Network Security  

Instructor: Professor Stephen Osborne

Task Type: Discussion Board 3   Deliverable Length: See assignment details    Points Possible: 50   Due Date: 9/16/2011 11:59:59 PM  CT

Review and reflect on the knowledge you have gained from this course. Based on your review and reflection, write at least 3 paragraphs on the following:

1.What were the most compelling topics learned in this course?2.How did participating in discussions help your understanding of the subject matter? 3.Is anything still unclear that could be clarified?4.What approaches could have yielded additional valuable information?

Respond to another student: Respond to 1 of your fellow classmates with a reply of at least 100 words about his or her primary task response regarding items you found to be compelling and enlightening.

Phase 5 Discussion Board 3 Resolution

Think about and then answer the below three questions.

1. What were the most compelling topics learned in this course?

2. How did participating in discussions help your understanding of the subject matter?

3. Is anything still unclear that could be clarified?4. What approaches could have yielded additional valuable

information?

Please respond to at least one others classmates’ post.

Task Type: Individual Project 2   Deliverable Length: 3–5 pages    Points Possible: 100   Due Date: 9/17/2011 11:59:59 PM  CT

In the context of e-mail communications security, prepare a 3–5 page white paper that describes the difference between Pretty Good Privacy (PGP) and Secure/MIME (S/MIME)

Be sure to reference all sources using APA style.

Please submit your assignment.

Individual Project 2 Resolution

Gather information from the CTU Library or the Internet on Pretty Good Privacy and Secure/MIME (S/MIME). Once you have collected all of your research, provide an overview of each.  

Are online backup services safe for our company data?

• This is an open-ended question. A better question is whether online backup services can be safe for company data, and the answer is “yes.” There are several questions you should ask before using an online backup service.

• Where is the data actually stored? Is it secure and safe from natural disasters or other more ordinary threats like temperature and humidity? Is the media high quality? Are redundancies in place?

•Under what conditions can data be recovered? Are you allowed to inspect the physical premises? Are backup power systems in place? As the value of your data increases, the depth of your questions will also increase.

•Online backup services might not be appropriate for your primary backups, but they may serve well for a level of redundancy.

How can I establish redundancy for my hosted Internet website?

• Many businesses are highly dependent on their Internet presence as a primary part of business. From sales to actual business processes and communications, the web servers and the functions they support are extremely important.

• Many of these same businesses have all the Internet operations located on a single hosted computer at another provider’s location.

•Although reputable hosting sites have reasonably good availability, it may not always be good enough if problems occur. Most hosts provide service-level guarantees and, for a price, many will offer redundancy for your host site.

•The next best level of redundancy is another hosted system through another provider. If the primary host has long-term difficulties, one can switch to a secondary host on relatively short notice. As a final measure of protection, make sure to have a system capable of running the basic operations internally, if necessary.

If I encrypt the data on my systems, how can I make sure someone will be able to decrypt it

should a disaster occur?

• Encryption is the process of combining one or more keys with data to make it unreadable without the key used for encryption. If only one person knows the key and that person leaves the company or is not available for some other reason, a company could be in a bad situation and unable to access important information.

• Failure to consider this kind of circumstance could be catastrophic. To avoid losing vital data, encryption should also be accompanied by a method to recover the data. Key individuals in the company could be given the decryption key, but this is not always adequate protection.

•An additional method is to create decryption tools that can recover the important data in the event of an emergency. Treat the encrypted data as one would treat important documents kept in a safe.

•How many people should have the combination, and would someone also store the combination in other safe places to provide some redundancy?

Is the backup software that came with my operating system (OS) good enough

for company backups?

• The answer to this question lies in an understanding of what makes an excellent backup program. Basic backup features aside, the most critical part of a backup are ensuring the data are recoverable.

• If a backup program merely writes the data to the backup media, then there is no assurance the data can be recovered, if necessary.

