And availability relevance the internet internet relevance

FINAL EXAM REVIEW (MULTIPLE CHOICE)

- Information Security/Information Systems (SYSAdmin/Security Competencies)

- Watershed

- Why is Windows 95 Important?

- Several Questions on HiPAA

- HIPAA stands for: Health Insurance Portability and Accountability Act. This Act which primarily focused on protecting health insurance for US workers when they change or lose jobs also had important information security implications. Many government leaders believed at the time that electronic health records (EHR) were an important instrument to lower rising healthcare costs in America. The Act therefore also pushed for electronic health records.

- Sarbox Or Sarbanes-Oxley Act: 2000-2002, America witnessed many unpleasant incidents of corporate fraud involving such legendary companies in Enron, Tyco, and WorldCom. So, this act is retaliation. The Act is focused on making the key executives personally accountable for the correctness of financial reports filed by publicly traded companies. The Act had three major provisions. Section 302 of the Act requires the CEO and CFO of firms to sign a declaration of personal knowledge of all the information in annual filings. Section 906 of the Act imposes criminal penalties including imprisonment of up to 20 years for incorrect certification. Section 404 of the Act has had a major impact on the information security profession because it requires that the certification in Section 302 be based on formal internal controls. This has led to significant investments in internal controls over financial reporting in publicly traded firms.

- TJ MAXX Incident – 2007 – Hackers had complete access to credit card databases at many of the leading retailers in the country, one of them being T.J. MAXX.

- Differences between System Admin & Security Officer

- System Admin is day to day operations of system. The system administrator is the person who is responsible for the day-to-day operation of a technology system.

- Access Control vs User Management

- Access Control is limited permissions/rights on apps. Access control is the act of limiting access to information system resources only to authorized users, programs, processes, or other systems. Access controls establish what users can do on a system.

- Active Directories - Active Directory is a collection of technologies that provide centralized user management and access control across all computers that are “members” of the domain.

- Various Control Mechanism

- The shell is a text-based program that allows the user to interact directly with the kernel. Common operations performed using the shell include starting and stopping programs, controlling the execution of programs, and starting or stopping the computer.

- Linux Distribution/What a Distribution Is

- What does this shell name stand for? (Extra Credit)

- Syntax

- Shell Prompt ($ vs #)

- $ is standard.

- Folder Navigation

- cd = change directory

- Copying and Deleting, Renaming.

- cp -r (recursive) or just cp.

- Permissions

- -RWX RWX RWX or Permission 777 (Default)

- Common Vulnerabilities and Exposures (CVE) - The CVE list aims to provide common names and identifiers for all publicly known software vulnerabilities. The list is maintained by Mitre, a non-profit federally funded research and development organization.

- National Vulnerability Database (NVD) - While the community is interested in being alerted to vulnerabilities, most users are more interested in learning about the likely impacts of vulnerabilities and recommended measures to remove the vulnerability. This information is maintained in a parallel effort.

- Buffer Overflow - The buffer overflow vulnerability refers to the situation where a pro- gram puts more data into a storage location than it can hold.

- SQL Injection - The SQL injection vulnerability refers to the use of unvalidated SQL input in applications.

THREATS

- What is a Zombie in IS context?

Rootkits - Rootkits are collections of software programs used to hide the existence of malicious software on computer systems. The term “rootkit” refers to a software toolkit that gives an unauthorized user root access (root is the administrative account on UNIX systems), while hiding the actions of the unauthorized user.

Zero-Day Exploits - A zero-day exploit compromises a previously unknown vulnerability in computer software.

- Third Party

- Asset Sensitivity and Criticality

- Required, if it disappears big problem if no plan B

- An asset is considered required when it is important to the organization but the organization would be able to continue to operate for a period of time even if the asset is not available.

- External Partners – Agents outside the organization.

- What is Ciphertext? Ciphertext is the encrypted text that is unintelligible to the reader.

- Modulus -

- 15 mod 5 = 0 (remainder of 15/5).

- Cut command - The cut command allows you to parse each line of the data file and extract only the column that you need.

- Read Command - read pauses the execution of a script until the user enters a value and presses return.

- Variables

- Example of Syntax and Which is correct way?

- IF, THEN, ELIF - The final construct we’ll be looking at is the if/then/elif construct. elif is a contraction of “else if” and is an alternative to nested-if structures.

- IF THEN ELSE - If you want to take one action if a conditional statement is true and a different action if it is false, you’ll use the if/then/else construct. It is identical to the if/then construct except that for the addi- tion commands in the else stanza that will be executed if the conditions were not met. /opt/book/ scripting/number_guess_v1 is an example of a basic if/then/else construct.

- Series

- 1..5..2