b)Phishing – setting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data. 

c)Pharming – redirects users to a bogus Web page, even when individual types correct Web page address into his or her browser.

d)Spoofing – misrepresenting oneself by using fake e-mail addresses or masquerading as someone else. It is redirecting Web link to address different from intended one, with site masquerading as intended destination.

QUESTION 2
a) Distinguish the TWO (2) methods for encrypting network traffic on the Web.

i)Secure Sockets Layer (SSL) and successor Transport Layer Security (TLS) enables client & server computers to manage encryption & decryption activities; so they communicate with each other during a secure web session. 

ii)Secure Hypertext Transfer Protocol (S-HTTP) is another protocol used for encrypting data flowing over the Internet, but it is limited to individual messages.

b) Briefly explain the following terms.
i)Cyber warfare - State-sponsored activity designed to cripple & defeat another state or nation by penetrating its computers or networks for the purposes of causing damage & disruption
ii) Computer Forensic - Scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law and it includes recovery of ambient and hidden data.

QUESTION 3
a)Briefly explain these THREE (3) tools.
i) Firewall- a combination of hardware and software that prevents unauthorized users from accessing private networks which technologies include Static packet filtering, stateful inspection, network adress translation (NAT)
ii)Intrusion detection system- to monitors hot spots on corporate networks to detect and deter intruders and examines events as they are happening to discover attacks in progress.
iii)Antivirus software- it checks computers for presence of malware and can often eliminate it as well. It requires continual updating.

b)Contrast between General Controls and Application Controls.
i)General Controls
These are policies and procedures that relate to many applications and support the effective functioning of application controls by helping to ensure the continues proper operation of information systems. It governs design, security and use of computer programs and security of data. It basically applies to all computerized applications. Example of the type are implementation controls and software controls.
ii)Application Controls
Application controls are the controls specific to a particular accounting application. It is a specific control unique to each computerized applications such as payroll or order processing. It includes automated and manual procedures and IPO controls. Example of the type are input and output controls.

QUESTION 4 
Malicious Software programs are referred to as Malware. Describe FOUR (4) types of malicious software.

i)SQL injection attacks- hackers submit data to web forms that exploit site's unprotected software and sends rogue SQL query to database.

ii)Virus is a rogue software  programs that attaches itself to other software programs or data files in order to be executed

iii)Worm is a independent programs that copy themselves from one computer to other computers over a network

iv)Trojan horses is a software that appears benign but does something other than expected. it is also a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the certain area on your hard disk.

QUESTION 5
a)Nowadays securing information systems has become an important issue in organization to protect itself against computer crime. Define computer crime and provide an appropriate example.
Computer crime means any violations of criminal law that involves knowledge of computer technology for their perpetration, investigation, or prosecution. Some examples are breaching confidentiality of protected computerized data and accessing a computer system without authority.

b) Briefly explain THREE (3) reasons why information systems are vulnerable to destruction, error and abuse?

i)internet vulnerabilities
it is because the network is open to anyone and the internet is designed to be an open system and make internal corporate systems more vulnerable to actions from outsiders.
ii)wireless security challenges
because many wifi networks can be easily penetrated easily by intruders using sniffer program to obtain an address to access the resources of a network without authorization.
ii)malware
it is represented in the form of a computer virus, a worm and Trojan Horse. Computer viruses and worms can spread rampantly from system to system, clogging computer memory or destroying programs and data

c) Discuss the THREE (3) most important tools and technology for safeguarding information resources
i)Firewall
it is combination of hardware and software that prevents unauthorized users from accessing private networks
ii)Intrusion detection systems
it monitors hot spots on corporate networks to detect and deter intruders. it also examines events as they are happening to discover attacks in progress
iii)antivirus and anti-spyware software
it checks  computers  for presence of malware and can often eliminate it as well ad it also require continual updating

QUESTION 6
a)Identity management software automates the process of keeping track of all information systems users and their system privileges, assigning each user a unique digital identity for accessing each system. Define authentication.

