Core Computing Flashcards
1
Q
What does HTML stand for?
A
HyperText Markup Language
2
Q
What does CSS stand for ?
A
Cascading Style Sheets
3
Q
What does svg stand for?
A
Scalable Vector Graphics
4
Q
What does URL stand for?
A
Uniform resource locator
5
Q
What is a selector?
A
This is used to refer to an element that you will modify in your CSS.
6
Q
What format do we use when selecting an id in CSS ?
A
idname{
css goes here
}
7
Q
What format do we use when selecting class in CSS?
A
if its just a class then .classname{css}
if its a element with a class e.g. <p class = lol> then
p.lol {css}
8
Q
Can we style in html?
A
Yes
9
Q
How do we style in HTML?
A
We use style element. Then you type the CSS inside of it.
10
Q
Why do we use CSS instead of just styling in HTML?
A
CSS provides better efficiency and saves memory.
11
Q
What parts must a url always have?
A
. scheme/protocol
. host/domain name
. path (the /// part)
12
Q
What does the port look like in the URL?
A
:123
13
Q
How do we create hyperlinks in HTML?
A
we use the a element and its attribute href.
E.g.
<a>An Example Website</a>
14
Q
How do we link CSS file or JavaScript file to html?
A
We make use of the script tag and the src attribute.
E.g.
<script> </script>
15
Q
How do we use images in HTML ?
A
We use the img element and its attributes src for the name of the image file.
We must also include the alt attribute
E.g.
<img></img>
16
Q
Why do we need the alt attribute when using the img element ?
A
Its a standard and the alt attribute helps people with screen reader know what the image is
17
Q
Why is better to download the image?
A
It prevents hotlinking. This is when instead of putting a file in src you put a link to an image. This is bad because if the image from the link is changed or deleted so will yours
18
Q
Why is svg good for images?
A
It offers higher resolution images
19
Q
Name some markup languages ?
A
xml,html,svg
20
Q
What is svg?
A
It is a mark up language for images
21
Q
What do you need at the start of every html doc ?
A
<!DOCTYPE html>
22
Q
Who created HTML ?
A
Tim Berners-Lee
23
Q
What kinda markup do we prefer in HTML?
A
Descriptive not procedural
24
Q
What is the difference between client and server?
A
Server operations are remote, whereas client operations are performed locally by a web browser.
25
What is information security ?
Information security is the preservation of confidentiality, integrity and availability of information
26
Define confidentiality.
preventing the disclosure of information to anyone or anything that is not authorised to view or otherwise access that information
27
Define integrity
Preserving the integrity of information is the safeguarding of its accuracy and completeness
28
Define availability ?
if the information can be accessed by authorised entities on demand whenever they need it for legitimate purpose
29
Explain the trade that happens when trying to improve information security
* Often in an attempt to improve confidentiality a trade-off is made in which integrity or availability is decreased/threatened and the same goes for the other 2
* An example of this may be repeating credit card details during a phone purchase repeating the details in short integrity by authorised individuals may over here this information which threatens confidentiality
30
Define an asset
An asset is anything of value to an organisation
31
Define a threat
A threat is a potential cause of an incident that may result in harm to system organisation
32
Define vulnerability
vulnerabilities are weaknesses In an information asset or information system itself that can be exploited
33
Define impact
The result of an information security incident caused by threats which affects the assets
34
Define risk
The potential that a given threat will exploit vulnerabilities of an asset or group of assets and thereby cause harm to the organisation
35
Must all information be protected ?
Yes
36
Define business critical information
Info about the business without this information the business will not be able to function
37
Define personal information
Info on employees and customers by law this needs to be protected
38
Define strategic information
Info that provides organisations with a competitive advantage and directs their activities
39
Define high cost information
info whose gathering storage processing and transmission require a long time and involve a high cost
40
Define business processes.
* Business processes are the steps taken to Accomplish certain task that really should be considered In their own right
* These can be processes protected as trade secrets or processes That ensure effective delivery Of business goals as well as the mission Of the organisation
* Or they can be processes that ensure legal requirements
41
What is network security?
Network security is the steps to both manage the network perimeter and protect the internal network
42
How do we protect the network perimeter?
by filtering and inspecting all traffic to the network perimeter. This can be done by :
Firewall - monitors and controls incoming and outgoing network traffic based on predetermined security rules
. Malware - prevents malicious content
43
How do we protect internal network ?
