Question

1.Describe the difference between direct and indirect attacks.

2.Describe the balance between information security and access.

3.Explain the difference between a policy and a standard.

4.Go to http://www.NIST.govand find the Incident Response template. Fill in the information on the template.

Answer 1

1. Direct Attack: In this type of attack, the computer is object of an attack. Here, the attacker uses his computer to attack another computer.

Indirect Attack: In this type of attack, the computer is subject of an attack. Here, the system is compromised and used to attack another system by the attacker.

Therefore, a system can be both object of an attack  and subject of an attack. It can be the object of an attack first and then it can be compromised and used to attack another system. Thus it becomes subject of an attack.

3. Policies:

• These are high-level management instructions.
• It describes how an organization should run.
• Policies are generally driven by legal concerns.
• Policies are short and technical aspects are excluded from policies.

Standards:

• Standards are a low-level description.
• It concerns with how an organization will enforce the policies.
• It define the process to be used to support the policy.