Answers...... Digital Security, Ethics and Privacy CHP 5
Answers...... Digital Security, Ethics and Privacy CHP 5
Digital Security Risk: A digital Security risk is an event that causes a loss of or damage to
the computer or mobile device hardware, software, data, information or processing capability.
Computer crime: Any illegal act involving the use of a computer or related devices is
referred to as a computer crime.
Cybercrime: cybercrime is referred to online or Internet based illegal acts as distributing
malicious software or committing identify theft.
Crime ware: Software used by the cybercriminals called as crime ware. Combating crime
ware is one of the priorities of FBI.
1. Differentiate among hacker, crackers, script kidders, Cybertortionist
, cybercriminals?
Safety Measures:
Do not share personal information with other online gamers.
Excersie the caution if game require JavaScript or ActiveX. It must played in
administration mode.
Use firewall and allow only trusted people to access computer or device.
Read permission to check what information is required.
Before downloading game check the developer.
4. Define these terms:
Botnet: Botnet or zombie army is a group of compromised computers which are
connected with each other such as internet, to attack other network especially for
nefarious purpose.
Zombie: Zombie is the compromised computer or device, whose owner is unaware
that is computer and device is being controlled remotely by an outsider.
Bot: A bot is a program that performs a repetitive task on a network. Cybercriminals
install malicious bot on the un protected computer or device to create botnet.
5. Describe the damages caused by and private motivated behind the
DoS and DDoS?
Damages:
1. Denial of services attack: DoS is an assault whose purpose is to disturb computer
access to the internet services such as web or mail. Victim computer slows down and
eventually unresponsive and unavailable.
2. Distributing denial of services attack: DDoS is a more devasting type of DoS in
which zombie army attack computer or computer network. It able to stop working at
numerous websites such as Yahoo.com, CNN.com.
Motivation:
Hactivits or those disagree with belief or actions of a particular organization,
claim political anger motivates their attacks. Some perpetrators use their attack
as a vehicle for extortion. Other simply wants the recognition although it is
negative.
6. A(n)…… allows user to bypass security controls when accessing a
program, computer, or network?
Back door. 8. Define the term, spoofing. How can you tell if an email is
spoofed?
Spoofing is a technique intruders use to make their network or Internet transmission appear
legitimate to a victim computer or network.
Email spoofing occurs when the sender’s address or other components of an email header are
altered so that it appears that the email message originated from a different sender. Email
spoofing commonly is used in virus hoaxes, spam, and phishing scams.
Methods that protect computers, mobile devices, and networks from attacks include the
following
11. Define the terms, firewall and proxy server. List steps to set up
a personal firewall.
A firewall is hardware and/or software that protects a network’s resources from intrusion
by users on another network, such as the Internet.
A proxy server is a server outside the organization’s
network that controls which communications pass in and out of the organization’s network.
The following steps describe how to set up a personal firewall.
The following
steps describe how to set up a personal
firewall.
1. Locate and purchase a personal
firewall.
You can purchase personal
firewalls online and in stores that
sell software. Many operating systems
include a personal firewall.
2. If you purchase a personal firewall,
follow the instructions to install the
program on your computer.
3. Run the personal firewall.
4. If necessary, ensure the personal
firewall
is enabled.
5. Review the settings for the incoming and
outgoing rules.
6. Back up or export your current list of
incoming and outgoing rules.
7. Adjust your incoming rules to disallow
devices, programs, and services you do
not want accessing your computer. Be
careful adjusting these settings.
8. Adjust your outgoing rules to allow only
appropriate programs on your computer
to communicate with other computers
and mobile devices on your network
or the Internet.
9. Save your settings.
10. Test programs on your computer that
require Internet access. If any do not
function properly, restore the list of rules
you backed up or exported in Step 6.
11. Exit the personal firewall.
13. Identify what an AUP should specify. Why might you disable
file and printer sharing?
An organization’s AUP should specify
the acceptable use of technology by employees for personal reasons.