○ Segregate networks - This is done by identifying grouping and fascinating critical business systems and appropriate networks
. Secure WAPs
○ Enable secure administration
○ Configure the exception handling process
○ Monitor network
Assurance processes
44
What should an organisation do to prevent its personnel from falling victim to social engineering?
. Security policy
. Induction process
. Make personnel aware of risks
. Have security training and see if it works
. promote incident reporting e.g. tfl see it say it sort it
45
What must security policies have to remain viable?
○ Individual responsible for the policy
○ A schedule reviews
○ Method for making recommendation for reviews
Specific policy insurance and revision date
46
Define policy
A principle or rule to guide decisions and achieve rational outcomes
47
Define standards
A standard is a agreed way of doing something to a specific or measurable level of quality. It is an created by a recognised body and it is officially documented .
48
Define a guideline
A set of recommended actions to assist in complying with the policy
49
Define procedure
A list of steps/instructions for performing some action or accomplishing the task
50
What is authentication ?
Checking that only authorised individuals can view or modify protected information assets
51
What are the 3 authentication mechanisms and give examples?
○ Something a supplicant knows e.g. password, pin or security questions
○ Something a supplicant has e.g. smart cards, bank card
. Something a supplicant is e.g. fingerprint, eye scan, voice, palmprint,boimetric
52
Give some pros and cons on passwords?
Pro -They are simple for designers and users and can provide good protection if used correctly
Cons - Protection is often compromised by the user This is because users make them too short or personal so they're easy to remember or They are also never changed and the same password is used for multiple systems making passwords weaker.
. People also forget passwords
53
What is a way to protect passwords
. dont give them out
. To protect against password guessing we can lock people after three failed attempts
. However this enables a form of denial of service because attackers deliberately locked try lock out users which has an affect on availability
54
What is the acronym for the requirements for biometrics and define the words for each acroynm?
CAPCUPD
Collectability - It should be easy and harmless to collect
Acceptability - The trait should be accepted by the public
Performance - It should be fast and accurate regardless of the resources or environment
Circumvention - Using fraudulent methods should be difficult
Universality - Everyone should have this trait
Persistence - The trait shouldn't change too much over time
Distinctiveness - The ability of the trait to change between 2 people
55
How is the effectiveness of biometrics evaluated ?
False reject rate (FRR) -the percentage of how many users that should have access are denied
False acceptance rate(FAR) - the percentage of how many users that shouldnt have access are accepted
Crossover error rate (CER) - Level at which the number of false rejections equals to false acceptances
56
Define identity?
The properties of an individual resource that can be used to identify uniquely one individual or resource
57
What is accounting ?
Ensures that user activities can be tracked back to them
58
Define audit ?
Formal or informal review of actions processes, policies and procedures
59
What are the 4 access control policies ?
DAC) Discretionary Access Control - Controls access based upon identity. Straight forward to implement and flexible
MAC) Mandatory Access Control - controls access based upon security labels
Used when stronger security guarantees that is required, Centralised control of information
(RBAC) Role Based Access Control - controls access based upon roles
(ABAC) Attribute Based Access Control - controls access based upon attributes
60
What is strong authentication?
The use of two or more authentication mechanisms from at least two different authentication factors. Sometimes called MFA or 2FA
61
What is the difference between factor and mechanisms ?
factors are what we know,posses or is whereas the mechanisms are pins and etc
62
What are the 3 file permissions
read write execute
62
What are the 3 file permissions
Read,Write,Execute
63
What kind of user will have greater access?
admins as they are responsible for removing users from groups or modifying the whole groups access rights
64
What is cryptography ?
Cryptography is a way of turning plaintext (our secret message) into ciphertext (an unreadable version that can later be turned back into the plaintext
65
What are the 4 principles of modern cryptography?
1. Large enough key space to resist exhaustive search
2. Resistant to frequency analysis
3. Small change in plaintext results in large change in ciphertext
4. Security depends only on secrecy of key, and not on secrecy of algorithm
66
Give some info on symmetric encryption?
. Sometimes called private key encryption
. uses the same “secret key” to encipher and decipher message
* Both sender and receiver must possess encryption key
If either copy of the key is compromised, a hacker can decrypt and read messages
67
Give some info on asymmetric encryption?
