Podcast
Questions and Answers
What is the primary focus of computer security?
What is the primary focus of computer security?
Which classification does not belong among the measures to protect computer assets?
Which classification does not belong among the measures to protect computer assets?
What is an example of a preventive measure in the physical world?
What is an example of a preventive measure in the physical world?
In the case of credit card fraud, what is a detection measure?
In the case of credit card fraud, what is a detection measure?
Signup and view all the answers
Which of the following statements about reaction measures in cyber security is true?
Which of the following statements about reaction measures in cyber security is true?
Signup and view all the answers
What is a vulnerability in a computing system?
What is a vulnerability in a computing system?
Signup and view all the answers
Which statement best describes a threat to a computing system?
Which statement best describes a threat to a computing system?
Signup and view all the answers
How can the risk associated with a vulnerability be controlled?
How can the risk associated with a vulnerability be controlled?
Signup and view all the answers
In the example of the man and the rising water, what does the water represent?
In the example of the man and the rising water, what does the water represent?
Signup and view all the answers
What is the relationship between a vulnerability and a threat?
What is the relationship between a vulnerability and a threat?
Signup and view all the answers
What is the primary focus of Confidentiality in the CIA Triad?
What is the primary focus of Confidentiality in the CIA Triad?
Signup and view all the answers
What encompasses the authorization in the context of asset access?
What encompasses the authorization in the context of asset access?
Signup and view all the answers
In the CIA Triad, what does Integrity refer to?
In the CIA Triad, what does Integrity refer to?
Signup and view all the answers
Which of the following is an example of access modes defined under Confidentiality?
Which of the following is an example of access modes defined under Confidentiality?
Signup and view all the answers
What role do subjects play in the context of the CIA Triad?
What role do subjects play in the context of the CIA Triad?
Signup and view all the answers
What does Availability ensure in the context of the CIA Triad?
What does Availability ensure in the context of the CIA Triad?
Signup and view all the answers
Which statement best encapsulates the concept of Integrity?
Which statement best encapsulates the concept of Integrity?
Signup and view all the answers
What does preserving the integrity of an item imply?
What does preserving the integrity of an item imply?
Signup and view all the answers
Which aspect of integrity involves managing changes to resources?
Which aspect of integrity involves managing changes to resources?
Signup and view all the answers
What does availability refer to in the context of assets?
What does availability refer to in the context of assets?
Signup and view all the answers
In what context is the term 'denial of service' used?
In what context is the term 'denial of service' used?
Signup and view all the answers
Which of the following is NOT a component of the AAA framework?
Which of the following is NOT a component of the AAA framework?
Signup and view all the answers
What is the primary purpose of authentication within the AAA framework?
What is the primary purpose of authentication within the AAA framework?
Signup and view all the answers
What should happen to resources in order to ensure proper protection?
What should happen to resources in order to ensure proper protection?
Signup and view all the answers
Which property does NOT directly relate to the concept of integrity?
Which property does NOT directly relate to the concept of integrity?
Signup and view all the answers
Which of the following statements about error detection is accurate?
Which of the following statements about error detection is accurate?
Signup and view all the answers
What defines the usability of assets in terms of availability?
What defines the usability of assets in terms of availability?
Signup and view all the answers
Computer security is the protection of assets of a computer system.
Computer security is the protection of assets of a computer system.
Signup and view all the answers
There are five classifications of protection in computer security.
There are five classifications of protection in computer security.
Signup and view all the answers
Detection measures can help identify when an asset has been damaged.
Detection measures can help identify when an asset has been damaged.
Signup and view all the answers
In the case of credit card fraud, reaction measures do not include asking for a new credit card number.
In the case of credit card fraud, reaction measures do not include asking for a new credit card number.
Signup and view all the answers
Prevention measures in computer security can include using encryption.
Prevention measures in computer security can include using encryption.
Signup and view all the answers
Confidentiality ensures that assets are accessible to any party.
Confidentiality ensures that assets are accessible to any party.
Signup and view all the answers
Integrity allows assets to be modified by any party without restrictions.
Integrity allows assets to be modified by any party without restrictions.
Signup and view all the answers
Availability guarantees that assets are accessible to authorized parties when needed.
Availability guarantees that assets are accessible to authorized parties when needed.
Signup and view all the answers
The CIA Triad consists of Confidentiality, Integrity, and Authenticity.
The CIA Triad consists of Confidentiality, Integrity, and Authenticity.
Signup and view all the answers
In the context of asset access, an access mode can include read, write, or execute.
In the context of asset access, an access mode can include read, write, or execute.
Signup and view all the answers
Modification of assets under Integrity includes actions like deleting and creating.
Modification of assets under Integrity includes actions like deleting and creating.
Signup and view all the answers
Access to assets can be granted to anyone based on personal preference.
Access to assets can be granted to anyone based on personal preference.
Signup and view all the answers
A vulnerability in a system is a strength that prevents exploitation.
A vulnerability in a system is a strength that prevents exploitation.
Signup and view all the answers
A threat to a computing system is a set of circumstances that has the potential to cause loss or harm.
