Chp. 11 Chapter Questions

Question 1

What factors have brought increased emphasis on network security?

Answer 1

• Numerous legal actions involving officers and directors of organizations
• Pronouncements by government regulatory agencies requiring controls
• Losses associated with computer frauds are greater on a per incident basis than those not associated with computers
• Recent highly publicized cases of viruses and criminally instigated acts of penetration
• Data is a strategic asset
• The rise of the Internet with opportunities to connect computers anywhere in the world (increased potential vulnerability of the organization’s assets)
• Highly publicized denial-of-service incidents

Question 2

Briefly outline the steps required to complete a risk assessment.

Answer 2

1. Develop risk measurement criteria
2. Inventory IT assets
3. Identify threats
4. Document existing controls
5. Identify improvements

Question 3

Name and describe the main impact areas. Who should be responsible for assessing what is meant by low/medium/high impact for each of the impact areas? Explain your answer.

Answer 3

1. impact areas

• Financial – revenue and expenses
• Productivity – business operations
• Reputation – customer perceptions
• Safety – health of customers and employees
• Legal – potential for fines and litigation

2. Business leaders should make the decisions on the impact of each impact area because these are business decisions.

Question 4

What are some of the criteria that can be used to rank security risks?

Answer 4

• Most damaging, most dangerous, most risky.
• Most sensitive, most critical to organization, most likely to cause political problems
• Most costly to recover, most difficult to recover, most time consuming to recover
• Greatest delay, most likely to occur

Question 5

What are the most common security threats? What are the most critical? Why?

Answer 5

• Some of the more common security threats:
  
  • viruses,
  • theft of equipment,
  • theft of information,
  • device failure,
  • natural disaster,
  • sabotage,
  • denial of services.

Question 6

Explain the purpose of threat scenarios. What are the steps in preparing threat scenarios?

Answer 6

1. Threat scenarios describe how an asset can be compromised by one specific threat. An asset can be compromised by more than one threat, so it is common to have more than one threat scenario for each asset.
2. steps:
   
   • name the asset
   • describe the threat
   • explain the consequence (violation of confidentiality, integrity or availability)
   • estimate the likelihood of this threat happening (high, medium, low)

Question 7

What is the purpose of the risk score and how is it calculated?

Answer 7

1. Risk scores are used to compare the risk scores among all the different threat scenarios to help us identify the most important risks we face.
2. It is calculated by multiplying the impact score by the likelihood (using 1 for low likelihood, 2 for medium likelihood, and 3 for high likelihood).

Question 8

In which step of the risk assessment should existing controls be documented?

Answer 8

Documenting existing controls is the fourth step in the process, between identifying threats and identifying improvements.

Question 9

What are the four possible risk control strategies? How do we pick which one to use?

Answer 9

1. The risk control strategies are to:
   * accept the risk, mitigate it, share it, or defer it.
2. Selection of a strategy depends on things such as the impact (positive or negative) of the risk, the likelihood of the event occurring, and the cost.

Question 10

Why is it important to identify improvements that are needed to mitigate risks?

Answer 10

risks are always changing and responses (including technologies) are changing as well.

Question 11

What is the purpose of a disaster recovery plan? What are the major elements of a typical disaster recovery plan?

Answer 11

1. A disaster recovery plan should address various levels of response to a number of possible disasters and should provide for partial or complete recovery of all data, application software, network components, and physical facilities.
2. backup and recovery controls that enable the organization to recover its data and restart its application software should some portion of the network fail.

Question 12

What is a computer virus? What is a worm?

Answer 12

1. A computer virus is an executable computer program that propagates itself (multiplies), uses a carrier (another computer program), may modify itself during replication, is intended to create some unwanted event.
2. A worm is a special type of virus that spreads itself without human intervention. Worms spread when they install themselves on a computer and then send copies of themselves to other computers, sometimes by e-mail, sometimes via security holes in software.

Question 13

Explain how a denial-of-service attack works.