. Sometimes called public key encryption
. uses two different but related keys to encrypt/decrypt messages
. Typically used to encrypt a symmetric session key rather than the plaintext message
68
Name some encryption codes?
* Caeser cipher
* Exhaustive Search
. Substitution and Transposition
69
Name some example symmetric cryptosystems
Data Encryption Standard (DES)
Advanced Encryption Standard (AES)
70
Name some example asymmetric cryptosystems
RSA(Have a look at how it works)
Elliptic curves
71
What is the formula for risk?
Risk = likelihood x impact
72
What elements of risk must be analysed when using component driven approaches?
threat,vulnerability and impact
73
Define threat
the individual, group or circumstance which causes a given impact to occur, e.g., lone hacker and etc
74
Name 2 Risk assessment methods/frameworks
Octave Allegro
NIST 800-30
75
Name 2 information security assessment methods/frameworks
NIST CSF
ISO/IEC 270000 series
76
What are the 4 control strategies for risk assessment?
- Avoid
- Accept
- Reduce
- Transfer
77
What are the risk assessment steps
1.) Identify risk
2.) Analyse risk
3.) Treat Risk
4.) Monitor and review
78
What is Qualitative risk analysis ?
Uses scale of qualifying attributes to describe magnitude of consequences/likelihood (VL,L,M,H,VH)
79
Give some advantages and disadvantages of qualitative risk analysis ?
Advantage - ease of understanding by all relevant personnel
Disadvantage - Dependecnce on subjective choice of the scale
80
What is quantitative risk analysis?
Uses scale of objective numerical values for consequences/likelihood
81
Give some advantages and disadvantages of quantitative risk analysis
Advantage - related directly to info security objectives/concerns of organization
Disadvantage - Lack of data on new risks
. Accurate/missing data in general could create illusion of worth/accuracy of risk assessment
82
What does CBA stand for
Cost Benefit Analysis
83
What does ACS stand for
Annualized cost of safeguard
84
What does ALE stand for
Annualized Loss Expectancy
85
What does ARO stand for
Annualized Rate of Occurence
86
What does SLE stand for?
Single Loss Expectancy
87
What is the formula for ALE
ALE = SLE × ARO
88
What is th formula for CBA
CBA = ALE(prior) - (ALE(post) + ACS)
89
Name and explain the 4 risk treatment options?
Retain/Accept risk retention - organisation may tolerate (but not ignore) risk
* Avoid/Terminate risk avoidance - organisation may decide not to do the thing that incurs risk
* Share/Transfer risk sharing - transfer risk via an insurance policy or a third party
* Modify/Reduce risk modification - adopt controls to lower the current level of risk by reducing likelihood and impact
90
When developing software what security should you also include?
. Defensive coding
. Testing
. Back ups
. Assurance of availability
. Compliance with legal requirements
. security of communication
. auditing
91
What is cross site scripting (XSS)?
occurs when an attacker injects malicious code into a trusted website, which is then unknowingly executed by a user's web browser.
92
How do you prevent XSS?
Implement escapes in all your code
93
What is sql injection ?
occurs when an attacker manipulates input fields on a website to execute unauthorized SQL commands on the website's database
94
What are some ways to secure the development environment?
* Separate business and development functions
* Consider your development environment compromised
* Trust your developers, verify their actions
95
Why is formal change control and 2 person control important ?
In formal change the Separation of duties ensures the person responsible for testing the code isn’t also responsible for its implementation
Two person control requires that an additional person signs off on the code changes, to reduce accidental or malicious flaws
96
Give some info on patches
. Patches are updates that address security vulnerabilities within a program or product.
Patches should be rolled out at the earliest opportunity because attackers may already know vunerable spots or try to reverse engineer
. Patches should be tested
97
Define certification
a certificate that the product, service or system in question meets specific requirements
98
Define accreditation
A formal recognition by an independent body that a certification body operates according to international standards
99
What does HCI stand for?
Human Computer Interaction
100
What is HCI ?
HCI is the study of interaction between people and computers?
101
What are the 2 major goals of HCI?
- To improve the interactions between people and computers (machines?)