Some organizations prohibit such use entirely. Others allow personal use
on the employee’s own time. Whatever the policy,
an organization should document and explain it to employees. The
AUP also should specify the personal activities.
To protect your personal computer from unauthorized intrusions,
you should disable file and printer sharing in your operating system. This security measure
attempts to ensure that others cannot access your files or your printer.
14. Explain how an organization uses access controls and audit trails.
Many organizations use access controls to minimize the chance that a perpetrator
intentionally may access or an employee accidentally may access confidential information on
a computer, mobile device, or network. An access control is a security measure that defines
who
can access a computer, device, or network; when they can access it; and what actions they can
take while accessing it. In addition, the computer, device, or network should maintain an audit
trail that records in a file both successful and unsuccessful access attempts.
The basic difference is among these terms is just terminology. A username is a unique
combination of characters, such as letters of the alphabet or numbers that identifies one
specific user. Whereas a password is a private combination of characters associated with the
username that allows access to certain computer resources. A passphrase is a private
combination of words, often containing mixed capitalization and punctuation, associated with a
username that allow access to certain computer resources. It can be up to 100 characters in
length. It is more secure than passwords. A passcode is a numeric password, either assigned by
a company or selected by a user. It provides an additional level of security.
Single sign on account is a session and user authentication service that permits a user to use
one set of login credentials to access multiple applications. The service authenticates the end
user for all the applications the user has been given rights to and eliminates further prompts
when the user switches applications during the same session. PIN stands for Personal
Identification Number.
Possessed objects: A possessed object is any item that a person must possess, or carry
with him, in order to gain access to a computer or computer facility. Examples of possessed
objects are badges, cards, smart cards, and keys.
A lock screen is a screen that restricts access to a computer or mobile device until a user
performs a certain action. Some simply require a user swipe the screen to unlock the screen.
Others verify a user’s identity by requiring entry of a password, PIN, or passcode, a fingerprint
scan, or a gesture swipe. Gestures are motions users make on a touch screen with the tip of
one or more fingers or their hand.
Face Recognition System: A face recognition system captures a live face image and
compares it with a stored image to determine if the person is a legitimate user. Some buildings
uses face recognition systems to secure access to rooms. Law enforcement, surveillance
systems, and airports use face recognition to protect the public.
Hand Geometry System: A hand geometry system measures the shape and size of a
person’s hand. Because hand geometry systems can be expensive, they often are use in
larger companies to track workers’ time and attendance or as security devices.
Iris Recognition System: High security areas use iris recognition systems. The
camera in an iris recognition system uses iris recognition technology to read patterns in the
iris of the eye. These patterns are as unique as a fingerprint.
If a person cut his finger, a fingerprint reader might reject the person as a legitimate
user.
Hand geometry readers can transmit germs.
If a person is nervous, a signature might not match the one on file.
If a person has a sore throat, a voice recognition system might reject him.
Two-step verification:
In an attempt to further protect personal data and information from online thieves, many
organizations such as financial institutions or universities that store sensitive or confidential
items use a two-step verification process. With two step verification, also known as two-factor
verification, a computer or mobile device uses two separate methods, one after the next, to
verify the identity of a user. Atms (automated teller machines) usually requires it. Users first
insert their atm card into the atm (step 1) and then enter a pin (step 2) to access their
bank account.
Similarly while logging in to any networking site, when user sign in to an account on a
computer, they enter a user name and a password (step 1) next, they are prompted to enter
an authentication code (step 2), which is sent as a text or voice message or via an app on a
smartphone.
Question # 23: Define the term, digital forensics. Name areas in which
digital forensics are used.
Digital forensics:
It also called cyberforensics, is the discovery, collection, and analysis of evidence found on
computers and networks. It involves the examination of media, programs, data and log files on
computers, mobile devices, servers, and networks.
Law enforcement
Criminal prosecutors
Military intelligence
Insurance agencies
Information security departments
Question # 24: Define the terms, software theft, keygen, and software
piracy. Identify methods to prevent software theft.
Software theft:
Software theft occurs when someone steals software media, intentionally erases programs,
illegally registers and/or activates a program, or illegally copies a program.
