Information Systems Exam 2

Photo Tagging definition

the process of assigning names to images of people. Facial recognition software to search for similar facial features in untagged photos.

Allows user to quickly group photos in which the tagged person appears.

Geofence definition

virtual perimeter for a real-world, physical geographical area.

The use of GPS, Wi-Fi, data, sensor tech to create a virtual geographic boundary, enabling software to trigger a response when a mobile device enters or leaves a particular area

What are the 4 main categories of ethics issues

Privacy Issues

Accuracy Issues

Property Issues

Accessibility Issues

cookies

remembers log in information, saves shopping cart contents, tracks user behavior across websites, support analytics and advertising systems

Alien software

any software secretly installed to your computer without your knowledge.

Adware

software that causes pop up advertisements to appear on your screen

Spyware

collects personal information about users without their consent

Keystroke loggers (keyloggers)

record your keyboard strokes and internet browsing history

Screen scrapers

record a movie of screen contents and activities

Stalkerware

powerful surveillance functions which include keylogging, capturing screenshots, monitoring actitvity, etc

Spamware

software that pulls email addresses from websites and individuals pcs and sends out unsolicited emails to your mailing list

• looks like it came from your

SCADA attacks (Supervisory control and data acquisition attacks )

used to monitor or control chemical, physical, and transport processes

Cyber warfare

when a country or government is behind a malicious act to target computer systems to cause physical, real world harm or severe disruption

Cyber terrorism

malicious act in which attackers uses a targets computer system to cause physical, real world harm or severe disruption to carry out a political agenda by an individual or group

What are the most common method for successful attacks into an organization?

Phishing and spear phishing

What is the single most effective way to prevent from malware threats and data breaches

effective and ongoing education and training

Information security controls

designed to protect all the components of information systems

what are the 3 major types of information security controls?

Physical controls

Access controls

communication controls

Physical controls examples

badges, retina scans, fingerprint scans

Access controls as security controls

prevents unauthorized individuals from using information resources

Examples of access controls

multifactor authentications

authentication: identify who the individual is

Authorization: rights and privileges the user has in the organizations systems

Communications controls as a security control

secure the movement of data across networks

Parts of communication controls as security controls

Firewalls, anti-malware software, whitelisting, blacklisting, encryption, virtual private network (VPN), Transport Layer security (TLS), Employee monitoring systems, security information and event management (SIEM)

Firewalls

systems that prevent unauthorized internet users from accessing private networks

Anti-malware/virus software

software that attempts to identify and eliminate viruses, worms, etc

Whitelisting

process in which a company identifies the applications that ARE allowed to run and access on computers

Blacklisting

process in which a company identifies websites that are NOT allowed to run on computers

Encryption

process of converting an original message into a form that cannot be read by anyone except the intended receiver

Virtual Private Network (VPN)

private/secure network that remote users can connectdto ans access/share information

Transport Layer Security (TLS)

secures transactions on the internet; encrypts and decrypts data between webs server and browser

Employee monitoring systems

proactive approach of protecting against human mistakes. Monitors email activities and internet browsing activities

Security information and event management (SIEM)

software solution that collects data, uses analytics and real time monitoring to provide real time ontifications of suspicious activity

• looks at attempts to try to access websites or where someone logged in in the world

What is the goal in risk management

identify, control, and minimize the impact of threats

• reduce risk to acceptable levels

• impossible to eliminate all risk

What are the 3 steps in risk analysis

• assessing the value of each asset

• estimate the probability that each asset will be compromised

• comparing probable costs of the assets being compromised with costs of protecting assets

Risk mitigations two function are:

• implanting controls to prevent identified threats from happening

• developing a means of recovery if the threat becomes a reality

what does 1st party cyber liability insurance cover?

it protects your company

what does 3rd party cyber liability insurance cover?

provides protection for businesses that offer professional services to other business that can be compromised by cyber threats

Multifactor authentication

additional layer of security

Ex. auburn uses duo

How are passwords stored in password documents?

Passwords are stored as HASHES to encrypt passwords incase a document of password gets hacked

Open source intelligence (OISNT)

practice of bad actors collecting and using data from publicly available sources for malicious intelligence purposes

• ex. getting names and numbers of LinkedIn and calling in for malicious reasons

Ethics issues fall into 4 general categories

Privacy Issues: collecting, storing, disseminating info about individuals

Accuracy issues: involve authenticity/correctness of info that is collected/processed

Property issues: involve ownership and value of information

Accessibility issues: who should have access to info and should they pay a fee for this access

Essential cookies

necessary for website to function correctly

functional cookies

language settings, regional selection

advertising or targeting cookies

tracks to deliver personalized advertisments

session cookies

installed and deleted when you enter and exit a website

persistent cookies

installed in your device and stored (sometimes permanently)

First- party cookies

get directly by the website you visit

Helps remember your information and settings

third party cookies

placed on websites by some entity other than the company of the website

web beacons

tracking beacons that are embedded in websites or emails to monitor you

Session Replay scripts

records a visitors mouse activities on a website

What three places created the first cookie policies?

Europe

Brazil

California

What do cookie policies state?

Right to know what’s collected

right to delete information

right to opt out of sale of data

data breach

source not authorized gets access to information / data

what are the 5 key factors contributing to increasing vulnerability?

• todays interdependent, wirelessly connected networked business environment

• smaller, faster, cheaper computers and storage devices

• decreasing skills necessary to be a computer hacker

• international organized crime taking over cybercrime

• lack of management support

Botnets

collection of infected computers (bots) controlled by a remote player (bot master)

DDOS - distributed denial of service

aims to make a website or network unusable by flooding it with malicious traffic from multiple infected computers (botnets)

Whaling attacks

targets towards high-value individuals (HR and execs)