Computer Security: Principles and Practice, 4th Edition Midterm Review

T

Access control is the central element of computer security.

T

An auditing function monitors and keeps a record of user accesses to system resources.

T

The principal objectives of computer security are to prevent
unauthorized users from gaining access to resources, to prevent legitimate users from accessing resources in an unauthorized manner, and to enable legitimate users to access resources in an authorized manner.

T

A user may belong to multiple groups.

T

An access right describes the way in which a subject may access an object.

F

Traditional RBAC systems define the access rights of individual users and groups of users.

Access control

1. __________ implements a security policy that specifies who or what may have access to each specific system resource and the type of access that is permitted in each instance.

Authentication

__________ is verification that the credentials of a user or other system entity are valid.

Authorization

_________ is the granting of a right or permission to a system entity to access a system resource.

DAC

__________ is the traditional method of implementing access control.

MAC

__________ controls access based on comparing security labels with security clearances.

mandatory access control

A concept that evolved out of requirements for military information security is ______ .

subject

A __________ is an entity capable of accessing objects.

object

A(n) __________ is a resource to which access is controlled.

RBAC

__________ is based on the roles the users assume in a system rather than the user's identity.

role

A __________ is a named job function within the organization that controls this computer system

Constraints

__________ provide a means of adapting RBAC to the specifics of administrative and security policies in an organization.

Cardinality

__________ refers to setting a maximum number with respect to roles.

ABAC

Subject attributes, object attributes and environment attributes are the three types of attributes in the __________ model.

access management

The __________ component deals with the management and control of the
ways entities are granted access to resources.

Object

The basic elements of access control are: subject, __________, and access right.

Environment

The three types of attributes in the ABAC model are subject attributes, object attributes, and _________ attributes.

T

User authentication is the fundamental building block and the primary line of defense.

F

Identification is the means of establishing the validity of a claimed identity provided by a user.

T

Many users choose a password that is too short or too easy to guess.

T

User authentication is the basis for most types of access control and for user accountability.

F

Memory cards store and process data.

T

Enrollment creates an association between a user and the user's biometric characteristics.

T

In a biometric scheme some physical characteristic of the individual is mapped into a digital representation.

password cracker

A __________ is a password guessing program.

reactive password checking

A __________ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.

facial characteristics

The most common means of human-to-human identification are __________.

Hand geometry

__________ systems identify features of the hand, including shape, and lengths and widths of fingers.

enrolled

Each individual who is to be included in the database of authorized users must first be __________ in the system.

host attack

A __________ is directed at the user file at the host where passwords, token passcodes, or biometric templates are stored.

replay

A __________ attack involves an adversary repeating a previously captured user response.

Identification

An authentication process consists of the _________ step and the verification step.

tokens

Objects that a user possesses for the purpose of user authentication are called ________

Biometric

A __________ authentication system attempts to authenticate an individual based on his or her unique physical characteristics.

denial-of-service

A _________ attack attempts to disable a user authentication service by flooding the service with numerous authentication attempts.

T

Symmetric encryption is used primarily to provide confidentiality

T

Two of the most important applications of public-key encryption are digital signatures and key management.
True or False

F

Cryptanalytic attacks try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
True or False

T

The secret key is input to the encryption algorithm.
True or False

F

Triple DES takes a plaintext block of 64 bits and a key of 56 bits to produce a ciphertext block of 64 bits.
True or False

T

Modes of operation are the alternative techniques that have been developed to increase the security
of symmetric block encryption for large sequences of data.
True or False

F

The advantage of a stream cipher is that you can reuse keys.
True or False

T

A message authentication code is a small block of data generated by a
secret key and appended to a message.
True or False

T

Public-key cryptography is asymmetric.

T

The strength of a hash function against brute-force attacks depends solely on the length of the hash code produced by the algorithm.

plaintext

The original message or data that is fed into the algorithm is __________.

decryption algorithm

The __________ is the encryption algorithm run in reverse.

