t that exploits vulnerability
It is accomplished by a threat-agent to damage or steal an organization’s information or physical asset
An exploit is a technique to compromise a system
A vulnerability is an identified weakness of a controlled system whose controls are not present or are no longer effective
An attack is then the use of an exploit to achieve the compromise of a controlled system.
Question 48. What Is A Malicious Code?
This kind of attack includes the execution of viruses, worms, Trojan horses, and active web scripts with the intent to destroy or steal information. The state of the art in attacking systems in 2002 is the multi-vector worm using up to six attack vectors to exploit a variety of vulnerabilities in commonly found information system devices.
Question 49. Define Virus ?
Virus – Each infected machine infects certain common executable or script files on all computers to which it can write with virus code that can cause infection.
Question 50. Define Hoaxes ?
Hoaxes – A more devious approach to attacking computer systems is the transmission of a virus hoax, with a real virus attached.
Question 51. What Is Distributed Denial-of-service (ddos)?
DDoS is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.
Question 52. What Is Back Door?
Back Doors – Using a known or previously unknown and newly discovered access mechanism, an attacker can gain access to a system or network resource.
Question 53. Define Dictionary Attack ?
The dictionary password attack narrows the field by selecting specific accounts to attack and uses a list of commonly used passwords (the dictionary) to guide guesses.
Question 54. What Are The Various Forms Of Attacks ?
- IP Scan and Atack
- Web Browsing
- Unprotected Shares
- Mass Mail
- Back Doors
- Password Crack
- Brute Force
- Denial of Service
- Distributed DoS.
Question 55. What Is Denial-of-service (dos) ?
attacker sends a large number of connection or information requests to a target
so many requests are made that the target system cannot handle them successfully along with other, legitimate requests for service
may result in a system crash, or merely an inability to perform ordinary functions.
Question 56. Define Spoofing ?
It is a technique used to gain unauthorized access whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host.
Question 57. Define Man-in-the-middle ?
Man-in-the-middle is an attacker sniffs packets from the network, modifies them, and inserts them back into the network.
Question 58. What The Roles To Be Played By The Communities Of Interest To Manage The Risks An Organization Encounters?
It is the responsibility of each community of interest to manage risks; each community has a role to play:
- Information Security
- Management and Users
- Information Technology.
Question 59. What Is The Process Of Risk Identification?
A risk management strategy calls on us to “know ourselves” by identifying, classifying, and prioritizing the organization’s information assets These assets are the targets of various threats and threat agents and our goal is to protect them from these threats.
Question 60. What Are Asset Identification And Valuation ?
This iterative process begins with the identification of assets, including all of the elements of an organization’s system: people, procedures, data and information, software, hardware, and networking elements.
Question 61. What Is Asset Information For People?
Security clearance level
Question 62. What Are Hardware, Software, And Network Asset Identification?
When deciding which information assets to track, consider including these asset attributes:
- IP address
- MAC address
- Element type
- Serial number
- Manufacturer name
- Manufacturer’s model number or part number
- Software version, update revision, or FCO number
- Physical location
- Logical location
- Controlling entity.
Question 63. What Are Asset Information For Procedures?
What elements is it tied to
Where is it stored for reference