 

Authentication is the technique by which a system checks the identification of a end User who wants to access it. Since entrance or access control is normally based on the identification of the user who demands access to a resource. Authentication is essential to effective security.

b)Four types of authentication technologies are
i)Password Based Technologies which is the most common form of authentication. Password may be of any form (String of alphabets, numbers and special characters). This password is necessarily to be known by the entity or the thing or a person that is being authenticated.

ii)E-Token Based Technologies which is a small device that develop/generates a new odd/random value every time it is used. This random value becomes the basis for authentication (an alternative to a password). It can be implemented on a USB key fob or on a smart card. Data is protected on the device itself.
iii)Biometric Based Technologies which is an authentication mention to the realization/recognition/identification of humans by their personality/characteristics such as Face, fingerprint, human voice, Retina, Iris pattern of the eye, vein pattern etc. It's used in computer science as a form of realization/recognition and access control.
iv)Two Factor Authentication also known as multi-step verification, which adds another layer of security, supplementing the username and password model with a code that only a specific user has access to (typically sent to something they have immediately to hand). 

 Ransomware is proliferating on both desktop & mobile devices that try to extort money from users by taking control of their computers or displaying annoying pop-up messages such as CryptoLocker that encrypts an infected computer files, forcing users to pay hundreds of dollars to regain access.
b) State how do we prevent and protect our computer from ransomware.
i) Make sure one must installed up to date anti-malware or anti virus tool
ii) Scan attachments
iii) Ask before you open the email
c) Discuss the effects of computer crime to an organization.
i)  Reputational damage

Trust is an essential element of customer relationship. Computer crime can damage business' reputation and erode the trust that customers have for the organization. This could potentially lead to loss of customer, loss of sales and reduction in profits

Data protection and privacy laws require organizations to manage the security of all personal data they hold whether on the staff or their customers. If this data is accidentally or deliberately compromised, and they have failed to deploy appropriate security measures, they may face fines and regulatory sanctions.

IT Security should be seen as a task to minimize risk for an organization. This risk management is not just limited to the IT department or within the office because many people do work a little when we get home even if its just checking their emails. Employees use of unauthorized personal mobile devices can be a threat because it is an unknown object on the IT network. For example, if a user was to save business data onto an unauthorized device and then it was infected by malware, the data could end up in the wrong hands. However, it is not about the IT department forbidding personal devices. If devices are approved then it is safe to have on the network. It’s all about having policies in place and training employees on how to access business data securely.

2)Who poses the biggest security threat: insiders or outsiders?
Insiders poses the greatest security threat as they have access to sensitive information on a regular basis, and may know how that information is protected. If they want to steal it or leak it they can usually do so with far greater ease than outsiders. Furthermore, insiders may also accidentally leak data or otherwise put it at risk which is something that outsiders typically cannot do. Whether by attaching the wrong file to an email being sent, oversharing on social media, losing a laptop or USB drive, or through some other mistake, insiders can put an organization's data at risk with little effort. Policies and technology can help address this risk, but without it, problems are likely to occur

3)Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats

E-commerce involves transactions that take place over the Internet. Therefore, e-commerce utilizes internal networks that interface with the World Wide Web. The nature of this kind of business, introduces internal and external risks to both the website and the business systems to which it is connected to. An E-commerce website can be faced with security threats such as fraud incidents that include credit card fraud, which exposes the website to threat from clients and any other external sources and internal fraud. Such transactions can also be introduced into the system by hackers or Trojan Horses, which resemble the real customers’ transactions. To prevent fraud, Fraud scoring must be used. Other than that, alicious software and computer viruses are some of the biggest security threats to any E-commerce website. Viruses are normally from external sources and can corrupt files on website if introduced into the internal network. Viruses can completely destroy a computer system and disrupt the operations of the website. Trojan horse is malicious software that has the ability to capture the clients’ information, before any encryption software can take effect. They can also impersonate a customer and pass over bad and malicious codes into the server running the website. To avoid these viruses, users should exercise reasonable precautions in order to minimize the introduction and spread of computer viruses. Virus scanning software should be used to check any software downloaded from the Internet or obtained from any questionable sources.