•High quality backup programs are able to perform some checks on the data while the backup is being made to ensure it is recoverable.

•The backup software that comes with the operating systems can do this kind of check, but as the sophistication of the software increases, so does the ability to verify integrity of the backups. The amount an organization wants to invest in backup software is related to the value of those backups.

How often should I perform backups?

• The simple answer is another question. How much data can you afford to lose? Keeping in mind that backups slow down system operation and also consume disk space, a system administrator needs to look at how much time would be spent recreating the lost data if something happens to the data.

• Some data cannot be recreated easily at all, so some form of ongoing redundancy should be considered.

•Other data, while not easy to recreate, are also not highly valuable, so a system administrator could afford to lose more. If business operations would be significantly interrupted by loss of data, then nightly backups should be performed.

•With less valuable data, data that do not change often, or data that are easily recreated, weekly or even monthly backups are sufficient.

How can I test my backups if there is not sufficient disk space to restore the data to a

secondary location?

• The best way to test a backup is to actually restore and test the resultant information. This is seldom possible though because disk space to hold the restored data is not always available. One alternative is to stream test the information. To stream test, individual files are restored and tested.

• During this process, the backup media can also be verified for integrity. The problem with this approach is many of the applications and associated data cannot be tested in isolation, but at least the integrity of the files can be checked.

Do backups go bad after time? • This was a larger problem in the past when backups

were made to more sensitive media like floppy disks and tape drives. Backups are now often made to secondary hard drives and CD or DVD media, which is generally more durable and less prone to problems.

• These media are not without their problems though, and while time may not be the biggest contributor to problems, environmental exposure combined with time can be. The answer to the question is that backup media does go bad, but it does not happen very often if the media are kept under appropriate conditions.

How much can I justify spending on disaster recovery plans?

• A system administrator can begin to address this question by determining how much a disaster would cost the business. After these values are established, the administrator can attempt to assign some probabilities to the types of problems the business might encounter.

• Although a flood might present an almost catastrophic situation to the business, if the business is in an area where this is extremely unlikely, then preparation for a flood would not make a lot of sense.

•Preparation for an earthquake in San Francisco might not be a bad idea though. How much do you spend in preparation for disaster? When one combines the cost of an event with the risk, one will have a sense of the threat to the business.

•Treat these disaster recovery plans somewhat as an individual would treat insurance. As a system administrator, one might want to discuss this topic with the person responsible for insurance coverage in the company.

More on Disaster Recovery

• Disaster recovery is critical for today's organization because weather-related or man-made disasters can occur at any time. Examples of disasters are extensive, from weather-related disasters like hurricanes and tornadoes to man-made disasters such as riots.

• Unfortunately, these events happen, but businesses must have operations back up and running as soon as possible.

• Disasters like the tsunami that struck Southeast Asia in December 2004 or Hurricane Katrina that hit the Gulf Coast region of the United States in August 2005 provide real-life examples that disasters can happen in any form and at any time. Businesses must have systems in place to protect themselves.

• Network outages can create the same damage to a business as a natural disaster. Although a network outage pales in comparison to a natural disaster, the effect on a business can be the same. The business is shut down. Money and time are lost. If steps are not taken quickly, the business may not recover.

Defining Disaster Recovery • Disaster recovery planning, sometimes called business

continuity planning, is defined by the Disaster Recovery Journal (DRJ) editorial review board as "The ability of an organization to respond to a disaster or an interruption in services by implementing a disaster recovery plan to stabilize and restore the organization's critical functions" (Disaster Recovery Journal, n.d.).

• The definition encompasses the activities that restore health to the system stricken by disaster. It is critical to understand that disaster recovery planning refers to a set of activities and processes to restore the health of a business to an acceptable state.

Disaster Recovery Teams

• Teamwork is an important component in disaster recovery planning. If a disaster occurs, many individuals are coordinated to restore business functions. When natural disasters occur, teams of personnel will be disbursed to provide help to people affected in the natural disaster's stricken areas.

