Podcast
Questions and Answers
Within the CIA triad, what does 'confidentiality' primarily aim to protect?
Within the CIA triad, what does 'confidentiality' primarily aim to protect?
Which statement best describes the concept of 'integrity' within the CIA triad?
Which statement best describes the concept of 'integrity' within the CIA triad?
In the context of the CIA triad, what qualifies as 'access' to an asset?
In the context of the CIA triad, what qualifies as 'access' to an asset?
What does the term 'subject' refer to when discussing access to an asset?
What does the term 'subject' refer to when discussing access to an asset?
Signup and view all the answers
What are considered modifications, in the context of 'integrity' within the CIA triad?
What are considered modifications, in the context of 'integrity' within the CIA triad?
Signup and view all the answers
Which security threat involves making a system resource unusable?
Which security threat involves making a system resource unusable?
Signup and view all the answers
What type of security threat is exemplified by illicitly copying a file?
What type of security threat is exemplified by illicitly copying a file?
Signup and view all the answers
Which attack directly compromises the integrity of a system by altering transmitted messages?
Which attack directly compromises the integrity of a system by altering transmitted messages?
Signup and view all the answers
Adding false records to a database is an example of which security threat?
Adding false records to a database is an example of which security threat?
Signup and view all the answers
Which of the following best describes 'integrity' in the context provided?
Which of the following best describes 'integrity' in the context provided?
Signup and view all the answers
Which threat targets the confidentiality of data?
Which threat targets the confidentiality of data?
Signup and view all the answers
According to the provided information, what is a primary concern regarding availability?
According to the provided information, what is a primary concern regarding availability?
Signup and view all the answers
Which aspect is NOT a part of the three particular aspects of integrity as recognized by [Welke & Mayfield]?
Which aspect is NOT a part of the three particular aspects of integrity as recognized by [Welke & Mayfield]?
Signup and view all the answers
In the context of the AAA framework, what is the primary purpose of 'Authentication'?
In the context of the AAA framework, what is the primary purpose of 'Authentication'?
Signup and view all the answers
Which statement best reflects the relationship between 'CIA' and 'AAA' as presented?
Which statement best reflects the relationship between 'CIA' and 'AAA' as presented?
Signup and view all the answers
What is a vulnerability in the context of a computer system?
What is a vulnerability in the context of a computer system?
Signup and view all the answers
Which of the following best describes a 'threat' to a computing system?
Which of the following best describes a 'threat' to a computing system?
Signup and view all the answers
In the analogy of the man, water, and wall, what is the role of the crack in the wall?
In the analogy of the man, water, and wall, what is the role of the crack in the wall?
Signup and view all the answers
According to the 'Security Threats' model, what type of harm is caused by interception?
According to the 'Security Threats' model, what type of harm is caused by interception?
Signup and view all the answers
Which of the following action is described by the term 'fabrication' as a security threat?
Which of the following action is described by the term 'fabrication' as a security threat?
Signup and view all the answers
Computer security focuses exclusively on protecting hardware.
Computer security focuses exclusively on protecting hardware.
Signup and view all the answers
The principle of easiest penetration suggests that intruders will use the most difficult means possible to compromise a system.
The principle of easiest penetration suggests that intruders will use the most difficult means possible to compromise a system.
Signup and view all the answers
Detection measures are proactive steps to prevent damage to assets.
Detection measures are proactive steps to prevent damage to assets.
Signup and view all the answers
In a cyber security context, using encryption when placing an order is a reactive measure.
In a cyber security context, using encryption when placing an order is a reactive measure.
Signup and view all the answers
Replacing a stolen item is considered a 'prevention' method in security.
Replacing a stolen item is considered a 'prevention' method in security.
Signup and view all the answers
An attack on availability occurs when an asset of the system is enhanced or improved.
An attack on availability occurs when an asset of the system is enhanced or improved.
Signup and view all the answers
Wiretapping is an example of a modification attack.
Wiretapping is an example of a modification attack.
Signup and view all the answers
Changing values in a data file is an example of fabrication.
Changing values in a data file is an example of fabrication.
Signup and view all the answers
Cutting a communication line is an example of an interruption threat that targets the confidentiality of messages.
Cutting a communication line is an example of an interruption threat that targets the confidentiality of messages.
Signup and view all the answers
In the CIA triad, confidentiality ensures that assets are accessible to anyone who requests them.
In the CIA triad, confidentiality ensures that assets are accessible to anyone who requests them.
Signup and view all the answers
An unauthorized party inserting counterfeit records into a file is considered a fabrication attack, which is an attack on the system's integrity
An unauthorized party inserting counterfeit records into a file is considered a fabrication attack, which is an attack on the system's integrity
Signup and view all the answers
Modifying an asset includes only writing new information; deleting or changing existing data is not considered modification.
Modifying an asset includes only writing new information; deleting or changing existing data is not considered modification.
Signup and view all the answers
A 'threat' is best described as the active exploitation of a vulnerability.