Answer 13

• A DOS attacks works by an attacker attempting to disrupt the network by flooding it with messages so that the network cannot process messages from normal users.
• The simplest approach is to flood a Web server, mail server, and so on, with incoming messages. The server attempts to respond to these, but there are so many messages that it cannot.

Question 14

How does a denial-of-service attack differ from a distributed denial-of-service attack?

Answer 14

• While the source of a denial-of-service (DoS) attack could be a single computer, a distributed denial-of-service (DDoS) attack could involve hundreds of computers on the Internet simultaneously sending messages to a target site.

Question 15

Online backup allows you to back up data to a server across the Internet.

What is a disaster recovery firm? When and why would you establish a contract with them?

Answer 15

1. Disaster recovery firms provide second level support for major disasters.
2. Building a network that has sufficient capacity to quickly recover from a major disaster such as the loss of an entire data center is beyond the resources of most firms.

Question 16

What is online backup?

Answer 16

• Online backup allows you to back up data to a server across the Internet.

Question 17

People who attempt intrusion can be classified into four different categories. Describe them.

Answer 17

• four types:

1. are casual computer users
2. experts in security
3. professional hackers who break into corporate or government computer for specific purposes
4. organization employees who have legitimate access to the network, but who gain access to information they are not authorized to use.

Question 18

There are many components in a typical security policy. Describe three important components.

Answer 18

• The name of the decision-making manager who is in charge of security.
• An incident reporting system and a rapid response team that to respond to security breaches in progress.
• A plan to routinely test and update all security controls that includes monitoring of popular press and vendor reports of security holes

Question 19

What are the three major aspects of intrusion prevention (not counting the security policy)?

Answer 19

1. securing the network perimeter,
2. securing the interior of the network,
3. authenticating users.

Question 20

How do you secure the network perimeter?

Answer 20

• There are three basic access points into most organizational networks: from LANs, the Internet, and WLANs.
• One important element of preventing unauthorized users from accessing an internal LAN is through physical security.
  
  • A firewall is commonly used to secure an organization’s Internet connection.
  • NAT is a common security measure that can be used as well.

Question 21

What is physical security and why is it important?

Answer 21

1. Physical security refers to policies and procedures that are designed to prevent outsiders from gaining access to the organization’s offices, server room, or network equipment facilities.
2. only authorized personnel can enter closed areas where servers and network equipment are located or access the network.

Question 22

What is eavesdropping in a computer security sense?

Answer 22

• Eavesdropping refers to the process of unauthorized tapping into a computer network through local cables that are not secured behind walls or in some other manner.

Question 23

What is a sniffer?

Answer 23

• A sniffer program records all messages received for later (unauthorized) analysis.

Question 24

A firewall is a router, gateway, or special purpose computer that examines packets flowing into and out of a network and restricts access to the organization’s network

How do you secure dial-in access?

Answer 24

• strategies:
  
  • changing the modem telephone numbers periodically,
  • keeping the telephone numbers confidential,
  • requiring the use of computers that have an electronic identification chip for all dial-up ports.
  • use a call-back modem

Question 25

What is a firewall?

Answer 25

• A firewall is a router, gateway, or special purpose computer that examines packets flowing into and out of a network and restricts access to the organization’s network

Question 26

How do the different types of firewalls work?

Answer 26

• A packet-level firewall examines the source and destination address of every network packet that passes through it.
• An application level firewall acts as an intermediate host computer between the Internet and the rest of the organization’s networks.
• The NAT firewall uses an address table to translate the private IP addresses used inside the organization into proxy IP addresses used on the Internet

Question 27

What is IP spoofing?

Answer 27

• IP spoofing means to fool the target computer (and any intervening firewall) into believing that messages from the intruder’s computer are actually coming from an authorized user inside the organization’s network
• The goal of an intruder using IP spoofing is to send packets to a target computer requesting certain privileges be granted to some user (e.g., setting up a new account for the intruder or changing access permission or password for an existing account).

Question 28

What is a NAT firewall and how does it work?

