System Integration, Security & Internet | Questions & Answers

System Integration, Security & Internet

Questions & Answers

What are the three components of the C.I.A. triangle? What are they used for?

Answer:

1. Confidentiality:  protect information from disclosure or exposure to unauthorized individuals or systems

2. Integrity:  when information is whole, complete and uncorrupted

3. Availability:  allows authorized users to access information without interference or obstruction and to receive it in the required format

C.I.A.: the industry standard for computer security since the development of the mainframe

3. What is privacy in an information security context?

ANS: Privacy in an information system refers to how the information that you supply will be protected. Will the information will be confidential, will they sell it? Will the information be leaked or not. Privacy cannot be considered as absolute freedom from observation. But rather it is more precise “state of being free from unsanctioned intrusion of information”.

OR

Vulnerability is a weaknesses or fault in a system or protection mechanism that opens it to attack or damage. Exposure is a condition or state of being exposed. In information security, exposure exists when a vulnerability known to an attacker is present.

5. What is the difference between vulnerability and exposure?

  Vulnerability is a fault within the system, such as software package flaws, unlocked doors or an unprotected system port. It leaves things open to an attack or damage.  Exposure is a single instance when a system is open to damage. Vulnerabilities can in turn be the cause of exposure.

8. What is a policy? How is it different from a law?

A policy is that which outlines what a government is going to do and what it can achieve for the society as a whole. “Policy” also means what a government does not intend to do. It also evolves the principles that are needed for achieving the goal. Policies are only documents and not law, but these policies can lead to new laws.

Laws and policies are vary needed in our society as they help in maintaining law and order in the society and help in shaping political and social aspects of the society. Though policies and laws can be interrelated, they are definitely two terms having different purposes. No nation can go forward without having certain laws and policies.

Laws are for the people, and policies are made in the name of the people. Policies can be called a set of rules that guide any government or any organization. Laws are administered through the courts. Laws are enforceable in which the policies comply.

A law is more formal as it is a system of rules and guidelines that are derived for the welfare and equity in society. A policy is just informal as it is just a statement or a document of what is intended to be done in the future.

10. What is civil law, and what does it accomplish?

Ans: A wide variety of laws that govern a nation or state and deal with the relationships and conflicts between organizational and entities and people.

11. What is the difference between a threat agent and a threat?

Answer:

Threat: a category of objects, persons, or other entities that presents a danger to an asset.

Threat agent: the specific instance or component of a threat.

OR

A threat agent is the facilitator of an attack, whereas a threat is a category of objects, persons, or other entities that represents a potential danger to an asset. Threats are always present. Some threats manifest themselves in accidental occurrences and others are purposeful. Fire is a threat; however, a fire that has begun in a building is an attack. If an arsonist set the fire then the arsonist is the threat agent. If an accidental electrical short started the fire, the short is the threat agent.

12. Briefly describe two critical characteristics of information?

* Availability: the accessibility of information. In Computer Security, access to data is usually restricted to particular users, this making it unavailable to unauthorized users.

* Accuracy: freedom from errors due to mistakes in data entry, as opposed to errors that arise during the transmission or reproduction of information (see Integrity). Obviously, in Computer Security accuracy is essential. Inaccurate information is at best useless, and at worst dangerous.

* Authenticity: the data is original, rather than a reproduction (or forgery). In computer security, it is important to ensure that information is authentic; that is, that the information is exactly the same in content and state as the original produced by its creator.

13. What are the various types of Malware? How do worms differ from viruses? Do Trojan horses carry viruses or worms?

Common types of malware are viruses, worms, Trojan horses, logic bombs, and back doors.

Computer viruses are segments of code that induce other programs to perform actions. Worms are malicious programs that replicate themselves constantly without requiring another program to provide a safe environment for replication.

