3. Concepts of Security

Question 1

What are the 4 security attacks?

Answer 1

1. Interruption - attack on availability.
2. Interception - attack on confidentiality
3. Modification - attack on integrity.
4. Fabrication - attack on authenticity.

Question 2

What are the threat consequences?

Answer 2

• Unauthorized disclosure of data.
• Deception
• Disruption
• Usurpation (misuse)

Question 3

What is a passive attack?

Answer 3

A passive attack is where the perpetrator only listens in to data / communications and does not interupt the normal flow of data / systems.

Question 4

What is an active attack?

Answer 4

An active attack is an attack where the malicious actor interrupts the normal flow of data / operation of a system.

Question 5

What are countermeasures?

Answer 5

Countermeasures are any means used to deal with security attacks. Countermeasures may result in new vulnerabilties and the main goal is to minimize risk given constraints.

Question 6

What is computer security?

Answer 6

Computer security is the protection afforded to an automated system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of computer systems.

Question 7

What is a security service?

Answer 7

A security service is a service to enhance the security of data processing systems and information transfers of an organization. They are intended to counter security attacks using one or more security mechanisms which often replicates functions normally associaiated with physical documents (such as signatures, dates, etc).

Question 8

What is the X.800 model?

Answer 8

• Authentication - assurance that communicating entity is the one claimed.
• Access control - prevention of the unauthorized use of a resource
• Data confidentiality - protection of data from unauthorized disclosure.
• Data Integrity - assurance that the data received is as sent by an authorized entity.
• Non-repudiation - protection against denial by one of the parties in a communication.
• Availability - resource accessible / usable.

Question 9

What methods of defence can be implemented?

Answer 9

• Encryption
• Software controls (access limitations in database etc.)
• Hardware controls (e.g. smartcard)
• Policies (e.g, password changes)
• Physical controls