Introduction

Question 1

Computer security in essence…

Answer 1

deals with computer-related assets that are subject to a variety of threats and for which various measures are taken to protect those assets.

Question 2

CIA triad + extra properties

Answer 2

• Confidentiality
• Integrity
• Availability
  +
• Authenticity
• Accountability

Question 3

Confidentiality

Answer 3

• Private information is not available/disclosed to unauthorized users
• Privacy: users control how information is used/shared with which 3rd parties

Loss:
Unauthorized disclosure of information

Question 4

Integrity

Answer 4

• Data: information and programs are changed only the expected way
• System: prevent unauthorized manipulation of the system
  +
  Ensures non-repudiation and authenticity

Loss:
Unauthorized modification or destruction of information

Question 5

Availability

Answer 5

• Service is not denied
• Timely and reliable access

Loss:
Disruption of access or use of information

Question 6

Authenticity

Answer 6

• User is who he says
• Inputs came from trusted sources
• Being genuine, verifiable and trustable

Loss:
Impersonation and modification of the system

Question 7

Accountability

Answer 7

• Inputs can be traced uniquely to that entity
• Supports non repudiation

Security breaches should be traced back to a responsible party.

Loss:
Impersonation and modification of the system

Question 8

Impacts CIA (FIPS) - Low

Answer 8

• Degradation in mission / the effectiveness of the company is greatly reduced
• damage
• financial loss
• harm to individuals

Low: minor
Moderate: Significant
High: major, to individuals loss of life or serious-life threatening

Question 9

Challenges of Security

Answer 9

• Requirements can be complex and unknown
• Security mechanisms might need users to be in possess and share secret information which complicates them
• Security becomes a fight between perpetrator and designer/admin, where perpetrator needs to find only one weakness and designer/admin needs to cover all weaknesses.
• It requires prior design and control, which only starts to be important after a security breach

Question 10

Difference between Data integrity and System Integrity

Answer 10

Data: information and programs are changed in the specified manner
System: system performs intended function free from unauthorized manipulation

Data focuses on information/programs content and System focuses in how it should work/function.