• This is no different in business disaster recovery; each person on the disaster recovery team has a role to play. It is his or her job to coordinate an area of responsibility to bring the business network back up and operating.

• Disaster recovery teams develop long before a disaster occurs. Teams are created from different departments across the organization. They have members with a mix of technical and business skills who work together to identify critical resources and to prioritize critical operations for the organization.

Disaster Recovery Steps There are a number of steps involved in developing a

disaster recovery plan. These steps include the

following (Erbschloe, 2003):

1. Organization of the team

2. Assessing the potential risks

3. Establishing roles and responsibilities

4. Development of policies

5. Documentation

6. Preparation

7. Training and testing

8. Maintenance

•These steps illustrate that disaster recovery planning is more than a plan; it is a company-wide philosophy that enables the company to pull together all the pieces and use its resources to get the business back up and running.

Disaster Recovery Management • Disaster Recovery Management Teams (DRMTs)

are not necessarily included in disaster recovery plans, but they are necessary. DRMT are the managers and executives who are responsible for overseeing a disaster recovery plan and making sure the rules that were developed are followed.

• The leadership of the organization has to be sure that these knowledgeable workers get the resources they need, give the necessary support, and make sure the plan is being carried out as effectively as possible.

Introduction to Cyber Crimes and Networks • Cyber crime is a term that many people are now

familiar with; however, it is a term that was not a part of the common vernacular until recent years. As computers and computer networks, including the Internet, have increased in popularity, so have the opportunities to use these tools as systems to commit policy violations as well as civil and criminal activities.

• When considering cyber crime, one must remember there are many types of crimes commonly committed using computer systems.

• To understand cyber crimes in relation to computer network penetration, one must first understand the concept of computer networks. At its most basic level, a computer network is two or more computers connected together to allow communications between two users.

•When considering computer network penetration, it is important to consider the types of attacks that can occur and where these attacks may originate. It is common for security professionals to focus on the possibility of external attacks and not put sufficient focus on the potential for internal attacks.

• Computer users connected to a network must realize that in today’s society there is always a possibility of interception of any information on a networked computer or one shared over an Internet connection.

•Standard security recommends that users look for “the lock” that indicates the security of a Web site or HTTPS in the Web address, again to indicate security. These are good indications of the security of the Web site; however, this does not indicate the security of the user’s Internet connection.

Challenges of Information Security

• Attackers are always interested in gaining something from the organization or person attacked. It may be the notoriety of having performed the attack, the data gained during the attack, or any of the other results when a network attack occurs.

There are six significant challenges outlined, which include the following (Egan & Mather, 2005):

•E-commerce is where the attack could occur to the organization selling the product or service or to the purchaser where the attacker is attempting only to gain the individual’s purchase information.

•The information security requirements of the organization must be maintained. Organizations must maintain the security of their data. In today’s marketplace, the importance of an organization's customer database, employee records, product plans, and other data are the backbone of the organization; the loss of this information could cause lawsuits and other situations that can lead to the organization’s failure.

•The immature information security market is a problem that many do not readily recognize; however, many areas of information security still do not meet the needs of consumers or organizations.

•Organizations may also lack experienced information security personnel.

•With the increase in government legislation and industry regulations, organizations must not only ensure compliance with company policies but also all of the government and other regulations.

•The final challenge for organizations to face is the increasing mobile workforce and wireless computing. The mobile workforce has increased physical security risks related to the mobility of the data through mobile devices such as laptops and smart phones. In addition, to be considered are the information risks related to employees using unsecured networks at airports or other public locations or attackers using the convenience of public access to observe users and gain access to information that would have been unavailable if the employee was within the organization’s business environment.

Internal Crackers

• In today's corporate world internal crackers are serious threats possibly even more so than external crackers since internal crackers already have access to the network. But all hope is not lost there are lots that can be done to combat internal hacking.