Keygen:
A program called keygen; short for key generator, creates software registration numbers and
sometimes activation codes. Some unscrupulous individuals create and post keygens so that
user can install software without legally purchasing it.
Software piracy:
It often referred to simply as piracy, is the unauthorized and illegal duplication of copyrighted
software. Piracy is the most common form of software theft.
To protect software media from being stolen, owners should keep original software boxes and
media or the online confirmation of purchased software in a secure location, out of sight of
prying eyes. All computer users should backup their files and drives regularly, in the event of
theft. When some companies terminate a software developer or if he quits, they escort the
employee off the premises immediately. These companies believe that allowing terminal
employees to remain on the premises gives them time to sabotage files and other network
procedures.
Product activation:
Many manufacturers incorporate an activation process into their programs to ensure the
software is not installed on more computers than legally licensed. During a product activation
which is conducted either online or by on phone user provide the software product’s
identification number to associate the software which the computer or mobile device on which
the software is installed. Usually, the software can be run a present number of times, has
limited functionality, or does not function until you activate it. To further protect them-self
from software piracy, software.
Single-or-end-user:
The most common type of license included with software purchased by individual user is a
single-user license agreement also called an end-user license agreement (EULA). The license
agreement provide the specific condition for use of this software which a user must accept
before using the software.
Network license:
A network license is a legal agreement that allows multiple user to access the software on the
server simultaneously. The network license fee usually is based on the number of users or the
number of computer attached to the network.
Site license:
A site license is a legal agreement that permits user to install the software on multiple
computers-usually at a volume discount.
You can:
Install the software on only computer or device (some license agreement allow user to
install the software on a specified number of computer and / or mobile devices).
Make one copy of software as a backup.
Give or sell a software to another individual, to only if software is removed from user’s
computer first.
You can’t:
Information theft:
It occurs when someone steals personal or confidential information. Both business and home
users can fall victim to information theft. An unethical company executive may steal or buy
stolen information to learn about a competitor. A corrupt individual may steal credit card
number to make fraudulent purchases.
Encryption algorithm:
An encryption algorithm, or cyber, is a set of steps that can convert readable plaintext into
unreadable ciphertext. A simple encryption algorithm might switch the order of characters or
replace characters with other characters.
Encryption key:
An encryption key is a set of characters that the originator of the data uses to encrypt the
plaintext and the recipient of the data uses to decrypt the ciphertext.
Many people are uncomfortable with the thought of using an iris scanner.
Mobile users today often access their company networks through a virtual private network.
When a mobile user connects to a main office using a standard Internet connection, a virtual
private network (VPN) provides the mobile user with a secure connection to the company
network server, as if the user has a private line. VPNs help ensure that data is safe from being
intercepted by unauthorized people by encrypting data as it transmits from a laptop,
smartphone, or other mobile device.
31. Define these terms: digital signature, digital certificate, and secure
site?
Digital signature:
Digital certificate:
Secure site:
A website that uses encryption techniques to secure its data is known as a secure site Web
addresses of secure sites often begin with https instead of http. Secure sites typically use
digital certificates along with security protocols.
Hardware theft is the act of stealing digital equipment. Hardware vandalism involves defacing
or destroying digital equipment. Hardware can fail for a variety of reasons: aging hardware,
natural or man-made disasters, or random events such as electrical power problems, and even
errors in programs or apps.
Backup:
A backup is a duplicate of a file, program, or media that can be used if the original is lost,
damaged, or destroyed; and to back up a file means to make a copy of it.
Restore:
Restore means copying the backed up files to their original location on the computer or
mobile device in case of system failure or the discovery of corrupted files.
A disaster recovery plan typically contains these four components: emergency plan, backup
plan, recovery plan, and test plan.
Emergency Plan:
An emergency plan specifies the steps Rosewood will take as soon as a disaster strikes. The
emergency plan is organized by type of disaster, such as fire, flood, or earthquake test plan.
Backup Plan:
The backup plan specifies how Rosewood will use backup files and equipment to resume
computer operations.
