ISDS 418 MIDTERM || with Complete Solution.
Computer Security correct answers The protection afforded to an automated information system
in order to attain the applicable objectives of preserving the integrity, availability, and
confidentiality of information system resources (includes hardware, software, firmware,
information/data, and telecommunications).
The CIA Triad correct answers three key objectives that are at the heart of computer security:
— Confidentiality
— Integrity
— Availability
The three concepts embody the fundamental security objectives for both data and for information
and computing services.
Confidentiality correct answers Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and proprietary information
Two Concepts of Confidentiality correct answers — Data Confidentiality : Assures that private
or confidential information is not made available or disclosed to unauthorized individuals.
— Privacy : Assures that individuals control or influence what information related to them may
be collected and stored and by whom and to whom that information may be disclosed.
Integrity correct answers Guarding against improper information modification or destruction,
including ensuring information nonrepudiation and authenticity
Two Concepts of Integrity correct answers - Data integrity : Assures that information and
programs are changed only in a specified and authorized manner.
- System integrity : Assures that a system performs its intended function in an unimpaired
manner, free from deliberate or inadvertent unauthorized manipulation of the system.
,Availability correct answers - Ensuring timely and reliable access to and use of information
- Assures that systems work promptly and service is not denied to authorized users.
Computer Security Challenges correct answers — computer security is not as simple as it might
first appear to the novice
— potential attacks on the security features must be considered
— procedures used to provide particular services are often counterintuitive
— physical and logical placement needs to be determined
— additional algorithms or protocols may be involved
— attackers only need to find a single weakness, the developer needs to find all weaknesses
— users and system managers tend to not see the benefits of security until a failure occurs
— security requires regular and constant monitoring
— is often an afterthought to be incorporated into a system after the design is complete
— thought of as an impediment to efficient and user-friendly operation
Adversary (threat agent) correct answers An entity that attacks, or is a threat to, a system.
, Attack correct answers An assault on system security that derives from an intelligent threat; that
is, an intelligent act that is a deliberate attempt (especially in the sense of a method or technique)
to evade security services and violate the security policy of a system.
Countermeasure correct answers An action, device, procedure, or technique that reduces a threat,
a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause,
or by discovering and reporting it so that corrective action can be taken
Risk correct answers An expectation of loss expressed as the probability that a particular threat
will exploit a particular vulnerability with a particular harmful result
Security Policy correct answers formal statement of rules and practices that specify or regulate
how a system or organization provides security services to protect sensitive and critical system
resources
- factors to consider:
> value of the assets being protected
> vulnerabilities of the system
> potential threats and the likelihood of attacks
- trade-offs to consider:
> ease of use versus security
> cost of security versus cost of failure and recovery
Security Implementation correct answers Involves four complementary courses of action:
- detection
> intrusion detection systems
Computer Security correct answers The protection afforded to an automated information system
in order to attain the applicable objectives of preserving the integrity, availability, and
confidentiality of information system resources (includes hardware, software, firmware,
information/data, and telecommunications).
The CIA Triad correct answers three key objectives that are at the heart of computer security:
— Confidentiality
— Integrity
— Availability
The three concepts embody the fundamental security objectives for both data and for information
and computing services.
Confidentiality correct answers Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and proprietary information
Two Concepts of Confidentiality correct answers — Data Confidentiality : Assures that private
or confidential information is not made available or disclosed to unauthorized individuals.
— Privacy : Assures that individuals control or influence what information related to them may
be collected and stored and by whom and to whom that information may be disclosed.
Integrity correct answers Guarding against improper information modification or destruction,
including ensuring information nonrepudiation and authenticity
Two Concepts of Integrity correct answers - Data integrity : Assures that information and
programs are changed only in a specified and authorized manner.
- System integrity : Assures that a system performs its intended function in an unimpaired
manner, free from deliberate or inadvertent unauthorized manipulation of the system.
,Availability correct answers - Ensuring timely and reliable access to and use of information
- Assures that systems work promptly and service is not denied to authorized users.
Computer Security Challenges correct answers — computer security is not as simple as it might
first appear to the novice
— potential attacks on the security features must be considered
— procedures used to provide particular services are often counterintuitive
— physical and logical placement needs to be determined
— additional algorithms or protocols may be involved
— attackers only need to find a single weakness, the developer needs to find all weaknesses
— users and system managers tend to not see the benefits of security until a failure occurs
— security requires regular and constant monitoring
— is often an afterthought to be incorporated into a system after the design is complete
— thought of as an impediment to efficient and user-friendly operation
Adversary (threat agent) correct answers An entity that attacks, or is a threat to, a system.
, Attack correct answers An assault on system security that derives from an intelligent threat; that
is, an intelligent act that is a deliberate attempt (especially in the sense of a method or technique)
to evade security services and violate the security policy of a system.
Countermeasure correct answers An action, device, procedure, or technique that reduces a threat,
a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause,
or by discovering and reporting it so that corrective action can be taken
Risk correct answers An expectation of loss expressed as the probability that a particular threat
will exploit a particular vulnerability with a particular harmful result
Security Policy correct answers formal statement of rules and practices that specify or regulate
how a system or organization provides security services to protect sensitive and critical system
resources
- factors to consider:
> value of the assets being protected
> vulnerabilities of the system
> potential threats and the likelihood of attacks
- trade-offs to consider:
> ease of use versus security
> cost of security versus cost of failure and recovery
Security Implementation correct answers Involves four complementary courses of action:
- detection
> intrusion detection systems