Answer 28

1. The NAT firewall (sometimes referred to as a proxy server) uses an address table to translate the private IP addresses used inside the organization into proxy IP addresses used on the Internet.
2. The NAT firewall receives the incoming message, and after ensuring the packet should be permitted inside, changes the destination IP address to the private IP address of the internal computer and changes the TCP port id to the correct port id before transmitting it on the internal network.

Question 29

What is a security hole and how do you fix it?

Answer 29

1. Many commonly used operating system have major security problems (called security holes) well known to potential intruders; UNIX systems are among the worst
2. patches

Question 30

Explain how a Trojan horse works.

Answer 30

• Trojans are remote access management consoles that enable users to access a computer and manage it from afar.
• Trojans are often concealed in other software that unsuspecting users download over the Internet.

Question 31

Compare and contrast symmetric and asymmetric encryption.

Answer 31

1. A symmetric (or single key) encryption algorithm is one in which the key used to encrypt a message is the same as the one used to decrypt it. The key must be kept secret, leading to a need for key management.
2. An asymmetric algorithm is one in which the key used to decrypt a message is different from the one used to encrypt it. Public key encryption is the most common for asymmetric encryption. , there are two keys.

Question 32

Describe how symmetric encryption and decryption works.

Answer 32

• Encryption is the process of disguising information into ciphertext, whereas decryption is the process of restoring it to readable form (plaintext).
• An encryption system has two parts: the algorithm itself and the key, which personalizes the algorithm by making the transformation of data unique.

Question 33

What is key management?

Answer 33

• Key management is concerned with dispersing and storing keys carefully.
• Managing this system of keys can be challenging, especially with symmetric algorithms.

Question 34

How does DES differ from 3DES? From RC4? From AES?

Answer 34

DES uses a 56-bit key while 3DES uses a 168-bit key (3 x 56).

RC4 uses keys from 40 to 256 bits in length.

AES uses the Rijndael algorithm and has key sizes of 128, 192, and 256 bits.

Question 35

Compare and contrast DES and public key encryption.

Answer 35

• DES is a symmetric algorithm, which means that the key used to decrypt a particular bit stream is the same as the one used to encrypt it.
• Public key encryption is inherently different from secret key systems like DES. because it is asymmetric; there are two keys. One key (called the public key) is used to encrypt the message and a second, very different private key is used to decrypt the message.

Question 36

What is key escrow?

Answer 36

• With key escrow, any organization using encryption must register its keys with the government.
• This enables the government, after receiving a legally authorized search warrant, to decrypt and read any messages sent by that organization

Question 37

Explain how authentication works.

Answer 37

• Public key encryption permits authentication (or digital signatures).
• When one user sends a message to another, it is difficult to legally prove who actually sent the message.
• Thus a digital signature or authentication sequence is used as a legal signature on many financial transactions.

Question 38

What is PKI and why is it important?

Answer 38

1. PKI stands for Public Key Infrastructure.
2. PKI refers to the encryption infrastructure that has developed around the most popular form of asymmetric encryption (also called public key encryption) called RSA.

Question 39

What is a certificate authority?

Answer 39

• A certificate authority (CA) is a trusted organization that can vouch for the authenticity of the person or organization using authentication (e.g., VeriSign)

Question 40

How does PGP differ from SSL?

Answer 40

• Pretty Good Privacy (PGP) is freeware public key encryption package developed by Philip Zimmermann that is often used to encrypt e-mail
• Secure Sockets Layer (SSL) operates between the application layer software and the transport layer. SSL encrypts outbound packets coming out of the application layer before they reach the transport layer and decrypts inbound packets coming out of the transport layer before they reach the application layer.

Question 41

How does SSL differ from IPSec?

Answer 41

• SSL differs from IPSec in that SSL is focused on Web applications,
• IPSec can be used with a much wider variety of application layer protocols.

Question 42

Compare and contrast IPSec tunnel mode and IPSec transfer mode.

Answer 42

• IPSec transport mode provides only encryption of the message payload, while tunnel mode additionally encrypts the final destination by encrypting the entire IP packet.

Question 43

What are the three major ways of authenticating users?

