Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (h) Once an attack on the company’s website was discovered, it took more than 30 minutes to determine whom to contact to initiate response actions.

Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (h) Once an attack on the company’s website was discovered, it took more than 30 minutes to determine whom to contact to initiate response actions.

Pkg Acc Infor Systems MS VISIO CD

10th Edition

ISBN:9781133935940

Author:Ulric J. Gelinas

Publisher:Ulric J. Gelinas

Chapter8: Controlling Information Systems: Introduction To Pervasive Controls

Section: Chapter Questions

Problem 11DQ

See similar textbooks

Similar questions

Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (d) An employee received an email purporting to be from her boss informing her of an important new attendance policy. When she clicked on a link embedded in the email to view the new policy, she infected her laptop.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (g) Attackers broke into the company’s information system through a wireless access point located in one of its retail stores. The wireless access point had been purchased and installed by the store manager without informing central IT or security.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (j) An attacker gained access to the company’s internal network by installing a wireless access point in a wiring closet located next to the elevators on the fourth floor of a high-rise office building that the company shared with other companies.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (i)To facilitate working from home, an employee installed a modem on his office workstation. An attacker successfully penetrated the company’s system by dialing into that modem.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (e)A company’s programming staff wrote custom code for the shopping cart feature on its website. The code contained a vulnerability that could be exploited when the customer typed in the ship-to address.
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (c) A criminal remotely accessed a sensitive database using the authentication credentials (user ID and strong password) of an IT manager. At the time the attack occurred, the IT manager was logged into the system at his workstation at company headquarters.
Listed here are five scenarios. For each scenario, discuss the possible damages that can occur. Suggest a preventive control.a. An intruder taps into a telecommunications device and retrieves the identifying codes and personal identification numbers for ATM cardholders. (The user subsequently codes this information ontoa magnetic coding device and places this strip on a piece of cardboard.)b. Because of occasional noise on a transmission line, electronic messages received are extremely garbled.c. Because of occasional noise on a transmission line, data being transferred is lost or garbled.d. An intruder is temporarily delaying important strategic messages over the telecommunications lines.e. An intruder is altering electronic messages before the user receives them.
The IT auditor can MOST (select one) effectively help a company deal with increasing IT-related risk by: a) Alerting management and the Audit Committee of the risks related to IT, and making audit recommendations that are focused on the root cause. b) Performing a weekly review of system-based audit logs to determine if the company has been breached. c) Ensuring that the company has a log-in banner that warns unauthorized users that they may be subject to criminal prosecution and penalties. d) Conducting an audit of the company's network security and pointing out weak firewall configuration settings in the audit report.
1. For each occurrence below identify the policy(ies), practice(s), or procedure(s) that would be most effective in addressing the error or irregularity. For each control you identify, indicate (1) if it is a preventive, detective, or corrective control, and (2) which of the four internal control objectives is addressed.a. A computer hardware component malfunctions during a processing run, causing many of the accounts receivable records to be lost. b. A five-minute power failure causes the computer system to cease functioning, thus resulting in the loss of data being transmitted from several terminals. c. During a violent electrical storm, an employee was keying data at one of the computers in the order entry department. After about an hour of data entry, lightning caused a company-wide power failure. When power was restored, the employee had to re-key all the data from scratch. d. An inexperienced computer operator mounts the accounts receivable master file (on magnetic tape reel) for…
When a fraud has occurred within an organization, management must decide what follow-up action (s) to take. Briefly describe the three follow-up alternatives available to organizations?
Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (a) An employee’s laptop was stolen at the airport. The laptop contained personally identifying information about the company’s customers that could potentially be used to commit identity theft.
An IT auditor is performing a test of the company's user access administration process, and has selected a random sample of 25 user access requests to evaluate. The IT audit test procedures revealed that 1 of the 25 sampled user access requests has not been properly authorized according to company policy. As a key next step in the IT audit process, the IT auditor should (select the BEST response): a) Communicate this concern to the Chief Executive Officer as soon as possible. b) Communicate this concern to the Audit Committee as soon as possible. c) Disregard the finding entirely. d) Perform additional audit procedures to better understand the risks related to the issue, as well as the root cause of the problem.