Once a trusting user executes a Trojan horse program it will unleash viruses or worms to the local workstation and the network as a whole

14. How can an attacker use social engineering to gather information against his/her victims?

In the context of information security, social engineering is the process of using social skills to convince people to reveal access credentials or other valuable information to the attacker. There are several social engineering techniques, which usually involve a perpetrator posing as a person higher in the organizational hierarchy than the victim. To prepare for this false representation, the perpetrator may have used social engineering tactics against others in the organization to collect seemingly unrelated information that, when used together, makes the false representation more credible. For instance, anyone can check a company’s Web site, or even call the main switchboard to get the name of the CIO; an attacker may then obtain even more information by calling others in the company and asserting his or her (false) authority by mentioning the CIO’s name. Social engineering attacks may involve individuals posing as new employees or as current employees requesting assistance to prevent getting fired. Sometimes attackers threaten, cajole, or beg to sway the target.

Another social engineering attack called the advance-fee fraud (AFF), and internationally known as the 4-1-9 fraud, is named after a section of the Nigerian penal code. The perpetrators of 4-1-9 schemes often name fictitious companies, such as the Nigerian National Petroleum Company. Alternatively, they may invent other entities, such as a bank, government agency, or a nongovernmental organization. See Figure 2-14 for a sample letter from this type of scheme. This scam is notorious for stealing funds from credulous individuals, first by requiring that people who wish to participate in the proposed money-making venture send money up front, and then by soliciting an endless series of fees. These 4-1-9 schemes are even suspected to involve kidnapping, extortion, and murder, and they have, according to the Secret Service, bilked over $100 million from unsuspecting Americans lured into

15. Why is a methodology important in the implementation of information security? How

does a methodology improve the process?

Answer:

A methodology is a formal technique that has a structured sequence of procedures that is used to solve a problem. Methodology is important in the implementation of information security because it ensures that development is structured in an orderly, comprehensive fashion. The methodology unifies the process of identifying specific threats and the creation of specific controls to counter those threats into a coherent program. Thus, a methodology is important in the implementation of information security for two main reasons:

-First, it entails all the rigorous steps for the organizations' employees to follow, therefore avoiding any unnecessary mistakes that may compromise the end goal (i.e., to have a comprehensive security posture). An example of this is that a methodology guides an organization to solve the root cause of the information security problem, not just its symptoms.

16. What is intellectual property (IP)? Is it afforded the same protection in every country of the world? What laws currently protect it in the United States and Europe?

Ans: A work or invention that is the result of creativity, such as a manuscript or a design, to which one has rights and for which one may apply for a patent, copyright, trademark, etc.

In today's economic environment, intangible assets are becoming increasingly important. These assets which are the result of human intellectual creative activity such as invention, design, know-how, and artistic creation are known as "intellectual property." Among the forms of intellectual property specifically entitled to legal protection are inventions, trademarks, designs, literary works, layout-designs of integrated circuits and trade secrets. As the volume of trade in goods and services involving intellectual property has increased greatly in recent years, the importance of the protection of intellectual property for the world economy has grown enormously. Inappropriate and insufficient protection of intellectual property can distort free trade.

In developing countries, the protection of intellectual property rights is often insufficient. For example, developing countries often limit protection to a very narrow subject area, or provide protection for only a short period of time, or lack strict enforcement. Some developed countries also have problematic intellectual property regimes that, for example, openly discriminated against foreign nations, provide excessive protection or otherwise have regimes so different from those employed by the rest of the world that its effect is discriminatory.

17. What are the primary examples of public law?

Ans: Criminal, administrative and constitutional law.

What is methodology? Describe the steps taken in secSDLC?

The systems development life cycle (SDLC) is a methodology for the design and implementation of an information system. A methodology is a formal approach to solving a problem by means of a structured sequence of procedures.

Investigation
The first phase, investigation, is the most important. What problem is the system being developed to solve? The investigation phase begins with an examination of the event or plan that initiates the process. During the investigation phase, the objectives, constraints, and scope of the project are specified. A preliminary cost-benefit analysis evaluates the perceived benefits
and the appropriate levels of cost for those benefits. At the conclusion of this phase, and at
every phase following, a feasibility analysis assesses the economic, technical, and behavioral
feasibilities of the process and ensures that implementation is worth the organization’s time
and effort.

