midterm 1 priority scenarios

A company's payroll server has an unpatched weakness. The likelihood of an attack is rated 4 and the impact is rated 5. Calculate the risk score. What should the company do?

Risk = likelihood × impact, so 4 × 5 = 20. The weakness is the missing security update, which an attacker could exploit. The company should install the patch to remove the weakness. This is a technical and preventive control. If patching must wait, it can restrict access to lower the risk temporarily.

Alice and Bob want to send private messages over a public network. They exchange calculated public values but never send their secret key. How can they end up with the same key, and what happens next?

They can use Diffie-Hellman key exchange. Each person keeps a private value and combines it with a public value received from the other person. The calculations give both sides the same shared secret without sending that secret over the network. They can use it to create an AES key that encrypts their messages.

Your browser connects to a bank's HTTPS website. The website sends a certificate and a public key. How does the browser decide whether it can trust the website?

The certificate connects the bank's website name to a public key. The browser checks the name, expiration date, and digital signatures. It follows the certificate chain through any intermediate certificate authority to a trusted root authority. This helps verify that the public key belongs to the website rather than to an impersonator.

You download a software installer. Its calculated SHA-256 value does not match the value posted on the software company's trusted website. What does this mean, and what should you do?

SHA-256 is a hash function that produces a fixed-length digest based on the file's contents. Different digests mean the files or reference values are not the same, so the download may be damaged or altered. Do not run it; obtain a fresh copy from a trusted source. A matching hash is useful only when the expected hash is trustworthy.