•Firstly, one should set clearly defined policies for what is and is not acceptable use of the corporate network. The policies should define what acceptable use of network resources is and what resources one is allowed to access and the ones they are not allowed to access depending on there role within the company.

•A part of this policy should also be controls to police the network security personal, administrators, and anyone else with access to sensitive information.

•Some such controls could be background checks, making sure old user accounts are disabled, make sure to check for backdoors, and educating employees about the security policies.

•Another good practice is to make sure security responsibilities are distributed amount many people. This way no one person has access to everything so no one person can be comprised or paid-off to take down the entire network security.

The policy should also clearly define the consequences of violating the policy. And the most important part is the policy should be enforced because if the policy is not enforced it is completely useless and you might as well not have one.

•Secondly, file and folder security should be implemented such as NTFS permissions embedded in the newer versions of windows. It allows the admin to set up access control lists (ACL) to control what each user as access to and how much access they have.

•For example it can be set up the ACL to allow John Smith the read and open files in the Corporate Manuals folder but not delete or change them.

•File and folder security is important because it would be ideal for every employee to follow the security policy but in reality that is not always the case and that is were file and folder security comes in.

•Although not all internal hacking attempts are from malicious means some are just out of curiosity or just a plain accident but if the file and folder security is configured properly it should stop most internal hacking attempts.

• This idea ties into the concept of "Least Privilege" which is the idea that employees should only get permissions and access to what they need to complete the role of their jobs.

•Finally, an audit policy should be implemented to monitor high risk resources or the resources that have the highest impact on the companies operations. The audit policy will help to determine possible hacking attempts and the areas that require better security.

•An audit policy will also keep a record of activity that would allow activity to be tracked and provide evidence in the event of prosecution become necessary.

•Internal crackers can be a serious threat but there is a lot that can be done to combat them. But like all things in life there is no answer all solution that will prevent internal hacking 100%, but listed above are many ways in which we can reduce and mitigate the risk of internal crackers.

Access Control Lists (ACLs)

• Access Control List (ACL) are filters that enable you to control which routing updates or packets are permitted or denied in or out of a network. They are specifically used by network administrators to filter traffic and to provide extra security for their networks. This can be applied on routers (Cisco).

• ACLs provide a powerful way to control traffic into and out of your network; this control can be as simple as permitting or denying network hosts or addresses.  You can configure ACLs for all routed network protocols.

• The most important reason to configure ACLs is to provide security for your network. However, ACLs can also be configured to control network traffic based on the TCP port being used.

 How ACLs work• A router acts as a packet filter when it forwards or denies

packets according to filtering rules. As a Layer 3 device, a packet-filtering router uses rules to determine whether to permit or deny traffic based on source and destination IP addresses, source port and destination port, and the protocol of the packet. These rules are defined using access control lists or ACLs.

•  To simplify how ACL or a router uses packet filtering work, imagine  a guard stationed at a locked door. The guard's instruction is to allow only people whose names appear on a quest list to pass through the door. The guard is filtering people based on the condition of having their names on the authorized list.

When a packet arrives at the router, the router extracts certain information from the packet header and makes decisions according to the filter rules as to whether the packet can pass through or be dropped. Packet filtering process works at the Network layer of the Open Systems Interconnection (OSI) model, or the Internet layer of TCP/IP.

Why use ACLs

• Limits network traffic to increase network performance.

• ACLs provides traffic flow control by restricting the delivery of routing updates.

• It can be used as additional security.

• Controls which type of traffic are forwarded or blocked by the router.

• Ability to control which areas a client access.

Types of Access Control Lists

Standard access-list

• Standard access lists create filters based on source addresses and are used for server based filtering. Address based access lists distinguish routes on a network you want to control by using network address number (IP).

• Address-based access lists consist of a list of addresses or address ranges and a statement as to whether access to or from that address is permitted or denied.