A 'threat' is best described as the active exploitation of a vulnerability.
Signup and view all the answers
Availability ensures that authorized users can access assets without any notable delay.
Availability ensures that authorized users can access assets without any notable delay.
Signup and view all the answers
Accidentally deleting a file is categorized as a malicious, human-caused harm.
Accidentally deleting a file is categorized as a malicious, human-caused harm.
Signup and view all the answers
An 'object' in access control is the person or process attempting to access data.
An 'object' in access control is the person or process attempting to access data.
Signup and view all the answers
Lack of access control is an example of a hardware vulnerability.
Lack of access control is an example of a hardware vulnerability.
Signup and view all the answers
The security goals of the CIA triad are primarily from the user's point of view.
The security goals of the CIA triad are primarily from the user's point of view.
Signup and view all the answers
Interruption resulting in a denial of service is associated with the hardware category of vulnerabilities.
Interruption resulting in a denial of service is associated with the hardware category of vulnerabilities.
Signup and view all the answers
Creating false data or records falls under the threat category labeled modification.
Creating false data or records falls under the threat category labeled modification.
Signup and view all the answers
Study Notes
Introduction to Computer Security
- Computer security is the protection of computer system assets.
- Assets include hardware, software, data, processes, storage media, and people.
- The principle of easiest penetration means intruders will use the easiest method available.
Core Concepts
- Computer systems (hardware, software, and data) have value and require protection.
- There are three levels of protection:
- Prevention: measures to prevent damage.
- Detection: measures to identify when and how an asset is damaged.
- Reaction: measures to recover assets or from damage.
- An example from the physical world is using locks, burglar alarms, and CCTV cameras.
- An example from the cyber world is using encryption for online purchases and checking credit card statements for unauthorized transactions.
- Preventing theft of assets
- Detecting and recovering from theft
Security Goals - CIA Triad
- Confidentiality: assets of computing systems are only accessible to authorized parties.
- Integrity: assets can only be modified by authorized parties using authorized methods.
- Availability: assets are accessible to authorized parties when needed without delay.
- Security is from the assets' point of view.
Data Access
- At the most basic level, a subject can observe or alter an object.
- Access modes include observe and change.
- Access rights in the Bell-LaPadula model.
Vulnerabilities and Threats
- A vulnerability is a weakness in a system (procedures, design, or implementation) that can be exploited.
- A threat is a set of circumstances that could cause harm.
- A threat, if it successfully leverages a vulnerability is called a realized threat; therefore harm occurs.
- Examples of vulnerabilities include: weak authentication, lack of access control, errors in programs, inadequate resources, insufficient hardware protection, and involuntary/voluntary machine-slaughter.
- Exploits use vulnerabilities.
- Attacks exploit vulnerabilities.
Types of Threats
- Non-human threats: natural disasters, power outages, and hardware/software failures.
-
Human threats: benign (accidental) and malicious (intentional).
- Benign: accidental data deletion, incorrect typing, or other similar errors.
- Malicious: random and directed attacks.
- Types of malicious attacks: interception, interruption, modification, and fabrication.
- Random: general code placed on a public website targeting any users
- Directed: targeting specific computer systems, or an individual.
Types of Attackers
- Amateurs: generally not career criminals, but are aware of security flaws.
- Crackers: usually students or young adults trying to access unauthorized resources.
- Career criminals: understand targets of computer crimes and often collaborate with other groups.
- Hackers: generally understand computer systems in depth and often explore system limits (can be benign or not).
Method, Opportunity, Motive
Malicious attackers have three things for success: Method, Opportunity, and Motive
System Access Control
- System Access Control: system decides whether a user is legitimate.
-
Data Access Control: monitoring who can access data and for what purposes.
- Authentication: Proving user identities.
- Identification: Asserting user identity.
- System Administration and Security: enforcing procedures, training users, and maintaining systems.
- System Design: use of basic hardware and software security features.
System Access Controls (passwords)
-
A user's role in password protection—authentication can be compromised by giving away the password to others.
-
Password guessing: exhaustive search (brute force) and intelligent search.
-
Password spoofing.
-
Compromise of the password file.
-
Choosing Strong Passwords
Effectiveness
- Awareness of security requirements, clear understanding of the importance of security, and use of appropriate controls.
- Overlapping controls and periodic reviews.
- Awareness of security problems is necessary for people to work collaboratively to solve problems
- Procedures and controls must be used correctly, and be easy to use; they may be combined.
System Controls
- Controls can counter threats using physical (locks, walls), procedural (rules, regulations), and technical (firewalls, passwords) methods.
- Access control—identifying and authenticating users.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Related Documents
Description
This quiz covers foundational concepts in computer security, including asset protection, core security principles, and the CIA triad. Test your knowledge on how to safeguard hardware, software, and data, as well as the various levels of protection and their applications. Prepare to explore strategies for prevention, detection, and reaction to security breaches.