- Making computers more usable and receptive to the user's needs
102
What are the 3 sub domains of HCI
Usability, User Experience(UX) and User centred design
103
Describe Usability
Usability is making systems easy to learn, easy to use, limiting errors and the severity of errors.
104
What vocab comes under usability?
. error rates
. time to complete tasks, task failures
. number of lookups made
105
Define user experience
User experience is the user’s entire experience with a interface — not just how well the interface worked, but how they expected it to work, how they feel about using it, and how they feel about the system overall.
106
What vocab comes under user experience?
satisfaction, intuitive, frustration, good experience, difficult, confusing.
107
Describe user centered design
an iterative design process in which designers focus on the users and their needs in each phase of the design process. They do this via a variety of research and design techniques, to create highly usable and accessible products for them
108
Why is HCI important?
. Bad interfaces can waste users time and cause fustration and errors
. Users often leave website or apps with bad interfaces in frustration
109
Name the paradigms in HCI along with some examples
Command Line Interface(CLI) - Users control the computer by typing in commands.
Examples - command prompt app in Windows, and Terminal in macOS
Graphical User Interface (GUI) - Users directly manipulates graphical representations on a computer screen with a pointing device
Example - Apple 2
Natural user interface (NUI) - a system for human-computer interaction that a user operates via intuitive actions related to natural, everyday human behaviour like touch gesture or voice
Examples - Speech recognition(Sirri,Cortana), Touch screen, Gesture recognition(xbox kinect,wii),Eye tracker
Metaverse - the concept of a highly immersive virtual world where people gather to socialize, play, and work
Example VR
110
Is user interface a subset of HCI ?
Yes
111
Give some human forms of input?
Touch,sight,sound,smel,taste
112
List Nielsen's 10 Usability Heuristics
1.) Match between system and the real world - Systems should speak the users language
E.g. Computer science language: [0][0], [0][2] * Excel speaks users’ language: [A][1], [B][3]
2.) Consistency & standards - Users should not have to wonder whether different words, situations, or actions mean the same thing
3.) Visibility of system status E.g. loading bar
4.) User control and freedom - Users often choose system functions by mistake and will need a clearly marked "emergency exit" to leave the unwanted state E..g. Undo and redo
5.) Error prevention E.g. When you are about to delete a file you get a message asking are you sure before you delete it
6.) Help users recognize, diagnose, and recover from errors E.g if you type wrong password you get a message saying you chose the wrong password
7.) Recognition rather than recall E.g visited links in chrome are purple
8.) flexibility and efficiency of use
9.) Aesthetic and minimalist Design E.g when you search something on google the most relevant thing shows up
10.) Help and documentation E.g Manuals and online help
113
Define Usability Testing ?
Evaluating usability of a web-page, app or other software by testing it with real users.
114
Give some reasons for why usability testing cannot be done?
○ not enough time
○ not enough money
○ no expertise in doing it
○ no lab or location in which to perform it
○ don't know how to interpret the results
115
When should usability testing be performed?
Early in the software lifecycle and it should be done often/repeatedly.
116
Give some info on Traditional testing
Its expensive and scientific
117
Gibe some info on lost our lease testing.
. Tested cheaply and often
. Not scientific
118
Give some info on multiple testing
More users can find many problems
. You test with many users
119
Give some on Usability Study room set up
a quiet room where someone can interact with a interface
* Participant sits at computer and performs tasks with interface
* Moderator / facilitator guides the user through the process
. Others on dev team observe user, either from the side or from another room or hidden camera
. Record the user and watch later
120
List some things about the user and what they should do for the test to run smoothly
* Anybody with decent people skills can do it.
* Be friendly.
* Don't lead the user or give them hints about what to do.
* Probe; when they give feedback, ask for more details.
. Ask user to do a specific thing and watch to see how they d
121
What is an Exploratory/Formative test?
It looks to see if the user can actually do thnigs
122
What happens in an Assessment/Summative test?
The user performs an actual task
123
What happens in a comparison test?
match up different prototypes or designs
124
What happens in a verification test?
- verifies that UI is okay or that a fix works
125
What should a usability test plan include?
1. Type Of Test
2. Purpose/Goals/Objectives
3. Participant Characteristics
4. Task List
* Possibly have users try same tasks in different orders
5. Test Environment / Equipment
6. Moderator's Role
7. Evaluation Metrics And Data To Be Collected
8. Report
126
What data can be collected from a test?
