 made that the target system cannot handle them successfully along with other, legitimate requests for service
may result in a system crash, or merely an inability to perform ordinary functions.
Question 56. Define Spoofing ?
It is a technique used to gain unauthorized access whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host.
Question 57. Define Man-in-the-middle ?
Man-in-the-middle is an attacker sniffs packets from the network, modifies them, and inserts them back into the network.
Question 58. What The Roles To Be Played By The Communities Of Interest To Manage The Risks An Organization Encounters?
It is the responsibility of each community of interest to manage risks; each community has a role to play:
- Information Security
- Management and Users
- Information Technology.
Question 59. What Is The Process Of Risk Identification?
A risk management strategy calls on us to “know ourselves” by identifying, classifying, and prioritizing the organization’s information assets These assets are the targets of various threats and threat agents and our goal is to protect them from these threats.
Question 60. What Are Asset Identification And Valuation ?
This iterative process begins with the identification of assets, including all of the elements of an organization’s system: people, procedures, data and information, software, hardware, and networking elements.
Question 61. What Is Asset Information For People?
Security clearance level
Question 62. What Are Hardware, Software, And Network Asset Identification?
When deciding which information assets to track, consider including these asset attributes:
- IP address
- MAC address
- Element type
- Serial number
- Manufacturer name
- Manufacturer’s model number or part number
- Software version, update revision, or FCO number
- Physical location
- Logical location
- Controlling entity.
Question 63. What Are Asset Information For Procedures?
What elements is it tied to
Where is it stored for reference
Where is it stored for update purposes.
Question 64. What Are The Asset Information For Data?
Size of data structure
Data structure used – sequential, relational
Online or offline
Backup procedures employed.
Question 65. How Information Assets Are Classified?
Examples of these kinds of classifications are:
Informal organizations may have to organize themselves to create a useable data classification model
The other side of the data classification scheme is the personnel security clearance structure.
Question 66. Define Data Classification And Management?
A variety of classification schemes are used by corporate and military organizations
Information owners are responsible for classifying the information assets for which they are responsible
Information owners must review information classifications periodically
The military uses a five-level classification scheme but most organizations do not need the detailed level of classification used by the military or federal agencies.
Question 67. What Are Security Clearances?
The other side of the data classification scheme is the personnel security clearance structure
Each user of data in the organization is assigned a single level of authorization indicating the level of classification
Before an individual is allowed access to a specific set of data, he or she must meet the need-to-know requirement
This extra level of protection ensures that the confidentiality of information is properly maintained.
Question 68. Explain The Process Of Threat Identification?
Each of the threats identified so far has the potential to attack any of the assets protected
This will quickly become more complex and overwhelm the ability to plan
To make this part of the process manageable, each step in the threat identification and vulnerability identification process is managed separately, and then coordinated at the end of the process.
Question 69. What Is Vulnerability Identification?
We now face the challenge of reviewing each information asset for each threat it faces and creating a list o