Tutorial Sheet 1 Core Threats to

Information System Security

1. In recent months, there has been an increase in cyber-attacks/security in

the news. Working in pairs, use the resources available to research a
recent cyber-attack and prepare a short presentation to introduce your
findings to the rest of the class.

Answer:

2. Using a Web search engine, find an article from a reputable source

published within the past six months that reports on the relative risk that
comes from inside the organisation as opposed to risk that comes from
external sources. If the article notes that this relative risk is changing,
how is it changing and to what does the article attribute to the change?
Answers:

Tutorial Sheet 2 Deliberate Software

Attacks
1. Deliberate Software Attacks: What are they?

Answers:

2. Why Information Security is mandatory to avoid deliberate software

attacks?

Answers:
Deliberate software attacks mainly happen because of some flaws in
organisations main software and information security system.
Information security can not only provide security, but it can also
provide usability and validity to the customers who are using the
organisations services or software.

3. How Information Security can help to avoid deliberate software

attacks?

Answers:
Information security can help in many ways to provide protection from
the deliberate software attacks. Following are some main features of
information security that can help to avoid deliberate software attacks:

1. The most obvious threats to any company or organization is the

employees of that company. Many employees who resigned or fired from
the company can easily attack the servers of the company via
deliberate software attacks. Information security systems can categorize
the information and provide only mandatory information to the
employee, which is necessary to carry his or her task.
2. Information security systems can alert you in case of large deliberate
software system attacks via implementation of alarming softwares, so
that you can transfer your confidential information to some remote safe
areas.

4. What is the difference between a threat agent and a threat?

Answer:

5. What is the difference between vulnerability and exposure?

Answer:

6. What are the main threats posed to information system security?

Answer:

7. Can you explain some of the more common attacks associated with
those threats?

Answer:

8. You can get a virus just by opening and reading your email. Discuss
why?
Answer:

9. What is a threat in the context of information security? How many

categories of threats exist as presented in this lesson?

Answer:

A threat is an object, person, or other entity that represents a constant danger

to an asset. Twelve categories are listed: Act of human error or failure,
comprises to intellectual property, deliberate acts of espionage or trespass,
deliberate acts of information extortion, deliberate acts of sabotage or
vandalism, deliberate acts of thefts, deliberate software attacks, forces of
nature, deviations of service from service providers, technical hardware
failures, software failures or errors, and technological obsolescence.

10. How can vulnerability be converted into an attack? What label

would we give to the entity that performs this transformation?

Answer:

A vulnerability can be converted into an attack by a threat agent if it not

addressed.

11. Which of the following is most likely to send spam emails from your
computer?
A. Trojan
B. Worm
 C. Virus
D. Spyware
E. Adware

12. Which of the following is most likely steal your identity?

A. Trojan
B. Worm
C. Virus
D. Spyware
E. Adware
13. Which of the following is less likely to be detected with standard
antivirus software?
A. Trojan
B. Worm
C. Virus
D. Spyware
E. Adware

14. DoS attacks cannot be launched against routers. Discuss why?

Answers:

15. Deliberate software attacks are referred to as:

A. Malware
B. Malicious code
C. Malicious software
D. All of the above

16. ____________involves building an inappropriate trust relationship with

employees for the purpose of gaining sensitive information or
unauthorised access privileges.
A. Tailgating
B. Hacking
C. Phishing
D. Social Engineering
E. Spamming
Answer: D
17. Unintentional threats to information systems include all of the
following except:
A. Malicious software
B. Power Outage
C. Lack of user experience
D. Tornados
Answer: A