 of individuals interacting with systems Security begins and ends with the people that interact with the system End users may be the weakest link in the security chain Security administrators can greatly reduce the levels of risk caused by end users, and create more acceptable and supportable security profiles.
Question 20. What Are The Information Security Roles To Be Played By Various Professionals In A Typical Organization?
- Senior Management – Chief Information Officer, Chief Information Security Officer
- Security Project Team
- The champion
- The team leader
- Security policy developers
- Risk assessment specialists
- Security professionals
- Systems administrators
- End users.
Question 21. What Are The Three Types Of Data Ownwership And Their Responsibilities?
Data Owner – responsible for the security and use of a particular set of information Data Custodian – responsible for the storage, maintenance, and protection of the information Data Users – the end systems users who work with the information to perform their daily jobs supporting the mission of the organization.
Question 22. What Is The Difference Between A Threat Agent And A Threat?
A threat is a category of objects,persons,or other entities that pose a potential danger to an asset. Threats are always present. A threat agent is a specific instance or component of a threat. (For example All hackers in the world are a collective threat Kevin Mitnick,who was convicted for hacking into phone systems was a threat agent.)
Question 23. What Is The Difference Between Vulnerability And Exposure?
The exposure of an information system is a single instance when the system is open to damage. Weakness or faults in a system expose information or protection mechanism that expose information to attack or damage or known as vulnerabilities.
Question 24. What Is Attack?
An attack is an intentional or unintentional attempt to cause damage or otherwise compromise the information. If some one casually reads sensitive information not intended for his or her use ,this considered as a passive attack. If a hacker attempts to break into an information system,the attack is considered active.
Question 25. What Is Hacking?
Hacking can be defined positively and negatively. To writes computer programs for enjoyment to gain access to a computer illegally.
Question 26. What Is Security Blue Print?
The security blue print is the plan for the implementation of new security measures in the organization. Some times called a framework,the blue print presents an organized approach to the security planning process.
Question 27. What Is Multics?
MULTICS was an operating system ,now obsolete. MULTICS is noewothy because it was the first and only OS created with security as its primary goal. It was a mainframe ,time-sharing OS developed in mid – 1960s by a consortium from GE,Bell Labs,and MIT.
Question 28. What Is Arpanet?
Department of Defense in US,started a research program on feasibility of a redundant,networked communication system to support the military’s exchange of information.Larry Robers,known as the founder if internet ,developed the project from its inception.
Question 29. Define E-mail Spoofing ?
Information is authentic when the contents are original as it was created,palced or stored or transmitted.The information you receive as e-mail may not be authentic when its contents are modified what is known as E-mail spoofing.
Question 30. What Are The Four Important Functions, The Information Security Performs In An Organization?
Information security performs four important functions for an organization:
- Protects the organization’s ability to function
- Enables the safe operation of applications implemented on the organization’s IT systems
- Protects the data the organization collects and uses
- Safeguards the technology assets in use at the organization.
Question 31. What Are Threats?
A threat is an object, person, or other entity that represents a constant danger to an asset Management must be informed of the various kinds of threats facing the organization By examining each threat ca