10 Data Security - Defense

Question 1

What are the managements tasks for IT security?

1.
2.
3.
4.
5.

Answer 1

• risk analysis
• adoption of guidelines
• sensitisation of employees
• establishment of IT security management
• identification and implementation of operational measures

Question 2

What are typical operational measures for IT security?

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.

Answer 2

• access controls (for hardware software and rooms, e.g. by passwort ,ID card, key, …)
• restircted user rights (same as access controls but specifically for operating systems and user sofrtware)
• restrictive configuration (i.e. restrictive as in doubt, restrict rights
• keeping software up to date (hard to maintain up-to-dateness and security)
• deleting outdated software (risk assessment should be carried out as to whether investment should be made in new software - cf. WannaCry Virus)
• create backup cookies (regular checks; should be stored in a way that attack does not destroy; must not collide wirth data privacy)
• anti-virus software (data from external sources will be checked)
• additional: virus scan on computer
• run firewalls
• use sandboxes
• disable active content
• encrypt sensitive data (passwords, files, hard disks)

Question 3

Why is authentizitation with a password weak and what would be a higher security level?

1.
2.
3.
4.

Answer 3

• safety is only based on knowledge of a password (could be guessed or intercepted)
• higher security level: property or ohysical characteristic (USB key, EC-card / fingerprint, iris, voice)
• strong authentizitation is based on not only one but several measures
• e.g. two factor authentizitation is based on two measures (Smartcard as property and PIN as knowledge)

Question 4

Should servers store your passwort?

Answer 4

• ideally, the server should encrypt the password before storing it (with help of the Hash-algorithmns)

Question 5

What would be a safe password?

1.
2.
3.
4.

Answer 5

• consists of ~12 characters
• numbers, letters and special characters
• not party of any dictionary
• no reuse of password for different digital identities

Question 6

What is a systematic try-out when it comes to passwords?

Answer 6

• dictionary attack: at the beginning words from dictionaries are used
• brute force attack- first easy and short, then all combinations of characters are tried out