Security _____ are the areas of trust within which users can freely communicate.

_____ is a professional association that focuses on auditing, control, and security. The membership comprises both technical and managerial professionals.

_____ uses a number of hard drives to store information across multiple drive units.

The CPMT should include a _____ who is a high-level manager to support, promote, and endorse the findings of the project and could be the COO or (ideally) the CEO/president.

_________ of information is the quality or state of being genuine or original.

_________ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse.

_______ security addresses the issues necessary to protect the tangible items, objects, or areas of an organization from unauthorized access and misuse.

The _____ hijacking attack uses IP spoofing to enable an attacker to impersonate another entity on the network.

_____ equals the probability of a successful attack multiplied by the expected loss from a successful attack plus an element of uncertainty.

Each of the following is a role for the crisis management response team EXCEPT:

In the TVA worksheet, assets are placed into a matrix with threats and then the exposure of the assets to specific threats is explored by documenting _____

Which of the following is an example of a Trojan horse program?

People with the primary responsibility for administering the systems that house the information used by the organization perform the role of ____.

Which of these is NOT a unique function of information security management?

In 2002, Congress passed the Federal Information Security Management Act (FISMA), which mandates that all federal agencies _____

The _____ is the high-level information security policy that sets the strategic direction, scope, and tone for all of an organization’s security efforts.

In a _____, assets or threats can be prioritized by identifying criteria with differing levels of importance, assigning a score for each of the criteria, and then summing and ranking those scores.

Flaws or weaknesses in an information asset, security procedure, design, or control that can be exploited accidentally or on purpose to breach security are known as _____

In 1993, the first _____ conference was held in Las Vegas. Originally, it was established as a gathering for people interested in information security, including authors, lawyers, government employees, and law enforcement officials.

A threat _____ is an evaluation of the threats to information assets, including a determination of their likelihood of occurrence and potential impact of an attack.

Which of the following is NOT one of the categories recommended for categorizing information assets?

A technique used to compromise a system is known as a(n) ___________.

The _____ risk treatment strategy attempts to eliminate or reduce any remaining uncontrolled risk through the application of additional controls and safeguards.

A(n) _____ is an authorization issued by an organization for the repair, modification, or update of a piece of equipment.

The transfer of transaction data in real time to an off-site facility is called ____.

Individuals who are assigned the task of managing a particular set of information and coordinating its protection, storage, and use are known as data _________?

The maximum amount of time that a system resource can remain unavailable before there is an unacceptable impact on other system resources is ____.

An organization aggregates all local backups to a central repository and then backs up that repository to an online vendor with a ____ backup strategy.

Which of the following acts is also widely known as the Gramm-Leach-Bliley Act?

______ is a network project that preceded the Internet.

Standards may be published, scrutinized, and ratified by a group, as in formal or ____ standards.

Advance-Fee fraud is an example of a ______ attack.

34. ______ are compromised systems that are directed remotely (usually by a transmitted command) by the attacker to participate in an attack.

Which of the following is a term used to describe computers that have been compromised and are controlled remotely by an attacker?

The _____ risk treatment strategy is the choice to do nothing to protect a vulnerability and to accept the outcome of its exploitation.

Risk _____ is the application of security mechanisms to reduce the risks to an organization’s data and information systems.

The redirection of legitimate user Web traffic to illegitimate Web sites with the intent to collect personal information is known as ______.

An information system is the entire set of __________, people, procedures, and networks that enable the use of information resources in the organization.

The goals of information security governance include all but which of the following?

The SETA program is a control measure designed to reduce the instances of _____ security breaches by employees.

A table of hash values and their corresponding plaintext values that can be used to look up password values if an attacker is able to steal a system’s encrypted password file is known as a(n) _____

A _____ site provides only rudimentary services and facilities.

The Digital _____ Copyright Act is the American contribution to an international effort by the World Intellectual Properties Organization (WIPO) to reduce the impact of copyright, trademark, and privacy infringement.

According to NIST SP 800-14's security principles, security should _____

Microsoft acknowledged that if you type a res:// URL (a Microsoft-devised type of URL) longer than _____ characters in Internet Explorer 4.0, the browser will crash.

The average amount of time between hardware failures, calculated as the total amount of operation time for a specified number of units divided by the total number of failures, is known as ______.

An information security _____ is a specification of a model to be followed during the design, selection, and initial and ongoing implementation of all subsequent security controls, including information security policies, security education, and training.

A _____ is an attack in which a coordinated stream of requests is launched against a target from many locations at the same time.

A(n) _____ plan is a plan for the organization’s intended efforts over the next several years (long-term).

The _____ is a respected professional society that was established in 1947. Today it is “the world’s largest educational and scientific computing society.”

A(n) _____ scheme is a formal access control methodology used to assign a level of confidentiality to an information asset and thus restrict the number of people who can access it.

_____ is simply how often you expect a specific type of attack to occur.

Risk _____ defines the quantity and nature of risk that organizations are willing to accept as they evaluate the trade-offs between perfect security and unlimited accessibility.

The _____ defines stiffer penalties for prosecution of terrorism-related activities.

Understanding the _____ context means understanding the impact of elements such as the business environment, the legal/regulatory/compliance environment, as well as the threat environment.

The stated purpose of ISO/IEC 27002:2013 is to give guidelines for organizational information security standards and information security _____ practices.

The Health Insurance Portability and Accountability Act of 1996, also known as the _____ Act, protects the confidentiality and security of health-care data by establishing and enforcing standards and by standardizing electronic data interchange.

The point in time before a disruption or system outage to which business process data can be recovered after an outage is ____.

A ____ is an agency that provides physical facilities in the event of a disaster for a fee.

____ law comprises a wide variety of laws pertaining to relationships among individuals and organizations.

________ was the first operating system to integrate security as one of its core functions.

____ is the rapid determination of the scope of the breach in the confidentiality, integrity, and availability of information and information assets during or just following an incident.

As each information asset is identified, categorized, and classified, a(n) ____ value must be assigned to it.

Digital forensics involves the _____, identification, extraction, documentation, and interpretation of digital media.

The most common schedule for tape-based backup is a _____ backup, either incremental or differential, with a weekly off-site full backup.