Extended access lists

• Extended access lists create filters based on source addresses, destination addresses, protocol, port number and other features and are used for packet based filtering for packets that traverse the network.

Role-Based Access Control (RBAC) • RBAC appears to be a promising method for controlling

what information computer users can utilize, the programs that they can run, and the modifications that they can make. Only a few off-the-shelf systems that implement RBAC are commercially available; however, organizations may want to start investigating RBAC for future application in their multi-user systems.

• RBAC is appropriate for consideration in systems that process unclassified but sensitive information, as well as those that process classified information.

What is Role-Based Access Control?

• Access is the ability to do something with a computer resource (e.g., use, change, or view). Access control is the means by which the ability is explicitly enabled or restricted in some way (usually through physical and system-based controls).

• Computer- based access controls can prescribe not only who or what process may have access to a specific system resource, but also the type of access that is permitted. These controls may be implemented in the computer system or in external devices.

•With role-based access control, access decisions are based on the roles that individual users have as part of an organization. Users take on assigned roles (such as doctor, nurse, teller, manager).

•The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization.

•Access rights are grouped by role name, and the use of resources is restricted to individuals authorized to assume the associated role. For example, within a hospital system the role of doctor can include operations to perform diagnosis, prescribe medication, and order laboratory tests; and the role of researcher can be limited to gathering anonymous clinical information for studies.

•The use of roles to control access can be an effective means for developing and enforcing enterprise-specific security policies, and for streamlining the security management process.

Users and Roles • Under the RBAC framework, users are granted membership

into roles based on their competencies and responsibilities in the organization. The operations that a user is permitted to perform are based on the user's role. User membership into roles can be revoked easily and new memberships established as job assignments dictate.

• Role associations can be established when new operations are instituted, and old operations can be deleted as organizational functions change and evolve. This simplifies the administration and management of privileges; roles can be updated without updating the privileges for every user on an individual basis.

•When a user is associated with a role: the user can be given no more privilege than is necessary to perform the job. This concept of least privilege requires identifying the user's job functions, determining the minimum set of privileges required to perform that function, and restricting the user to a domain with those privileges and nothing more. In less precisely controlled systems, this is often difficult or costly to achieve.

•Someone assigned to a job category may be allowed more privileges than needed because is difficult to tailor access based on various attributes or constraints. Since many of the responsibilities overlap between job categories, maximum privilege for each job category could cause unlawful access.

Roles and Role Hierarchies • Under RBAC, roles can have overlapping responsibilities

and privileges; that is, users belonging to different roles may need to perform common operations. Some general operations may be performed by all employees. In this situation, it would be inefficient and administratively cumbersome to specify repeatedly these general operations for each role that gets created.

• Role hierarchies can be established to provide for the natural structure of an enterprise. A role hierarchy defines roles that have unique attributes and that may contain other roles; that is, one role may implicitly include the operations that are associated with another role.

•In the healthcare situation, a role Specialist could contain the roles of Doctor and Intern. This means that members of the role Specialist are implicitly associated with the operations associated with the roles Doctor and Intern without the administrator having to explicitly list the Doctor and Intern operations. Moreover, the roles Cardiologist and Rheumatologist could each contain the Specialist role.

Role hierarchies are a natural way of organizing roles to reflect authority, responsibility, and competency:

The role in which the user is gaining membership is not mutually exclusive with another role for which the user already possesses membership. These operations and roles can be subject to organizational policies or constraints.

When operations overlap, hierarchies of roles can be established. Instead of instituting costly auditing to monitor access, organizations can put constraints on access through RBAC.

For example, it may seem sufficient to allow physicians to have access to all patient data records if their access is monitored carefully. With RBAC, constraints can be placed on physician access so that only those records that are associated with a particular physician can be accessed.

Roles and Operations • Organizations can establish the rules for the association of operations

with roles. For example, a healthcare provider may decide that the role of clinician must be constrained to post only the results of certain tests but not to distribute them where routing and human errors could violate a patient's right to privacy. Operations can also be specified in a manner that can be used in the demonstration and enforcement of laws or regulations. For example, a pharmacist can be provided with operations to dispense, but not to prescribe, medication.

