A company sells products through its webpage. An attacker finds a way to inject commands into their website and retrieve information. The company stores its data unencrypted and uses a weak password for the main server. The company lost major customers’ information due to a hacking incident. From the above scenario, A. Which CIA security model elements were affected in this scenario? a.Define and identify the threat, vulnerability, and impact in this scenario? b.Suggestsome security controls, at least 3, that can be used to secure the system.

A company sells products through its webpage. An attacker finds a way to inject commands into their website and retrieve information. The company stores its data unencrypted and uses a weak password for the main server. The company lost major customers’ information due to a hacking incident. From the above scenario, A. Which CIA security model elements were affected in this scenario? a.Define and identify the threat, vulnerability, and impact in this scenario? b.Suggestsome security controls, at least 3, that can be used to secure the system.

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter1: Introduction To The Management Of Information Security

Section: Chapter Questions

Problem 15RQ

See similar textbooks

Similar questions

To assume that your company's mail server has sent you a message telling you that your password has been changed and that you need to verify this, assume that the message is genuine. However, as far as you know, you haven't changed the password at all! What may have caused the password to be changed in the first place Whose computers might have been infected with malware that could have provided an attacker with the password reset information?
Imagine that a virus was attached to an email that was sent to Jim, and that this email caused Jim to get infected with the virus. Are you able to provide a description of this attack, including the vulnerabilities, hazards, and those who committed it?
A "distributed denial of service assault" is what we call this kind of attack, and it can be orchestrated by only one person. How do you define it?
The challenge response authentication system (CRAS) is a system that utilises a question and its corresponding answer to authenticate users. This system is designed to verify the identity of users by posing a challenge question and requiring the user to provide the correct response. What is the comparative level of security offered by this authentication method in contrast to a password-based approach?
If you're unfamiliar with distributed denial-of-service attacks, allow me to explain.
Take into consideration the recently found flaw in the system that handles authentication and access control. If this is the case, then what impact did it have on the activities that took place on a daily basis? Is there a record of the amount of money that has been lost by the company?
A "distributed denial of service attack" is what it's termed, and a single individual might be responsible for its coordination. What exactly is it?
First, argue for the best information security practice, whether a block cipher or stream cipher should be used to encrypt a video data file sent through the internet as part of a major, successful entertainment service. The entertainment company has a large market share, and ample resources. Secondly, argue for the most secure choice of which kind of cipher should be used for the authentication exchange between the user and the entertainment service web portal. The entertainment service is expensive to the customer, and users are wary of the misuse of their accounts. Consider the nature of the traffic and its pattern, and the nature of the keys to use.
A "distributed denial of service attack" is what it is termed, and it may be orchestrated by a single individual. How do you define it?
Imagine if a virus were to be attached to an email and delivered to Jim, causing him to become infected. Can you describe this assault in terms of its vulnerabilities, dangers, and the perpetrators?
It's possible that you have an opinion on the most recent security incident that made news because it included access control or authentication. More specifically, how did it influence the day-to-day operations of the company? How much cash has been squandered by the company?
SCENARIO 1: You have just completed a routine security audit on the company’s information systems, and you found several areas of vulnerability. For example, file permissions have not been updated in some time, no comprehensive password policy exists, and network traffic is not fully encrypted. You noted these areas, among others, in a report to your supervisor. The report included specific recommendations to fix the problems. Your supervisor responded by saying that budgets are tight right now, and she could not approve your requests to resolve these issues. As an IT professional, you are very uncomfortable with the risk level, but you have been unable to sway your supervisor. When you discussed the situation with a colleague, he said, “Why worry about it? If it’s good enough for her, it should be good enough for you.” What do you think of your colleague’s advice, and why? Is this an ethical question? If you are still is uncomfortable, what are your options? SCENARIO 2: You work for a…