Answer 43

• The three major ways to authenticate users:
  
  • is to base account access on something you know (ex: passwords),
  • something you have (smart card),
  • something you are (eyeball, finger print)

Question 44

What are the different types of one-time passwords and how do they work?

Answer 44

• one-time password users
• token system (device is used)
• time based tokens (device with time limit)

Question 45

Explain how a biometric system can improve security.

Answer 45

1. scan the user to ensure that user is the sole individual authorized to access the network account.

Question 46

Why is the management of user profiles an important aspect of a security policy?

Answer 46

• Each user’s profile specifies what data and network resources he or she can access, and the type of access allowed (read only, write, create, delete).

Question 47

How does network authentication work and why is it useful?

Answer 47

• Instead of logging into a file server or application server, network authentication requires that users login to an authentication server. This server checks the user id and password against its database and if the user is an authorized user, issues a certificate.
• the user no longer needs to enter his or her password for each new service or resource he or she uses.
• This also ensures that the user does not accidentally give out his or her password to an unauthorized service

Question 48

What is social engineering? Why does it work so well?

Answer 48

1. Social engineering refers to breaking security simply by asking
2. A skilled social engineer is like a good con artist, he can manipulate people.

Question 49

What techniques can be used to reduce the chance that social engineering will be successful?

Answer 49

• Acting out social engineering skits in front of users often works very well; when a group of employees sees how they can be manipulated into giving out private information

Question 50

What is an intrusion prevention system?

Answer 50

• intrusion prevention systems (IPSs) can be used to monitor networks, circuits, and particular applications and report detected intrusions.

Question 51

Compare and contrast a network-based IPS, a host-based IPS, and an application-based IPS.

Answer 51

• The network-based IPS monitors key network circuits through IPS sensors that are placed on the key circuits to monitors all network packets on that circuit.
• The host-based IPS monitors a server and incoming circuits. It is installed on the server that it is monitoring.
• An application-based IPS is a specialized host-based IPS that monitors one application on its server such as a Web server.

Question 52

How does IPS anomaly detection differ from misuse detection?

Answer 52

• Anomaly detection looks for extreme changes in certain kinds of behavior while misuse detection guards against a repeat of prior intrusions.

Question 53

What is computer forensics?

Answer 53

• Computer forensics is the use of computer analysis techniques to gather evidence for criminal and/or civil

Question 54

What is a honey pot?

Answer 54

• A honey pot is a server that contains highly interesting fake information available only through illegal intrusion to “bait” or “entrap” hacker

Question 55

What is desktop management?

Answer 55

• Desktop management refers to security measures at the individual client level.
• may include:
  
  • think clients (no hard drives)
  • centralized desktop management where users cant access certain settings on computers

Question 56

A few security consultants have said that broadband and wireless technologies are their best friends. Explain.

Answer 56

• Anyone with physical access to the circuit can monitor the composite signal and, as in the case of wireless transmission, eavesdrop.

Question 57

Most hackers start their careers breaking into computer systems as teenagers. What can we as a community of computer professionals do to reduce the temptation to become a hacker?

Answer 57

• Computer professionals can reduce the temptation to become a hacker by increasing the costs involved in the activity.

Question 58

Some experts argue that CERT’s posting of security holes on its Web site causes more security break-ins than it prevents and should be stopped. What are the pros and cons on both sides of this argument? Do you think CERT should continue to post security holes?

Answer 58

1. it is necessary to help conscientious security operations reduce ris
2. The CERT postings reduce the time it takes for potential victims to identify new security hole threats and respond to them, t

Question 59

What is one of the major risks of downloading unauthorized copies of music files from the Internet (aside from the risk of jail, fines, and lawsuits)?

Answer 59

• One of the major risks of downloading files of this nature is the potential to introduce a Trojan Horse into the network.

Question 60

Although it is important to protect all servers, some servers are more important than others. What server(s) are the most important to protect and why?

Answer 60

• To answer this question, return to the risk assessment process and ask which server loss will cause the greatest damage to the organization