• An operation represents a unit of control that can be referenced by an individual role, subject to regulatory constraints within the RBAC framework. An operation can be used to capture complex security-relevant details or constraints that cannot be determined by a simple mode of access.

•For example, there are differences between the access needs of a teller and an accounting supervisor in a bank. An enterprise defines a teller role as being able to perform a savings deposit operation. This requires read and write access to specific fields within a savings file.

•An enterprise may also define an accounting supervisor role that is allowed to perform correction operations. These operations require read and write access to the same fields of a savings file as the teller. However, the accounting supervisor may not be allowed to initiate deposits or withdrawals but only perform corrections after the fact.

•Likewise, the teller is not allowed to perform any corrections once the transaction has been completed. The difference between these two roles is the operations that are executed by the different roles and the values that are written to the transaction log file.

•The RBAC framework provides administrators with the capability to regulate who can perform what actions, when, from where, in what order, and in some cases under what relational circumstances:

•Only those operations that need to be performed by members of a role are granted to the role. Granting of user membership to roles can be limited. Some roles can only be occupied by a certain number of employees at any given period of time.

•The role of manager, for example, can be granted to only one employee at a time. Although an employee other than the manager may act in that role, only one person may assume the responsibilities of a manager at any given time. A user can become a new member of a role as long as the number of members allowed for the role is not exceeded.

Advantages of RBAC• Properly-administered RBAC system enables users to carry out a

broad range of authorized operations, and provides great flexibility and breadth of application. System administrators can control access at a level of abstraction that is natural to the way that enterprises typically conduct business.

• This is achieved by statically and dynamically regulating users' actions through the establishment and definition of roles, role hierarchies, relationships, and constraints. Thus, once an RBAC framework is established for an organization, the principal administrative actions are the granting and revoking of users into and out of roles.

• This is in contrast to the more conventional and less intuitive process of attempting to administer lower-level access control mechanisms directly (e.g., access control lists [ACLs], capabilities, or type enforcement entities) on an object-by-object basis.

•Further, it is possible to associate the concept of an RBAC operation with the concept of "method" in Object Technology. This association leads to approaches where Object Technology can be used in applications and operating systems to implement an RBAC operation.

•For distributed systems, RBAC administrator responsibilities can be divided among central and local protection domains; that is, central protection policies can be defined at an enterprise level while leaving protection issues that are of local concern at the organizational unit level.

• For example, within a distributed healthcare system, operations that are associated with healthcare providers may be centrally specified and pertain to all hospitals and clinics, but the granting and revoking of memberships into specific roles may be specified by administrators at local sites.

Task Type: Individual Project   Deliverable Length: PowerPoint, 9–11 slides, including a title slide; Final key assignment document    Points Possible: 250   Due Date: 8/8/2011 11:59:59 PM  CT

Weekly tasks or assignments (Individual or Group Projects) will be due by Monday and late submissions will be assigned a late penalty in accordance with the late penalty policy found in the syllabus.

NOTE: All submission posting times are based on midnight Central Time.

Keeping data safe is not only a responsibility of the security administrator but also of every employee in a company. Many times, the employee is the first level of security and can thwart break-ins, spot security breaches, and protect data. However, many employees do not know how to protect data, what data needs protecting, or what to do if a breach is detected.

Please submit your assignment.

For this assignment, complete the following:

Develop a Security Awareness Training (SAT) presentation for company employees.Present at least 8 elements to help employees keep the company data safe and their computers running well.

Using your Week 4 DB Assignment, build a PowerPoint presentation following the summary.

Add 2 additional items to the presentation that are not included in your Week 4 DB assignment.

You can include, but are not limited to, understanding the importance of security, what data to protect, what to do if a breach is detected, how to protect the company data, or how computers get infected.

