Which of the following is biggest factor that makes Computer Crimes possible?
Answer(s): B
The biggest factor that makes Computer Crimes possible is Victim Carelessness. Awareness and education can reduce the chance of someone becomming a victim.The types and frequency of Computer Crimes are increasing at a rapid rate. Computer Crime was once mainly the result of insiders or disgruntled employees. Now just about everybody has access to the internet, professional criminals are taking advantage of this.Specialized skills are no longer needed and a search on the internet can provide a fraudster with a plethora of tools that can be used to perpetuate fraud.All too often carelessness leads to someone being a victim. People often use simple passwords or write them down in plain sight where they can be found by fraudsters. People throwing away papers loaded with account numbers, social security numbers, or other types of non-public personal information. There are phishing e-mail attempts where the fraudster tries to redirect a potential victim to a bogus site that resembles a legitimate site in an attempt to get the users' login ID and password, or other credentials. There is also social engineering. Awareness and training can help reduce the chance of someone becoming a victim.The following answers are incorrect:The fraudster obtaining advanced training and special knowledge. Is incorrect because training and special knowledge is not required. There are many tools widely available to fraudsters.Collusion with others in information processing. Is incorrect because as more and more people use computers in their daily lives, it is no longer necessary to have someone on the inside be a party to fraud attempts.System design flaws. Is incorrect because while System design flaws are sometimes a factor in Computer Crimes more often then not it is victim carelessness that leads to Computer Crimes.
OIG CBK Legal, Regulations, Compliance and Investigations (pages 695 - 697)
Under United States law, an investigator's notebook may be used in court in which of the following scenarios?
Answer(s): C
An investigator's notebook cannot be used as evidence is court. It can only be used by the investigator to refresh his memory during a proceeding, but cannot be submitted as evidence in any form.The following answers are incorrect:When the investigator is unwilling to testify. Is incorrect because the notebook cannot be submitted as evidence in any form.When other forms of physical evidence are not available. Is incorrect because the notebook cannot be submitted as evidence in any form.If the defense has no objections. Is incorrect because the notebook cannot be submitted as evidence in any form.
In addition to the Legal Department, with what company function must the collection of physical evidence be coordinated if an employee is suspected?
Answer(s): A
If an employee is suspected of causing an incident, the human resources department may be involved--for example, in assisting with disciplinary proceedings.Legal Department. The legal experts should review incident response plans, policies, and procedures to ensure their compliance with law and Federal guidance, including the right to privacy. In addition, the guidance of the general counsel or legal department should be sought if there is reason to believe that an incident may have legal ramifications, including evidence collection, prosecution of a suspect, or a lawsuit, or if there may be a need for a memorandum of understanding (MOU) or other binding agreements involving liability limitations for information sharing.Public Affairs, Public Relations, and Media Relations. Depending on the nature and impact of an incident, a need may exist to inform the media and, by extension, the public.The Incident response team members could include:ManagementInformation SecurityLegal / Human ResourcesPublic RelationsCommunicationsPhysical SecurityNetwork SecurityNetwork and System AdministratorsNetwork and System Security AdministratorsInternal AuditEvents versus IncidentsAn event is any observable occurrence in a system or network. Events include a user connecting to a file share, a server receiving a request for a web page, a user sending email, and a firewall blocking a connection attempt. Adverse events are events with a negative consequence, such as system crashes, packet floods, unauthorized use of system privileges, unauthorized access to sensitive data, and execution of malware that destroys data. This guide addresses only adverse events that are computer security- related, not those caused by natural disasters, power failures, etc.A computer security incident is a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices.Examples of incidents are:An attacker commands a botnet to send high volumes of connection requests to a web server, causing it to crash.Users are tricked into opening a "quarterly report" sent via email that is actually malware; running the tool has infected their computers and established connections with an external host.An attacker obtains sensitive data and threatens that the details will be released publicly if the organization does not pay a designated sum of money.A user provides or exposes sensitive information to others through peer-to-peer file sharing services.The following answers are incorrect:Industrial Security. Is incorrect because it is not the best answer, the human resource department must be involved with the collection of physical evidence if an employee is suspected.public relations. Is incorrect because it is not the best answer. It would be an important element to minimize public image damage but not the best choice for this question.External Audit Group. Is incorrect because it is not the best answer, the human resource department must be involved with the collection of physical evidence if an employee is suspected.
NIST Special Publication 800-61
To be admissible in court, computer evidence must be which of the following?
Before any evidence can be admissible in court, the evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence. This holds true for computer evidence as well.While there are no absolute means to ensure that evidence will be allowed and helpful in a court of law, information security professionals should understand the basic rules of evidence. Evidence should be relevant, authentic, accurate, complete, and convincing. Evidence gathering should emphasize these criteria.As stated in CISSP for Dummies:Because computer-generated evidence can sometimes be easily manipulated, altered , or tampered with, and because it's not easily and commonly understood, this type of evidence is usually considered suspect in a court of law. In order to be admissible, evidence must beRelevant: It must tend to prove or disprove facts that are relevant and material to the case.Reliable: It must be reasonably proven that what is presented as evidence is what was originally collected and that the evidence itself is reliable. This is accomplished, in part, through proper evidence handling and the chain of custody. (We discuss this in the upcoming section "Chain of custody and the evidence life cycle.")Legally permissible: It must be obtained through legal means. Evidence that's not legally permissible may include evidence obtained through the following means:Illegal search and seizure: Law enforcement personnel must obtain a prior court order; however, non-law enforcement personnel, such as a supervisor or system administrator, may be able to conduct an authorized search under some circumstances.Illegal wiretaps or phone taps: Anyone conducting wiretaps or phone taps must obtain a prior court order.Entrapment or enticement: Entrapment encourages someone to commit a crime that the individual may have had no intention of committing. Conversely, enticement lures someone toward certain evidence (a honey pot, if you will) after that individual has already committed a crime. Enticement is not necessarily illegal but does raise certain ethical arguments and may not be admissible in court.Coercion: Coerced testimony or confessions are not legally permissible.Unauthorized or improper monitoring: Active monitoring must be properly authorized and conducted in a standard manner; users must be notified that they may be subject to monitoring.The following answers are incorrect:decrypted. Is incorrect because evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence.edited. Is incorrect because evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence. Edited evidence violates the rules of evidence.incriminating. Is incorrect because evidence has to be relevant, material to the issue, and it must be presented in compliance with the rules of evidence.
CISSP STudy Guide (Conrad, Misenar, Feldman) Elsevier. 2012. Page 423andMc Graw Hill, Shon Harris CISSP All In One (AIO), 6th Edition , Pages 1051-1056 andCISSP for Dummies , Peter Gregory
The typical computer fraudsters are usually persons with which of the following characteristics?
These people, as employees, are trusted to perform their duties honestly and not take advantage of the trust placed in them.The following answers are incorrect:They have had previous contact with law enforcement. Is incorrect because most often it is a person that holds a position of trust and this answer implies they have a criminal background. This type of individual is typically not in a position of trust within an organization.They conspire with others. Is incorrect because they typically work alone, often as a form of retribution over a percieved injustice done to them.They deviate from the accepted norms of society. Is incorrect because while the nature of fraudsters deviate from the norm, the fraudsters often hold a position of trust within the organization.
Post your Comments and Discuss ISC SSCP exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SSCP content, but please register or login to continue.