Chapter#4: Information security

• Untrusted network is any network external to your organization.

 

• Social engineering an attack where the attacker uses social skills to trick a legitimate employee into providing confidential company information such as passwords.

•  Compromises to intellectual property 

 

• Intellectual property Property created by individuals or corporations which is protected under trade secret, patent, and copyright.
  Trade secret Intellectual work, such as a business plan, that is a company secret.
  Patent Document that grants the holder exclusive rights on an invention or process for 20 years.
  Piracy Copying a software program without making payment to the owner.
  Virus is a segment of computer code that performs malicious actions by attaching to another computer program.
  Worm is a segment of computer code that performs malicious actions and will spread by itself without requiring another computer program.
  Trojan horse is a computer program that hides in another computer program and reveals its designated behavior only when it is activated.
  Logic bomb is a segment of computer code that is embedded inside an organization’s existing computer programs and is designed to activate and perform a destructive action at a certain time or date.
  
  
  
  
  • Alien Software
  Spyware collects personal information about users without their consent.  Two types:
   keystroke loggers (keyloggers) and screen scrapers.  Keystroke loggers record your keystrokes and your Web browsing history.  Screen scrapers record a continuous movie of what you do on a screen.
  
  
  •  supervisory control and data acquisition (SCADA) system is a large-scale, distributed, measurement and control system.
  
  
  • Risk Mitigation Strategies
  Risk Acceptance Accept the potential risk, continue operating with no controls, and absorb any damages that occur.
  Risk limitation Limit the risk by implementing controls that minimize the impact of threat.
  Risk transference Transfer the risk by using other means to compensate for the loss, such as purchasing insurance.
  
  

  

  Information Security