COMP1323 Everything

What are the three components of the CIA triad?

Confidentiality (prevent unauthorized access), Integrity (prevent unauthorized modification), Availability (ensure reliable access).

What constitutes a breach of confidentiality?

Unauthorized disclosure of information (e.g., stolen unencrypted USB drive, intercepted network messages).

How does integrity differ from authenticity?

Integrity ensures data isn't altered improperly; authenticity verifies the source/genuineness of data/users.

What security goal does accountability support?

Nonrepudiation, forensic analysis, and legal actions by tracing actions to specific entities.

What are the four categories of system assets?

Hardware, Software, Data, and Communication facilities/networks.

What are the three types of system vulnerabilities?

Corruption (wrong outputs), Leakage (unauthorized access), Unavailability (denied service).

How do active and passive attacks differ?

Active attacks alter system assets (e.g., data modification); passive attacks only observe information (e.g., eavesdropping).

What distinguishes inside from outside attacks?

Inside attacks: by authorized users misusing access; outside attacks: by unauthorized external entities.

What factors determine risk in cybersecurity?

Likelihood of a threat occurring × potential adverse impact on assets.

What are the four types of countermeasures?

Detection, Prevention, Mitigation, and Recovery strategies.

How might hardware availability be compromised?

Theft or disabling of equipment (e.g., servers, routers) leading to service denial.

What software integrity threat involves malicious code changes?

Unauthorized program modifications (e.g., inserting backdoors, altering logic).

What data confidentiality risk arises from traffic analysis?

Inferring sensitive information from communication patterns (e.g., metadata analysis).

Which attack vector threatens network message integrity?

Message modification, delay, reordering, duplication, or fabrication of false messages.

Why is accountability critical despite perfect security being unattainable?

Enables breach investigation, assigns responsibility, and supports legal/disciplinary actions.

What is access control?

Access control is the process of granting or denying specific requests to access information, related services, or physical facilities, ensuring use of system resources aligns with a defined security policy.

What are the main goals of access control?

To prevent unauthorised access, prevent misuse by legitimate users, and allow authorised users to access resources appropriately in line with the security policy.

What are the three components of access control context?

Authentication (verifying credentials), authorisation (granting permissions), and audit (reviewing system activities).

What is a security policy in access control?

A security policy defines acceptable system behaviours and access permissions, analogous to a set of laws, and can be enforced locally or across a network.

What is a security model in access control?

A formal representation of system behaviour highlighting security features, used to guide the design of specific policies.

Define subject, object, and access right in access control.

Subject: entity (e.g. user, process) accessing an object. Object: resource being accessed. Access right: type of access (read, write, execute, delete, create, search).

What are the main access control models?

Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC).

What is the purpose of access control models?

To define and enforce policies that ensure confidentiality, integrity, and availability in multi-user systems.

What is Discretionary Access Control (DAC)?

An identity-based model where resource owners control access using Discretionary Access Control Lists (DACLs), forming an access matrix.

What is the key principle of DAC?

Users own resources and have full control over who gets access and what kind of permissions they have, including transferring ownership.

What are the issues with DAC?

Flexible but error-prone, hard to manage at scale, and requires users to understand and follow the security policy. The access matrix grows large quickly.

What is Mandatory Access Control (MAC)?

A security model where subjects and objects are classified with labels and clearances, and access is controlled by system-enforced policies rather than user discretion.

How does MAC make access decisions?

By comparing subject clearances and object classifications (sensitivity and category) to determine access rights based on formal rules.

What are the benefits of MAC?

It offers strong security and prevents data leakage, making it ideal for sensitive environments like the military. Examples include Bell-LaPadula and Biba models.

How does MAC differ from DAC?

MAC is more rigid and secure, with system-enforced rules and no user discretion, while DAC is flexible but relies on user-managed permissions.

Why is MAC called "mandatory"?

Because access rights cannot be transferred by users—control is centralized and enforced by the system owner.

What is Role-Based Access Control (RBAC)?

An access control model where permissions are assigned to roles rather than individual users, and users gain rights through their roles.

What is Attribute-Based Access Control (ABAC)?

An access control model that uses attributes (e.g. user role, object type, time of access) to define and enforce access rules dynamically

What is Role-Based Access Control (RBAC)?

RBAC assigns access permissions based on a user's role within an organisation. Roles have associated permissions, and users inherit permissions through their assigned roles.

What is the key intuition behind RBAC?

RBAC uses the concept of roles as an abstraction for groups of subjects with similar access needs, enabling policies based on shared attributes and organisational hierarchies.

What are the advantages of RBAC?

It increases abstraction, simplifies policy management, reduces user administration, is easy to audit, and offers high flexibility and scalability.

How does RBAC differ from user groups?

RBAC focuses on responsibilities and associated permissions, while user groups simply name collections of users without defining access rights.

What are role hierarchies in RBAC?

They allow one role to inherit permissions from another, simplifying the expression of access control policies.

What are constraints in RBAC?

