Review

Question 1

Assurance

Answer 1

How trust is provided and managed

• policies (for people and systems)
• permissions (for agent that interact w/ system)
• protections (mechanisms to enforce policies/permissions)

Question 2

Authenticity

Answer 2

The ability to determine that statements, policies, and permissions issued by persons or systems are genuine.

Objective achieved via digital signatures. This is turn creates non-repudiation.

Question 3

Anonymity Methods

Answer 3

1. Aggregation: combining of data from many individuals so that disclosed data not tied to any individual
2. Mixing: intertwining of data in way that cannot be traced to individual
3. Proxies: web proxy
4. Pseudonyms: ficitonal identities

Question 4

10 Security Principles

Answer 4

1. Compromise Recording (better to record than precent sometimes)
2. Work Factor (commensurate countermeasure)
3. Psychological Acceptability (make it easy to use/understand)
4. Least Common Mechanism
5. Fail Safe Defaults
6. Economy of Mechanism
7. Complete Mediation
8. Separation of Privelege
9. Open Design
10. Least Privelege