Information Security

Exercises
Problem 01:
 What is the difference between passive and active security threats?

Solution:
 Passive attacks have to do with eavesdropping on, or monitoring,
transmissions. Electronic mail, file transfers, and client/server exchanges
are examples of transmissions that can be monitored.

 Active attacks include the modification of transmitted data and attempts to

2
Problem 02:
 List and briefly define some categories of passive and active network
security attacks

Solution:
 Passive attacks:
 release of message contents and traffic analysis.

 Active attacks:
 masquerade, replay, modification of messages, and denial of service.

3
Problem 03:
 Consider an automated teller machine (ATM) in which users provide a
personal identification number (PIN) and a card for account access. Give
examples of confidentiality, integrity, and availability requirements
associated with the system and, in each case, indicate the degree of
importance of the requirement.

Solution:
 The system must keep personal identification numbers confidential, both
in the host system and during transmission for a transaction.
 It must protect the integrity of account records and of individual
transactions.
 Availability of the host system is important to the economic well being of
the bank, but not to its fiduciary responsibility.
 The availability of individual teller machines is of less concern.

4
Problem 04:
 Repeat Problem 03 for a telephone switching system that routes calls
through a switching network based on the telephone number requested by
the caller.

Solution:
 The system does not have high requirements for integrity on individual
transactions, as lasting damage will not be incurred by occasionally losing
a call or billing record.
 The integrity of control programs and configuration records, however, is
critical. Without these, the switching function would be defeated and the
most important attribute of all - availability - would be compromised.
 A telephone switching system must also preserve the confidentiality of
individual calls, preventing one caller from overhearing another.

5
Problem 05:
 Consider a desktop publishing system used to produce documents for
various organizations.
a. Give an example of a type of publication for which confidentiality of the stored
data is the most important requirement.
b. Give an example of a type of publication in which data integrity is the most
important requirement.
c. Give an example in which system availability is the most important requirement

Solution:
a. The system will have to assure confidentiality if it is being used to publish
corporate proprietary
b. The system will have to assure integrity if it is being used to laws or
regulations.
c. The system will have to assure availability if it is being used to publish a daily
paper.

6
Problem 06:
 For each of the following assets, assign a low, moderate, or high impact
level for the loss of confidentiality, availability, and integrity, respectively.
Justify your answers.
a. An organization managing public information on its Web server.
b. A law enforcement organization managing extremely sensitive investigative
information.
Solution
a. An organization managing public information on its web server determines that
 there is no potential impact from a loss of confidentiality (i.e., confidentiality
requirements are not applicable),
 a moderate potential impact from a loss of integrity,
 and a moderate potential impact from a loss of availability.
b. A law enforcement organization managing extremely sensitive investigative
information determines that the potential impact from
 loss of confidentiality is high,
 the potential impact from a loss of integrity is moderate, and
 the potential impact from a loss of availability is moderate.

7
Problem 06:
 For each of the following assets, assign a low, moderate, or high impact
level for the loss of confidentiality, availability, and integrity, respectively.
Justify your answers.
c. A financial organization managing routine administrative information (not
privacy related information).

Solution
c. A financial organization managing routine administrative information (not
privacy-related information) determines that
 the potential impact from a loss of confidentiality is low,
 the potential impact from a loss of integrity is low, and
 the potential impact from a loss of availability is low.

8
Problem 07:
 Consider the following general code for allowing access to a resource:

a. Explain the security flaw in this program.

9
Problem 07:
b. Rewrite the code to avoid the flaw
Solution:

b. In this case, if the call to IsAccessAllowed fails for any reason, the user is
denied access to the privileged operation

10