Rules that restrict how roles can be assigned or configured, including mutually exclusive roles, cardinality limits, and prerequisite roles.

What are mutually exclusive roles in RBAC?

Roles where a user can only be assigned one at a time, supporting separation of duties and reducing the risk of collusion.

What is cardinality in RBAC?

A constraint that sets a maximum number of users for a specific role to limit the spread of powerful permissions.

What is a prerequisite role in RBAC?

A role that can only be assigned if the user already holds a specified other role.

What is Attribute-Based Access Control (ABAC)?

An access control model where access decisions are made based on the evaluation of attributes of subjects, objects, operations, and environment.

What are subject attributes in ABAC?

Characteristics of the user such as name, job title, or organisation.

What are object attributes in ABAC?

Metadata about the object such as title, date, author, or classification.

What are environment attributes in ABAC?

Contextual factors like current date, location, threat level, or network security conditions.

What are the advantages of ABAC?

Dynamic access decisions, consideration of contextual conditions, fine-grained control, and the ability to implement DAC, MAC, and RBAC policies.

What is a disadvantage of ABAC?

Its complexity in design and implementation, with potential performance impacts exceeding those of other models.

Give an example of ABAC in a streaming service.

A service might restrict PG-13 content to users aged 13+, or allow access to premium content based on subscription level.

How does ABAC evaluate access requests?

By dynamically checking rules against the attributes of the subject, object, operation, and environment at the time of the request.

What is the difference between RBAC and ABAC?

RBAC assigns permissions through predefined roles, while ABAC makes access decisions dynamically using attributes and contextual information.

What are other access control models besides DAC, MAC, RBAC, and ABAC?

Bell-LaPadula (confidentiality), Biba and Clark-Wilson (integrity), Chinese Wall (dynamic access), Harrison-Ruzzo-Ullman (formal security models).

How do access control models vary in policy enforcement?

Some enforce static policies (e.g., Bell-LaPadula), while others account for dynamic changes in access rights (e.g., Chinese Wall).

What are the pros of DAC (Discretionary Access Control)?

• Simple to implement
• Flexible and intuitive for users
• Resource owners have control over access

What are the cons of DAC?

• Less secure as it relies on user discretion
• Vulnerable to malicious insiders
• Hard to enforce consistent policies across large systems

What are the pros of MAC (Mandatory Access Control)?

• Highly secure, especially in sensitive environments (e.g., military systems)
• Enforces strict access control policies
• Prevents unauthorised changes to access rights

What are the cons of MAC?

• Less flexible and more complex to manage
• Requires more resources for administration
• Can be restrictive and difficult for users to work with

What are the pros of RBAC (Role-Based Access Control)?

• Simplifies user management in large organisations
• Scalable and easier to manage than DAC
• Reduces errors in assigning permissions
• Ideal for environments with defined roles and responsibilities

What are the cons of RBAC?

• Role explosion (too many roles) can occur in large organisations
• Doesn’t address fine-grained access control (can be too coarse-grained)
• May require periodic role review

What are the pros of ABAC (Attribute-Based Access Control)?

• Highly flexible and fine-grained access control
• Can consider multiple attributes to make access decisions
• Suitable for dynamic and complex environments

What are the cons of ABAC?

• Complex to implement and manage
• Requires detailed attribute definitions
• Can become difficult to scale with a large number of attributes and policies

What is Cryptography?

Cryptography (or cryptology) is the practice and study of techniques for secure communication in the presence of adversarial behavior.

What is Symmetric Encryption?

Symmetric encryption uses the same key to encrypt and decrypt information. It ensures the confidentiality of the information.

What is an example of Symmetric Encryption?

An example of symmetric encryption is the Advanced Encryption Standard (AES).

What is Asymmetric (Public Key) Encryption?

Asymmetric encryption uses a pair of keys: a private key (secret) and a public key. The sender encrypts information with the recipient's public key, and the recipient decrypts it with their private key.

What is an example of Asymmetric Encryption?

Examples of asymmetric encryption include Rivest-Shamir-Adleman (RSA) and Digital Signature Algorithm (DSA).

What is a Digital Signature?

A digital signature involves the sender encrypting information with their private key, and the recipient decrypting it with the sender's public key to verify the message’s authenticity.

What is an example of Digital Signature?

Examples of digital signatures include RSA and DSA.

What is a Hash?

A hash is a function that maps data of arbitrary size (message) to a fixed-size bit string (hash value or message digest).

What is an example of a Hash Algorithm?

An example of a hash algorithm is the Secure Hash Algorithm (SHA-256), which produces a 64 hex-digit output.

What is Key Distribution?

Key distribution is the method of securely sharing encryption keys, especially for symmetric encryption, which requires shared secret keys between communicating parties.

How are keys shared in symmetric encryption?

Keys can be shared using public key encryption or through protocols like the Diffie-Hellman key exchange.

What is the Diffie-Hellman Key Exchange Protocol?

