M0084 – Sistem Informasi dalam Manajemen
True-False – Individual Assignment
Pertemuan – 23
Information Security
1. The term information security is used to describe the protection of both computer and
noncomputer equipment, facilities, data, and information from misuse by
unauthorized parties.
2. The information security objective of confidentiality is to make its data and
information available to those who are authorized to use it.
3. Benchmark compliance is a recommended level of security that in normal
circumstances should offer reasonable protection against unauthorized intrusion.
4. Information security threats can be internal as well as external, and they can be
accidental as well as intentional.
5. An information security risk is a potential undesirable outcome of a breach of
information security by an information security threat.
6. When the database and software library are made available to persons not entitled to
have access it is referred to as unauthorized use.
7. According to a survey by the Gartner Group, credit card fraud is 12 times more
prevalent for merchants who deal with their customers face- to- face than for ecommerce retailers.
8. User authorization makes use of access control files that specify the levels of access
available to each user.
9. Firewalls act as filters and barriers that restrict the flow of data to and from the firm
from the World Wide Web.
10. An application-level firewall is located between the router and the computer
performing the application.
11. Firms can carry physical controls to the limit by locating their computer centers in
remote areas far from cities and far from areas especially sensitive to such natural
disasters as earthquakes, floods, and hurricanes.
12. If formal controls are to be effective, then top management must participate actively
in their establishment and enforcement.
13. In the U.K. Anti-terrorism, Crime and Security Act of 2001, ISPs are exempted from
liability if they report suspicions to the government that an Internet crime might be
committed.
14. The activity aimed at continuing to operate after an information system disruption is
called disaster recovery.
15. A firm's vital records plan specifies how the vital records will be protected.