Analysis
The analysis phase begins with the information gained during the investigation phase. This
phase consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems. Analysts begin by determining what the new system is
expected to do and how it will interact with existing systems. This phase ends with the documentation of the findings and an update of the feasibility analysis.

Logical Design

In the logical design phase, the information gained from the analysis phase is used to begin
creating a systems solution for a business problem. In any systems solution, it is imperative
that the first and driving factor is the business need. Based on the business need, applications
are selected to provide needed services, and then data support and structures capable of providing the needed inputs are chosen. Finally, based on all of the above, specific technologies
to implement the physical solution are delineated. The logical design is, therefore, the blueprint for the desired solution. The logical design is implementation independent, meaning that it contains no reference to specific technologies, vendors, or products. It addresses,
instead, how the proposed system will solve the problem at hand. In this stage, analysts generate a number of alternative solutions, each with corresponding strengths and weaknesses,
and costs and benefits, allowing for a general comparison of available options. At the end of
this phase, another feasibility analysis is performed.

Physical Design

During the physical design phase, specific technologies are selected to support the alternatives identified and evaluated in the logical design. The selected components are evaluated
based on a make-or-buy decision (develop the components in-house or purchase them
from a vendor). Final designs integrate various components and technologies. After yet
another feasibility analysis, the entire solution is presented to the organizational management for approval.

Implementation
In the implementation phase, any needed software is created. Components are ordered,
received, and tested. Afterward, users are trained and supporting documentation created.
Once all components are tested individually, they are installed and tested as a system. Again
a feasibility analysis is prepared, and the sponsors are then presented with the system for a
performance review and acceptance test.

Maintenance and Change

The maintenance and change phase is the longest and most expensive phase of the process.
This phase consists of the tasks necessary to support and modify the system for the remainder of its useful life cycle. Even though formal development may conclude during this phase,
the life cycle of the project continues until it is determined that the process should begin
again from the investigation phase. At periodic points, the system is tested for compliance,
and the feasibility of continuance versus discontinuance is evaluated. Upgrades, updates, and
patches are managed. As the needs of the organization change, the systems that support the
organization must also change. It is imperative that those who manage the systems, as well
as those who support them, continually monitor the effectiveness of the systems in relation
to the organization’s environment. When a current system can no longer support the evolving
mission of the organization, the project is terminated and a new project is implemented.

Malware

Regroups viruses, spyware, Trojans, and all sorts of small programs designed to harm your system, steal information, track your activities…etc 

Spyware

Spyware (spy software or spyware) is a program designed to collect personal data about users of the infected system and to send them to a third party via the Internet or computer network without permission users.  Use Ad-Aware and Spybot to remove them. 

Viruses

A virus is a piece of malicious computer program designed to replicate itself. This ability to replicate, can affect your computer without your permission and without your knowledge. In layman’s term a classical virus will attach itself to a executable program and systematically replicate to all executable that you run. 
Worms

A worm (or worm) is a particular type of virus that can replicate through terminals connected to a network, then to perform certain actions which would impair the integrity of operating systems. 
Trojans

A Trojan looks like a valid program. But in reality it contains hidden features, through which the security mechanisms of the system are bypassed, allowing access to your files (to view, modify or destroy them). Unlike a worm, the Trojan does not replicate: it may stay harmless, in a game or a utility until the scheduled date of its entry into action. 
Key loggers

A key logger is software that records keystrokes to steal, for example, a password. 
Dialer

The dialers are programs that make up a number to connect your computer to the Internet. It may be safe and legitimate if it is from your ISP for example. However, some dialers are malicious and can move without your knowledge on your machine and dial a number very expensive number. 
Rootkits

A rootkit is a very complex malicious code that can merge with your system, and sometimes to very core of the operating system. It is thus able to take full control of a PC without leaving a trace. Detection is difficult, even impossible on some systems.