Percentages and counts of task completed/failed and count errors
Tine required to access info for help,recover from errors and complete tasks
127
What do performance goals do ?
Decide specific goals you want users to achieve.
128
List some things that show if a user has failed
* Don't understand the point of the site.
* They use different vocabulary than you, so they can't find a word for the action to do.
* Their notion of how to categorize is different.
* Site is too busy / cluttered.
* Not clear what the options are on the screen.
129
List some limitations of usability testing
* Test results don't prove that a product/design/UI "works"
* Testing may not be the best use of your time.
* Doesn't tell you if the market wants/needs a product like yours.
130
What is accessibility?
Software accessibility means that websites, apps, tools and technologies are designed and developed so that people with
disabilities can perceive, understand and interact with the software technology with ease.
131
What is impairment
Anything that has a major effect on people's ability to carry out normal day to day activities
132
List the 5 types of impairment and examples where possible.
* Speech
* Visual(blindness, low vision, colour blindness)
* Motor(cerbral palsy, Parkinson's disease, arthritis)
* Cognitive (dyslexia, attention deficit disorder)
Auditory (sound, hearing impaired audience)
133
Why is accessibility important?
Limited accessibility reduces the Internet's potential as an effective tool.
* Assistive/adaptive software will not work if web pages are coded incorrectly coded
* The web is spreading rapidly in all things we do and we need to avoid digital isolation and social exclusion.
. The population is aging so the number of people with impairments are increasing
134
When is a website said to be accessible ?
when anyone regardless of circumstance can access it
135
What are the 2 approaches to designing for accessibiility?
Design for all
Inclusive design
136
What is design for all?
AKA Universal design. This means going beyond only designing for user experience and accounts for everything
137
What is inclusive design?
to design for accessibility based on 4 criteria:
- Varying ability
- If it works for those with disabilities
- Mental state
- Usability and aesthetics being compatible
138
Define Percievable
Info and UI components must be presentable to users such that they are visible to all of their senses
139
Define Operable?
This means that users must be able to operate the user interface and all its components
140
Define understandable
This means that users must be able to understand the information as well as the operation of the user interface
141
Define robust
This means that users must be able to access the content as technologies advance
142
What is a standard ?
A standard is an agreed way of doing something to a specific or measurable level of quality. It is created by a recognised body and it is officially documented .
143
Why do we need standards?
. Standards promote best practice
. Standards encourage consistency
. Standards are independent so a majority agree on them
. Standards ensure businesses are compliant
144
Define a principle
an abstract design rule
144
Define a guideline
advice on how to achieve a principle
145
Give 2 benefits of guidelines
* Guidelines provides a clear instruction on a range of issues that designers will encounter
. Guidelines will help usability specialists evaluate the designs of their products
146
What is evaluation?
the process by which the interface is tested against the needs and practices of the user.
147
What can we lean from evaluation ?
We can get rid of problems to do wih functionalitiy, usability,user experience and etc
* Designers can learn about what users think and what makes a good system.
.Find out how effective and efficient is the software being studied, and how much the users enjoy using it and how much it annoys and frustrates them, and where they "get stuck“
148
Name the 5 types of evaluation
. Summative Evaluation
. Formative Evaluation
. Analytic Evaluation
. Empirical evaluation
. Lab - based Usability Evaluation
149
Give some info on summarative evaluation.
○ Often happens at the end of the development process
○ Provides an evaluation or summary of the end product
. Matches system to requirements specification
150
Give some info on formative evaluation
○ Happens during the development process
○ Used to inform the development process hence is applied to a prototype rather than a complete system
○ Takes account of users(knowledge, skills, gender, age, disability, etc.)
. Takes account of user tasks or goals
151
Give some info on analytic evaluation
○ Consists of formal methods for analysing interfaces v Heuristic evaluation
. Cognitive Walkthrough – task related
. Goals Operations Methods Selection Rules (GOMS)- task related
. Aims to investigate existing situation, not envision new systems
152
Give some info on empirical evaluation
○ users participate in trials of prototype interfaces
○ requires careful design of the trial’s content and conduct
○ may involve benchmark tasks
○ may involve collecting and processing subjective opinions
○ Evaluating with user participation
Field studies and controlled experiments
