Computer Science Homework Help

Review Questions

1.3 List and briefly define categories of passive and active network security attacks.

1.5 Explain the difference between an attack surface and an attack tree.

Problems

1.3 Consider a desktop publishing system used to produce documents for variousorganizations.

a. Give an example of a type of publication for which confidentiality of the stored datais the most important requirement.

b. Give an example of a type of publication in which data integrity is the most importantrequirement.

c. Give an example in which system availability is the most important requirement.

1.5 Consider the following general code for allowing access to a resource:

DWORD dwRet = IsAccessAllowed(…);if (dwRet == ERROR_ACCESS_DENIED) {// Security check failed.// Inform user that access is denied.} else {// Security check OK.}

a. Explain the security flaw in this program.

b. Rewrite the code to avoid the flaw.

1.7 Consider a company whose operations are housed in two buildings on the sameproperty: one building is headquarters, the other building contains network and computerservices. The property is physically protected by a fence around the perimeter. The onlyentrance to the property is through a guarded front gate. The local networks are splitbetween the Headquarters’ LAN and the Network Services’ LAN. Internet users connect tothe Web server through a firewall. Dial-up users get access to a particular server on theNetwork Services’ LAN. Develop an attack tree in which the root node representsdisclosure of proprietary secrets. Include physical, social engineering, and technicalattacks. The tree may contain both AND and OR nodes. Develop a tree that has at least15 leaf nodes.