A threat to a computing system is a set of circumstances that has the potential to cause loss or harm.
Signup and view all the answers
Manipulating user identities can help secure a system against threats.
Manipulating user identities can help secure a system against threats.
Signup and view all the answers
The water in the example represents security threats.
The water in the example represents security threats.
Signup and view all the answers
Controlling a vulnerability helps block a threat.
Controlling a vulnerability helps block a threat.
Signup and view all the answers
Integrity means the item is unmodified.
Integrity means the item is unmodified.
Signup and view all the answers
Availability refers to unauthorized access to assets.
Availability refers to unauthorized access to assets.
Signup and view all the answers
Error detection and correction are important aspects of integrity.
Error detection and correction are important aspects of integrity.
Signup and view all the answers
Denial of service (DoS) is an aspect of integrity.
Denial of service (DoS) is an aspect of integrity.
Signup and view all the answers
The AAA framework includes authentication, authorization, and assurance.
The AAA framework includes authentication, authorization, and assurance.
Signup and view all the answers
Integrity can involve modification only by authorized people.
Integrity can involve modification only by authorized people.
Signup and view all the answers
Availability requires that data is present in an unusable form.
Availability requires that data is present in an unusable form.
Signup and view all the answers
The integrity of an item can be characterized by its meaningfulness.
The integrity of an item can be characterized by its meaningfulness.
Signup and view all the answers
Separation and protection of resources are part of the integrity aspects.
Separation and protection of resources are part of the integrity aspects.
Signup and view all the answers
Assets must be inaccessible to authorized parties during a denial of service.
Assets must be inaccessible to authorized parties during a denial of service.
Signup and view all the answers
Study Notes
Chapter 1: Basic Security Concepts
- Computer security protects computer system assets.
- Assets include hardware, software, data, processes, storage media, and people.
- The "Principle of Easiest Penetration" suggests intruders will use readily available methods.
- Security protection has three classifications:
- Prevention: measures to stop damage.
- Detection: identifying when and how assets are harmed.
- Reaction: measures to recover from damage.
Example from the Physical World
- Prevention: Locks, walls prevent access to property.
- Detection: Noticing something missing triggers an alarm (CCTV, burglar alarm).
- Reaction: Calling the police or replacing stolen items.
Example from the Cyber World: Credit Card Fraud
- Prevention: Encryption and merchant checks before processing credit card orders or not using credit card numbers online.
- Detection: Unauthorized transactions appearing on statements.
- Reaction: Requesting new cards, recovering costs from the fraudster.
Security Goals - CIA Triad
- Confidentiality: Assets accessible only to authorized parties.
- Integrity: Assets modified only by authorized parties.
- Availability: Authorized parties access needed assets without delay.
- Security is achieved through combining the CIA principles from an asset perspective, not a user perspective.
Confidentiality
- Computer assets are accessible only to authorized parties.
- Access includes viewing, printing, and knowing the existence of the asset.
- A subject is a person/process/program.
- An object is a data item.
- An access mode is the type of access (read, write, execute).
- A policy describes how access is controlled.
Integrity
- Assets can only be modified by authorized parties.
- Modification includes writing, changing status, deleting, creating.
- Integrity can mean various things in different contexts:
- Accurate
- Precise
- Unmodified
- Modified only in acceptable ways
- Modified only by authorized people
- Modified only by authorized processes
- Consistent
- Internally consistent
- Meaningful and usable
- Specific aspects of integrity: authorized actions, separation, protection of resources, and error detection/correction.
Availability
- Assets are accessible to authorized parties at appropriate times.
- Denial of service (DoS), preventing access from authorized users, is an availability threat.
- Availability concerns both data and services.
- Factors affecting availability include capacity and service needs.
Other Protection Requirements (AAA)
- A three-process framework manages user access, enforces policies, and monitors network resource consumption.
- Authentication: Verifying user identity.
- Authorization: Determining user access permissions.
- Accounting: Tracking user activities and resource consumption.
Vulnerabilities and Threats
- A vulnerability is a weakness in a system's design or implementation.
- A threat is a circumstance that has the potential to cause harm or loss.
Computer Network Vulnerabilities
- Various hardware, software, and network vulnerabilities contribute to potential security threats. Examples include radiation, taps, cross-talk, communication lines, improper connections, and unauthorized access.
Security Threats (Interception, Interruption, Modification, Fabrication)
- Interruption: System unavailable or unusable.
- Interception: Unauthorized access to an asset.
- Modification: Tampering with an asset.
- Fabrication: Introducing counterfeit objects into a system.
Examples of Security Threats (Interruption, Interception, Modification, Fabrication)
- Interruption: Destroying hardware components such as a hard drive, cutting communication lines, and disabling file management systems.
- Interception: Wiretapping, illegally copying files.
- Modification: Altering data files, changing program behavior, modifying files.
- Fabrication: Adding records to files, inserting spurious messages into networks.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Related Documents
Description
Explore the fundamental concepts of computer security in this quiz based on Chapter 1. Understand the classification of security protections along with real-world examples that demonstrate prevention, detection, and reaction methods. Test your knowledge on key principles and goals of securing computer assets.