Ciphertext

__________ is the scrambled message produced as output.

half

On average, __________ of all possible keys must be tried in order to achieve success with a brute-force attack.

AES

The most important symmetric algorithms, all of which are block ciphers, are the DES, triple DES, and the __________.

use longer keys

If the only form of attack that could be made on an encryption algorithm is brute-force, then the way to counter such attacks would be to __________ .

Message authentication

__________ is a procedure that allows communicating parties to verify that received or stored messages are authentic.

hash function

The purpose of a __________ is to produce a "fingerprint" of a file, message, or other block of data.

symmetric encryption

Also referred to as single-key encryption, the universal technique for providing confidentiality for transmitted or stored data is _______________________ .

brute-force

There are two general approaches to attacking a symmetric encryption scheme:
cryptanalytic attacks and _______________________ attacks.

decryption

The ________________ algorithm takes the ciphertext and the secret key and produces
the original plaintext.

cryptanalytic

A _________________ attack exploits the characteristics of the algorithm to attempt to deduce a specific plaintext or to deduce the key being used.

block cipher

A _________________ processes the plaintext input in fixed-size blocks and produces a block of ciphertext of equal size for each plaintext block.

stream cipher

A _________________ processes the input elements continuously, producing output one element at a time.

Diffie and Hellman

Public-key encryption was first publicly proposed by _________________ in 1976.

uniform distribution

The two criteria used to validate that a sequence of numbers is random are independence and _________ .

digital signature

A __________ is created by using a secure hash function to generate a hash value for a message and then encrypting the hash code with a private key.

public-key

Digital signatures and key management are the two most important applications of __________ encryption.

brute-force attack

A __________ is to try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.

T

Computer security is protection of the integrity, availability, and confidentiality of information system resources.

T

Data integrity assures that information and programs are changed only in a specified and authorized manner.

T

Availability assures that systems work promptly and service is not denied to authorized users.

F

The "A" in the CIA triad stands for "authenticity".

T

The more critical a component or service, the higher the level of availability required.

T

Computer security is essentially a battle of wits between a perpetrator who tries to find holes and the administrator who tries to close them.

T

Many security administrators view strong security as an impediment to
efficient and user-friendly operation of an information system.

F

Assurance is the process of examining a computer product or system
with respect to certain criteria.

Privacy

________assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed.

System Integrity

_________assures that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.

confidentiality

A loss of _________ is the unauthorized disclosure of information.

countermeasure

A(n) __________ is an action, device, procedure, or technique that reduces a threat, a vulnerability, or an attack by eliminating or preventing it, by minimizing the harm it can cause, or by discovering and reporting it so that correct action can be taken.

High

A ________ level breach of security could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals.

denial of service

The _________ prevents or inhibits the normal use or management of communications facilities

exposure

A threat action in which sensitive data are directly released to an unauthorized entity is __________.

masquerade

An example of __________ is an attempt by an unauthorized user to gain access to a system by posing as an authorized user.

passive attack

A(n) _________ is an attempt to learn or make use of information from the system that does not affect system resources.

deception

Masquerade, falsification, and repudiation are threat actions that cause __________ threat consequences.

security attack

A __________ is any action that compromises the security of information owned by an organization.

Computer Security

_________ is the protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources.

Passive

Release of message contents and traffic analysis are two types of _________ attacks.

Recovery

Security implementation involves four complementary courses of action: prevention, detection, response, and____________

CIA Triad

Confidentiality, Integrity, and Availability form what is often referred to as the ________

Data

The assets of a computer system can be categorized as hardware, software, firmware, communication lines and networks, and _________

Active

Replay, masquerade, modification of messages, and denial of service are example of ________ attacks.

data integrity

The assurance that data received are exactly as sent by an authorized entity is __________.

vulnerability

A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy is a(n) __________.

attack

An assault on system security that derives from an intelligent act that is a deliberate attempt to evade security services and violate the security policy of a system is a(n) __________.