CIS4360 Intro to Computer Security: Midterm 1
Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity.
Integrity
Combined one byte at a time with the plaintext stream using the XOR operation, a __________ is the output of the pseudorandom bit generator.
Keystream
An example of __________is an attempt by an unauthorized user to gain access to a system by posing as an authorized user.
Masquerade
An unauthorized entity gains access to a system or performs a malicious act by posing as an authorized user
Masquerade
__________is a procedure that allows communicating parties to verify that received or stored messages are authentic.
Message Authentication
_________ assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed.
Privacy
Digital signatures and key management are the two most important applications of ________ encryption.
Public-Key
A _____assessment is periodically assessing the risk to organizational operations, organizational assets, and individuals, resulting from the operation of organizational information systems and the associated processing, storage, or transmission or organizational information.
Risk
A _______is any action that compromises the security of information owned by an organization.
Security Attack
A set of rules and practices that specify or regulate how a system or organization provides security services to protect sensitive and critical system resources
Security Policy
A _____________ processes the input elements continuously, producing output one element at a time.
Stream cipher
Also referred to as single-key encryption, the universal technique for providing confidentiality for transmitted or stored data is _______
Symmetric Encryption
Data contained in an information system; or a service provided by a system; or a system capability; a facility tat houses system operations and equipment
System Resource (Asset)
_____________is the insertion of bits into gaps in a data stream to frustrate traffic analysis attempts.
Traffic Padding
A message authentication code is a small block of data generated by a secret key and appended to a message.
True
Attacks are threats carried out
True
Brute-force attacks try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
True
Computer Security is essentially a battle of wits between a perpetrator who tries to find holes and the administrator who tries to close them.
True
Computer security is a protection of the integrity, availability and confidentiality of information system resources
True
In the context of security our concern is with the vulnerabilities of system resources.
True
Many security administrators view strong security as an impediment to efficient and user-friendly operation of an information system.
True
Symmetric encryption is used primarily to provide confidentiality
True
System Availability assures that systems work promptly and service is not denied to authorized users
True
The advantage of a stream cipher is that it is faster than block ciphers.
True
The first step in devising security services and mechanisms is to develop a security policy.
True
The secret key is input to the encryption algorithm.
True
X.800 architecture was developed as an international standard and focuses on security in the context of networks and communications.
True
IF the only form of attack that could be made on an encryption algorithm is brute-force, then the way to counter such attacks would be to
Use Longer Keys
A circumstance that results in control of system services or functions by an unauthorized entity.
Usurpation
Replay, masquerade, modification of messages, and denial of service are example of
active attacks
A _______is a threat that is carried out and, if successful, leads to an undesirable violation of security, or threat consequence.
attack
An assault on system security that derives from an intelligent act that is a deliberate attempt to evade security services and violate the security policy of a system is a
attack
A loss of _____ is the unauthorized disclosure of information
confidentiality
A ____________is any means taken to deal with a security attack
countermeasure
A _________ attack attempts to disable a user authentication service by flooding the service with numerous authentication attempts.
denial-of-service
The assets of a computer system can be categorized as (4 things)
hardware, software, communication lines and networks, and data.
A ______ is an attempt to learn or make use of information from the system that does not affect system resources.
passive attack
Release of message contents and traffic analysis are two types of
passive attacks
Security implementation involves four complementary courses of action:
prevention, detection, response, and recovery
A _________ stream is one that is unpredictable without knowledge of the input key and which has an apparently random character.
pseudorandom
In public key encryption, the __________ is a pair of keys that have been selected so that if one is used for encryption, the other is used for decryption.
public and private key
The OSI security architecture focuses on (3 things)
security attacks, mechanisms, and services
A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy is
vulnerability
DES takes a plaintext block of 64 bits and a key of ______ bits to produce a ciphertext block of 64 bits.
56
-The security goal that generates the requirement for actions of an entity to be traced uniquely to that entity - Systems must keep records of their activities to permit later forensic analysis to trace security breaches or to aid in transaction disputes
Accountability
verifying that users are who they say they are each input arriving at the system came from a trusted source
Authenticity (under Integrity)
A loss of __________ is the disruption of access to or use of information or an information system.
Availability
ensuring timely and reliable access to and use of information
Availability
A _________ is to try every possible key on a piece of ciphertext until an intelligible translation into plaintext is obtained.
Brute-Force Attack
______ is the scrambled message produced as output
Ciphertext
Messages are destroyed/deleted/read/ modified/delayed/recorded/duplicated fabricated
Communication Lines Threat
__________is the protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources.
Computer security
Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
Confidentiality
Vulnerabilities (3 types)
Corrupted (loss of Integrity) Leaky (loss of confidentiality) Unavailable or slow (loss of availability)
A __________ attack exploits the characteristics of the algorithm to attempt to deduce a specific plaintext or to deduce the key being used.
Cryptanalytic
The most important symmetric algorithms, all of which are block ciphers, are (3 of them)
DES (Data encryption standard), Triple DES, and AES (Advancted encryption standard)
The assurance that data received are exactly as sent by an authorized entity is
Data Integrity
Files are deleted, unauthorized analysis or reading is performed.
Data threat
The _______ algorithm takes the ciphertext and the secret key and produces the original plaintext.
Decryption
The __________prevents or inhibits the normal use or management of communications facilities.
Denial Of Service
attempts to disable a user authentication service by flooding the service with numerous authentication attempts
Denial-of-Service
(Contingency planning) is a functional area that primarily requires computer security technical measures.
FALSE access control; identification & authentication; system & communication protection; and system & information integrity functional areas that primarily require management controls and procedures include: awareness & training; audit & accountability; certification, accreditation, & security assessments; CONTINGENCY PLANNING; maintenance; physical & environmental protection; planning; personnel security; risk assessment; and systems & services acquisition
Privacy ensures that information and programs are changed only in a specified and authorized manner.
False (Confidentiality)
On average, _____ of all possible keys must be tried in order to achieve success with a brute-force attack.
Half