1) Describe two distinct types of attack against password systems and the countermeasures against eachof those attacks.2) Describe two general "good practices in coding". For each of them explain why they are appropriateand give an example of what could go wrong if that practice is not followed.3) A company has two departments, A and B, and has determined that it is appropriate to have two levelsof sensitivity, in increasing order: 0 and 1. Draw a BLP lattice system to represent this scenario. Usingexamples referring to this lattice, explain the three BLP rules, 2 mandatory and 1 discretionary.4) Explain what tailored attacks are. Give some specific examples in two different domains and explainhow they perform relative to other attacks in those domains.

As you have posted multiple questions and that too are not interlinked. So it will be considered as…

Answered: 1) Describe two distinct types of…

1) Describe two distinct types of attack against password systems and the countermeasures against each of those attacks.

Management Of Information Security

6th Edition

ISBN:9781337405713

Author:WHITMAN, Michael.

Publisher:WHITMAN, Michael.

Chapter10: Planning For Contingencies

Section: Chapter Questions

Problem 1EDM

See similar textbooks

Similar questions

Denial of Service attacks are estimated to happen once every six months (twice a year) in a mid-size company. One such company, XYZ, estimates the cost of recovering from a single DoS attack to be $12000. The company decides to apply a number of controls to counter these attacks. With these controls, the frequency of successful DoS attacks against the company reduces to once a year and the cost of recovering from an instance becomes $8000. The cost of implementing these controls is $7,000 a year. The annual loss expectancy (ALE) without controls is $ A . The annual loss expectancy (ALE) with controls is $
Denial of Service attacks are estimated to happen once every six months (twice a year) in a mid-size company. One such company, XYZ, estimates the cost of recovering from a single DoS attack to be $12000. The company decides to apply a number of controls to counter these attacks. With these controls, the frequency of successful DoS attacks against the company reduces to once a year and the cost of recovering from an instance becomes $8000. The cost of implementing these controls is $7,000 a year. From a purely financial point of view, is it worth for the company to implement these controls? Calculate the prior and post ALE and do a cost-benefit analysis to answer the question. In your answer make sure that you indicate what ARO, SLE and ALE are with and without controls. State clearly whether the company should implement the controls and explain why.
Scenario 2 An organization dedicated to reducing spam tries to get Internet service providers (ISPS) in an East Asian country to stop the spammers by protecting their mail servers. When this effort is unsuccessful, the anti-spam organization puts the addresses of these ISPS on its "black list." Many ISPS in the United States consult the black list and refuse to accept email from the blacklisted ISPS. This action has two results. First, the amount of spam received by the typical email user in the United States drops by 25 percent. Second, tens of thousands of innocent computer users in the East Asian country are unable to send email to friends and business associates in the United States. Questions 1. Did the anti-spam organization do anything wrong? 2. Did the ISPS that refused to accept email from the black listed ISPS do anything wrong? 3. Who benefited from the organization's action? 4. Who was hurt by the organization's action? 5. Could the organization have achieved its goals…
First, argue for the best information security practice, whether a block cipher or stream cipher should be used to encrypt a video data file sent through the internet as part of a major, successful entertainment service. The entertainment company has a large market share, and ample resources. Secondly, argue for the most secure choice of which kind of cipher should be used for the authentication exchange between the user and the entertainment service web portal. The entertainment service is expensive to the customer, and users are wary of the misuse of their accounts. Consider the nature of the traffic and its pattern, and the nature of the keys to use.
3. Access control is one of the security approaches that enable an organization to restrict access of its group of users to information or tangible assets. a) Explain any TWO (2) the importance of access control implementation in an organization. b) Describe THREE (3) principles required to apply the access control. c) By considering Uniec Campus System, why a different group of users such as student and lecturer are assigned with different access rights to the same information such as coursework?
Denial of Service attacks are estimated to happen once every six months (twice a year) in a mid-size company. One such company, XYZ, estimates the cost of recovering from a single DoS attack to be $10,000. The company decides to apply a number of controls to counter these attacks. With these controls, the frequency of successful DoS attacks against the company reduces to once a year and the cost of recovering from an instance becomes $6,000. The cost of implementing these controls is $12,000 a year. From a purely financial point of view, is it worth for the company to implement these controls? O None of the these Yes, because the measures will save the company $2,000. ONo, because the measures will cost the company $2,000. No, because the measures will cost the company $4,000. Yes, because the measures will save the company save $14,000.
Provide an example of a situation in which one of the four different methods of access control may be put into practice. What makes this choice different from the others that are available in this category?
Question: Consider an automated teller machine (ATM) in which users provide a personal identification number (PIN) and a card for account access. Give examples of confidentiality, integrity, and availability requirements associated with the system and, in each case, indicate the degree of importance of the requirement.(Every aspect (degree of importance, examples etc) need to be addressed)
Prepare a power point presentation (PPT) to describe the security vulnerabilities in ATM (automated teller machine) usage that affects a number of small to mid-size ATM card issuers. These vulnerabilities provides a useful case study illustrating that cryptographic functions and services alone do not guarantee security; they must be properly implemented as part of a system. And Explain how these vulnerabilities can be removed. Note: At the end of Chapter 3 you can find useful information related to the topic Case Study: “ ATM Security Problems”
One common description of the security issue (from the perspective of the defender) is the preservation of the confidentiality, integrity, and availability of data (and services). From the attacker's point of view, it is possible to conceive about interruption, interception, modification, and creation in many ways. Is there any relationship between the last four ideas and the first three concepts mentioned? Is there a match-up between any of the four and any of the other three players? If so, does one or more of the four include at least one of the three? Is there anything that comes within the purview of one formulation but not the other, and vice versa? Which framework is more advantageous, and why is this so?
Two new computer codes are being developed to prevent unauthorizedaccess to classified information. The first consists of six digits (each chosenfrom 0 to 9); the second consists of three digits (from 0 to 9) followed by twoletters (A to Z, excluding I and O).(i) Which code is better at preventing unauthorized access (defined as breaking the code in one attempt)?(ii) If both codes are implemented, the first followed by the second, what isprobability of gaining access in a single attempt?
Consider the threat of "theft/breach of proprietary or confidential information held in key data files on the system." One method by which such a breach might occur is the accidental/deliberate e-mailing of information to a user outside to the organization. A possible countermeasure to this is to require all external e-mail to be given a sensitivity tag (classification if you like) in its subject and for external e-mail to have the lowest sensitivity tag. Discuss how this measure could be implemented in a firewall and what components and architecture would be needed to do this.