Your presentation should improve the employees' security awareness and practices.Include, as the second slide, an agenda that names each security tip.Be sure to use a design template to add a professional look and consistency to the presentation.

Add to the key assignment document an explanation of the 2 additional elements in your presentation. Explain the 3 topic points you provided for the 2 additional elements, describing why they are important.

The following is the instructions for the Phase 5 Individual Project. Basically this assignment will consist of designing a Security Awareness Training Program for employees.

It will be a PowerPoint presentation consisting of as many slides that you deem necessary. I have provided the necessary topics below that should be incorporated into the program. I believe that these areas would definitely reflect a security awareness training program for an organization. I have added some examples for each topic. You can use these as well and anymore that you would like to add.

Factors that go into a Security Awareness Training (SAT) program

•Employee Training (password creation and protection in regards to their computers, recognizing different types of security issues, knowing what to do in case of a security breach).•Understanding how Data gets corrupted (viruses, internal and external crackers, not keeping company information confidential, downloading non-company material).•How to Keep Data Safe (antivirus software, do not download suspicious looking emails, be aware of types of social engineering attacks).•Designing company Security Policies (data integrity, data availability, data confidentiality, authentication, best email practices).

•Implementing Security Policies (educating personnel, ensuring that current company security policies are available at all times to personnel by some form of media such as a company intranet or some type of internal network).•Disaster Recovery (Training personnel in what to do in case of a disaster happens in their workplace, evacuation steps in case disaster is catastrophic or if not the decisions as what part of the business should be saved first, such as customer databases or billing systems and which personnel is in charge of this)?

•HIPAA (Health Insurance Portability and Accountability Act Training if applicable).

•HIPAA was created by the federal government to protect patients’ private information. It is directly associated with healthcare professionals and staff who have access to patient information. This includes doctors, healthcare office workers, healthcare managers, and healthcare technicians. In order to obtain HIPAA certification, individuals are required to take a HIPAA compliance course. This course provides you an understanding of HIPAA implications on healthcare providers. 

Please be sure to use APA formatting. 

If you need help or have any questions, please email me,

Little Quiz

What is the name of the agency that the 10 knowledge domains are under?

International Information Systems Security Certifications Consortium (ISC2).

What is the name of the triangle that comprises different stages of data such as

Confidentiality, Integrity and Availability?

CIA

What a type of attack is specifically designed to bring a network down by flooding it with

useless traffic? Various versions of this attack are SYN and flood attacks.

Denial of Service attack (DoS)

What term describes a non-technical kind of intrusion that relies heavily on human

interaction and often involves tricking other people to break normal security procedures?

Social Engineering

What is the name of the scenario when an organization has a procedure in place in case something catastrophic happens to the organization?

Disaster Recovery Plan (DRP)

This term is when data is converted into a form, called a ciphertext, which cannot be easily understood by unauthorized people.

Encryption

Thank You

ReferencesCTU Course Materialshttp://waringgrills.com/weber-charcoal-grills/weber-one-touch-charcoal-grill-2675.php

http://www.kidskorner.net/coloring/alien.html

http://www.associatedcontent.com/article/1779042/network_security_internal_hackers_pg2.html?cat=15

http://www.orbit-computer-solutions.com/Access-Control-Lists-%28ACL%29.php

http://csrc.nist.gov/groups/SNS/rbac/documents/design_implementation/Intro_role_based_access.htm

http://www.asolutioninc.net/images/Fotolia_11880956_M.jpghttp://www.westwardpictures.com/wp-content/uploads/2011/01/disaster-

recovery1.jpghttp://blogs.technet.com/b/seanearp/archive/2007/08/01/layers-defense-in-depth-

part-1.aspxhttp://iaclub.ist.psu.edu/2010/tooltalk-social-engineering-toolkit/http://www.thoughtmechanics.com/email-encryption-does-your-company-need-it/