1. This question concerns the main security goals (confidentiality, integrity, a

Question

1. This question concerns the main security goals (confidentiality, integrity, availability). Describe a situation in which the the goal of integrity is important, but there is not a need for confidentiality.

2. In a particular form of two-factor authentication, a user shows their identity by providing a password and then receiving (on their mobile phone) a text message with a number that must be entered as well. Describe an attack that would succeed despite this particular two-factor approach.

3. In the past few years, a type of scam has become common, where a telephone call claims to be from Microsoft Technical Support, telling the customer that their computer has been infected by a virus, and offering to help fix the problem, see http://www.scamwatch.gov.au/content/index.phtml/itemId/792165 Write an explanation suitable for a friend who is not studying any computing courses, to help explain to them about the dangers of allowing remote access to a computer.

4.If file permissions are set inappropriately, security can suffer. Suppose Fred Foolish, the Chief Security Officer of the company you work for, makes a policy that every file must have its permissions checked by a system administrator. Discuss the impact of this policy on the likelihood or extent of damage caused by an attack, and on the normal work of the organization.

5. A typical password is about 8 characters long (and so can be stored in 8 bytes, or 64 bits). However, a typical key for encryption/decryption is much longer, and a key of 64 bits would not be considered secure. Explain this in terms of the difference between the way a secret is used as a password, and the way it is used as a key. Hint: what happens if an attacker takes a few months to discover the secret?

Explanation / Answer

ans 5:

When the secret is used as a password, the message(data) is not scrambled.
when the secret is used as a key, the message(data) is scrambled aka ciphertext.

so the password should be changed periodically. so after few months by the time when the attacker discover user password, the user might have already using new password.

Related Questions

Navigate

• Browse (All)
• Browse 1
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.