The Diffie-Hellman protocol enables two users to securely exchange a key for subsequent symmetric encryption. Its effectiveness relies on the difficulty of computing discrete algorithms.

What is the purpose of the Diffie-Hellman Key Exchange Protocol?

The Diffie-Hellman protocol allows two users to exchange a secret key, which can then be used for symmetric encryption of messages.

What is the importance of the public key in preventing MITM attacks?

To prevent Man-in-the-Middle (MITM) attacks, the sender must sign the message, and the recipient needs the sender's public key to verify the signature.

What is the role of the private key in digital signatures?

The sender uses their private key to encrypt the information, ensuring authenticity, while the recipient uses the sender’s public key to decrypt it and verify the message.

What is user authentication?

User authentication is the process of determining the identity of someone or something. It involves two functions: identification (where a user presents a credential) and verification (where the system checks the presented information).

What are the four general means of user authentication?

The four general means of user authentication are:

1. Something the individual knows (e.g., passwords)
2. Something the individual possesses (e.g., tokens)
3. Something the individual is (e.g., static biometrics)
4. Something the individual does (e.g., dynamic biometrics)

What is password-based authentication?

Password-based authentication is a widely used method where the user provides a username and password, and the system compares the password to a previously stored password to authenticate the user.

What are some drawbacks of passwords?

Drawbacks of passwords include predictability, password reuse, and data breaches.

What is token-based authentication?

Token-based authentication involves using a physical object, like a memory or smart card, that the user possesses to authenticate themselves. Tokens can involve static, dynamic, or challenge-response protocols.

What are the drawbacks of token-based authentication?

Drawbacks of token-based authentication include the need for special readers, token loss (which can temporarily prevent access or lead to unauthorized access if stolen), and potential user dissatisfaction with the process.

What is biometric authentication?

Biometric authentication relies on unique physical characteristics, such as fingerprints, facial recognition, or voiceprints, to authenticate a user. It uses pattern recognition algorithms to compare the presented characteristic with stored data.

What are the drawbacks of biometric authentication?

Drawbacks of biometric authentication include false match (false positive), where an imposter is authenticated, and false nonmatch (false negative), where a genuine user is not authenticated.

What is remote user authentication and how does it work?

Remote user authentication raises additional threats such as eavesdropping and hijacking. Typically, challenge-response protocols are used, where one party sends a challenge, and the other responds with a calculated value.

What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) requires a user to present two or more pieces of evidence (factors) for authentication. Two-factor authentication (2FA) is a common example, such as using a bank card and PIN for an ATM transaction.

What are some common password cracking techniques?

Password cracking techniques include brute force attacks (which try all combinations), online dictionary attacks (which use precompiled lists of likely passwords), and offline dictionary attacks (which target password hashes).

What is a brute force attack?

A brute force attack is an exhaustive search where all possible password combinations are tried. The attack's complexity depends on the password space (characters and length).

What are the costs associated with brute force attacks?

Brute force attacks are computationally expensive, especially for longer passwords, and require significant processing power depending on the character set and password length.

What is an online dictionary attack?

An online dictionary attack intelligently searches for passwords by trying combinations related to the user or common words, such as names or popular passwords.

What are countermeasures against password cracking?

Countermeasures include enforcing strong password policies (length, complexity), using machine-generated passwords, changing passwords regularly, lockout mechanisms, throttling, monitoring login attempts, and password blacklisting.

What is an offline dictionary attack?

An offline dictionary attack occurs when an attacker gains access to a system's password file, allowing them to hash and compare the stored password hashes with a dictionary of common passwords.

What is a hash in password storage?

A hash is a non-reversible, fixed-size function that generates a unique value from the input (like a password). It is used in password storage to avoid saving plain text passwords.

What is a rainbow table in password cracking?

A rainbow table is a precomputed table that links plaintext passwords to their corresponding hash values. It is used to speed up the cracking process by reducing time complexity compared to brute-force attacks.

What is password salting?

Password salting involves adding a random string (salt) to a password before hashing it. This ensures that identical passwords produce different hash values and increases the difficulty of offline dictionary attacks.

What are the benefits of password salting?

The benefits of password salting include preventing duplicate passwords from having the same hash and making offline dictionary attacks more difficult by introducing randomness.

What is John the Ripper (JTR)?

John the Ripper (JTR) is a fast password cracker used for cracking weak passwords, supporting many hash types, including crypt(3), LM hashes, and more.

What is Crackstation?

Crackstation is an online tool that provides access to over 100TB of precomputed hashes to speed up password cracking.

What is RainbowCrack?

RainbowCrack is a tool used for cracking hashes using precomputed rainbow tables. It computes hashes on the fly and compares them with target hashes to identify the plaintext password.

What are other password cracking tools?

Other password cracking tools include Cane and Able (brute-force, dictionary, rainbow table cracking), Ophcrack (uses rainbow tables), Hydra (brute-forcing online services), L0phtcrack (extracts and sniffs hashes), and Pwdump (extracts hashes from Windows SAM)