Recovery Plan:
The recovery plan specifies the actions Rosewood will take to restore full computer operations.
Test Plan:
The test plan includes simulating various levels of disasters and recording Rosewood’s ability to
recover.
When you set up a wireless network, it is important to secure the network so that only your
computers and mobile devices can connect to it. Unsecured wireless networks can be seen and
accessed by neighbors and others nearby, which may make it easier for them to connect to and
access the data on the computers and mobile devices on your network. The following list
provides suggestions for securing your wireless network:
• Immediately upon connecting your wireless access point and/or router, change the password
required to access administrative features.
• Use a PIN.
Technology ethics are the moral guidelines that govern the use of computers, mobile
devices, information systems, and related technologies.
Information accuracy is a concern today because many users access information
maintained by other people or companies, such as on the Internet. In addition to concerns
about the accuracy of computer input, some individuals and organizations raise questions
about the ethics of using computers to alter output, primarily graphic output, such as a
retouched photo.
Intellectual property rights are the rights to which creators are entitled for their work.
Certain issues arise surrounding IP (intellectual property) today because many of these works
are available digitally and easily can be redistributed or altered without the creator’s
permission.
A copyright gives authors, artists, and other creators of original work exclusive rights to
duplicate, publish, and sell their materials. A copyright protects any tangible form of expression.
Inaccurate data can result in lost revenues for businesses when potential customers
cannot find the storefront.
It also has caused accidents when drivers followed turn by-turn GPS directions.
Drove the wrong way on one-way streets.
Made illegal turns, ended at ponds where a road stopped.
Data entry errors also can lead to lost business, lawsuits, and expenses.
Use computers and devices that comply with the ENERGY STAR program.
Do not leave a computer or device running overnight.
Turn off the monitor, printer, and other devices when not in use.
Some companies and individuals collect and use this information without your
authorization.
Websites often collect data about you, so that they can customize advertisements and
send you
personalized email messages.
Some employers monitor your computer usage and email messages.
43: Describe how following techniques are used to collect Personal data:
Electronic profile, Cookies, Phishing, Click jacking , Spyware, Adware, and
Mad ware?
Electronic profile:
When you fill out a printed form, such as a magazine subscription or contest entry, or an online
form to sign up for a service, create a profile on an online social network, or register a product
warranty, the merchant that receives the form usually stores the information you provide in a
database. Some merchants may sell or share the content of their database with national
marketing firms and internet advertising firms. By combining this data with information from
public records, such as driver’s licenses and vehicle registration, these firms can create an
electronic profile of an individual.
Cookies:
Most websites that allow for personalization use cookies to track user preferences. These
cookies may obtain their values when a user fills in an online form requesting personal
information. Some websites, for example, store users name in cookies in order to display a
personalized greeting that welcomes the user by name back to the website. Some allow users
to customize their viewing experience with preferences such as local news and local weather
forecast or stock quotes.
Phishing:
These messages look legitimate and request that you can update credit card numbers, social
security number, bank account numbers, passwords, or other private information.
Click jacking:
With click jacking, an object that can be tapped or clicked- such as a button, image, or link-on a
website, pop-up ad, pop under ad, or in an email message or text message contains a malicious
program. When a user taps or clicks the disguised objects, a variety of nefarious events may
occur. For example, the user may be redirected to a phony website that requests personal
information, or a virus may download to the computer or mobile device.
Spyware:
Spyware is a program placed on a computer or mobile device without the user’s knowledge that
secretly collect information about the user and then communicates the information it collects to
some outside source while the user is online.
Adware:
Madware:
Phishing scams can be perpetrated via email messages, websites, and even on the phone. The
following will help protect you phishing scams.
Phone scams:
E-mail scams:
Website scams:
Employee monitoring involves the use of computer, mobile devices, or cameras to observe,
record, and review an employee’s use of a technology , including communications such as
email message , keyboard activity (used to measure productivity), and websites visited.
Content filtering opponents argue that banning any materials violates constitutional
guarantees of free and personal rights.