems. Their goal is to steal, alter, or delete data.

threat actor

Software intended to disrupt normal computer operations either by impairing or interrupting the system, stealing sensitive data, or otherwise performing unwanted actions. AKA malware

malicious software

Malicious software that encrypts data, making it unreadable and unusable.

ransomware

An attack that occurs when a system is rendered incapable of responding to normal requests.

denial of service (DOS) attack

The use of multiple computers to compromise the availability of the target system

distributed denial of service (DDOS) attack

The act of using manipulative techniques to persuade individuals to disclose confidential information or perform actions that compromise security.

social engineering

An email method of tricking recipients into revealing sensitive information, such as logon credentials.

phishing

The use of phishing messages that are tailored to the recipient, referring to them by name and perhaps adding some accurate information that is germane to the context.

spear phishing

A phishing attack targeted at a senior person in an organization.

whale phishing

A group with the knowledge, skills, and computer resources necessary to conduct cybercrime campaigns.

Advanced persistent threats (APTs)

Individuals who do not possess the technical knowledge to create their own cyber exploits, so they pay for the tools that others have created.

Script kiddies

The primary responsibility for creating and enforcing security policies belongs with…

the CEO and the board of directors

A high-level document that establishes management direction for handling security in an organization.

security policy

A security policy that addresses the minimum requirements necessary to protect the people, processes, data, software, and/or hardware that are in scope for that policy.

adequate

A security policy that shows, through evidence, that it is being implemented appropriately and has a demonstrable impact in protecting the people, processes, data, software, and/or hardware covered by the policy.

effective

A means for service providers to demonstrate their compliance with security standards established by the American Institute of Certified Public Accountants (AICPA).

System and Organization Controls (SOC) audit

An event where the confidentiality, integrity, or availability of information is com-promised

incident

The practice of securing information by transforming it into a coded format that can only be read by someone with the correct tools and data.

cryptography