CYSE 101 Midterm with complete solution 2023

CYSE 101 Midterm with complete solution 2023CYSE is concerned with What are the cyber components of a system? What are the threats and vulnerabilities of that system (i.e., risk)? How do we reduce the risk by designing in security? What to answer for Case Studies What happened? (the facts) "Summary here" What vulnerabilities were exploited? Ex: Unencrypted data and code at rest, exposed electronics, exposed cryptographic keys By what/whom and how (threat)? Ex: Hackers for hire, Script kiddies, Hactivists, Terrorists What was loss/damage/cost? How could the event have been avoided? What are we trying to protect? Confidentiality, Integrity, and Availability of information, systems, resources Confidentiality Unauthorized users cannot access information Scenario: Hospital databases are protected Integrity Information is complete and uncorrupted Scenario: NextGen ATC Availability Definition: Authorized users can get to the information or resources Scenario: Power, water, ATC Vulnerability A flaw, weakness, or hole in a system or component Examples: Software (buffer overflow), System (weak/no passwords), Communications (lack of authentication/encryption) Threat Something (person, code, nature) that exploits a vulnerability to affect C, I, and/or A Examples: People (hackers, state actors, terrorists) Code (worm, virus, phish) Nature (flood, wind, solar storm) Risk? Vulnerability + Threat = Risk Likelihood that assets will be compromised Case Study example answers Case: Polycom HDX attack How exploited? - Crafted packets sent from attacker to target... • Impact? - Confidentiality, Availability, Integrity • Vulnerability? - Access control - Content checking - Software flaw • Threat? - Criminal Groups, Foreign Intelligence Services, Hackers, Terrorists • Controls? - FW: control access and check contents - Software: code review and testing Identification, Verification, Authentication Authorization 1. Who are you? 2. Confirming who you are 3. Proving who you are 4. What you can do Example: 1. I'm Andy 2. Here is my drivers license 3. Heres a barcode with my fingerprint or here is my password Types of Biometrics Physiological - Fingerprint, Voice, Iris How do we mitigate a risk? Controls and counter measures Internet of things? Connected digital devices, where each has: - digital processor - volatile memory (RAM) - persistent storage (ROM - flash) -communications (wired or wireless) Doesnt include workstations/servers, laptops, or smart phones Wireless connectivity strengths 1. NFC (1-2 inches) 2. Bluetooth (30-300 feet) 3. Wifi (150-300 feet) 4. Cell (miles)