Chapter 1, Problem 11.4EC

Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (c) A criminal remotely accessed a sensitive database using the authentication credentials (user ID and strong password) of an IT manager. At the time the attack occurred, the IT manager was logged into the system at his workstation at company headquarters.

The internal auditor of a small company has recommended to the CEO that it invest in a disaster recovery plan (DRP) because of several identified vulnerabilities. Traditional in-house DRP approaches are, however, not a viable option because the company lacks the necessary IT resources to implement and manage these tasks. The auditor has suggested that outsourcing disaster recovery to a cloud-based service provider may be a reasonable alternative. The CEO has no experience with cloud computing and has asked the internal auditor to provide him with more information. Required: Prepare a report outlining cloud computing. Your report should address the following: Describe how the services provided under cloud computing relate to disaster recovery planning. Outline the risks associated with this technology

The internal auditor of a small company has recommended to the CEO that it invest in a disaster recovery plan (DRP) because of several identified vulnerabilities. Traditional in-house DRP approaches are, however, not a viable option because the company lacks the necessary IT resources to implement and manage these tasks. The auditor has suggested that outsourcing disaster recovery to a cloud-based service provider may be a reasonable alternative. The CEO has no experience with cloud computing and has asked the internal auditor to provide him with more information. Required: Prepare a report outlining cloud computing. Your report should address the following: List the key features of cloud computing

Viljoen plc has suffered the following events:(1) An accidental failure of IT security resulting in publication of confidential client data(2) A deliberate breach of IT security resulting in client data being passed to a competitor(3) A new government regulation resulting in increased IT security costsWhich of these events are examples of cyber risks materialising?A. (1) and (2) onlyB. (1) and (3) onlyC. (2) and (3) only OD. (1), (2) and (3)

Which of the following statements is NOT correct? a. EAMs capture transactions during processing without removing the application from service. b. EAMs support continuous monitoring of controls. c. EAMs have the potential to corrupt corporate databases d. EAMs decrease operational performance. e. All of the above are correct statements.

STUDY QUESTIONS   Why is human behavior considered one of the  biggest potential threats to operating system integrity? What are the issues that need to be considered before implementing keystroke monitoring? Describe the three ways on how an audit trail can be used to support security objectives. Explain how poorly designed audit trail logs can actually be dysfunctional. Why would a systems programmer create a back door if he or she has access to the program in his or her day-to-day tasks?   PROBLEMS   Problem 1:   Charles Hart, an accounts payable clerk, is an hourly employee. He never works a minute past 5 P.M. unless the overtime has been approved. Charles has recently found himself faced with some severe financial difficulties. He has been accessing the system from his home during the evening and setting up an embezzlement scheme. As his boss, what control technique(s) can be used to help detect this type of fraud?   Problem 2:   In 2002, Mr. Rollerball started Mighty Mouse,…

Which preventive, detective, and/or corrective controls would best mitigate the following threat, and why? (i)To facilitate working from home, an employee installed a modem on his office workstation. An attacker successfully penetrated the company’s system by dialing into that modem.

Select the correct answer(s) for the following multiple choice questions. Note that there may be more than one correct answer. Which of the following statements is (are) true about computer fraud perpetrators? a. They are typically younger and are motivated by curiosity, the challenge of beating the system, and gaining stature in the hacking community. b. They do not see themselves as criminals and rarely, if ever, seek to turn their actions into money. c. They write and sell malicious software that infect computers with viruses or can be used to steal money or data that can be sold. d. They are a top FBI priority because they organize fraud schemes targeted at specific individuals and businesses.

Select the correct answer(s) for the following multiple-choice questions. Note that there may be more than one correct answer. The number of incidents and the total dollar losses from computer fraud are increasing rapidly for several reasons: a. Many instances of computer fraud go undetected and many frauds are not reported. b. Many companies are moving to cloud services where there are few data security controls. c. Internet sites offer step-by-step instructions on how to perpetrate computer fraud and abuse. d. Law enforcement is not interested in preventing or prosecuting computer fraud. e. There are no laws against computer fraud so prosecution is difficult