(Chapter 1)

What are the three decision making strategies?

1. Rule based decisions - follow a rule
2. Relativistic decisions - copy others
3. Rational - looks at risks and chooses measures accordingly

(Chapter 1)

What are the six phases of the security process?

1. Identify the assets
2. Analyze the risks of attack
3. Establish your security policy
4. Implement your defenses
5. Monitor your defenses
6. Recover from attacks

(Chapter 1)

Assets are protected by a ___

boundary

(Chapter 1)

Openings in the boundary are ___ 

vulnerabilities

(Chapter 1)

A ___ tries to attack assets

threat agent, attacker

(Chapter 1)

A ___ protects the assets.

defense, safeguard, countermeasure

(Chapter 1)

What is CIA?

confidentiality, integrity, availability

(Chapter 1)

What are the 5 recognized services that security mechanisms might provide?

1. confidentiality
2. integrity
3. availability
4. authentication
5. nonrepudiation

(Chapter 1)

All attacks fall into which 6 categories?

1. physical theft
2. denial of service
3. subversion
4. masquerade
5. disclosure
6. forgery

(Chapter 1)

What are the pros and cons of responsible disclosure?

Pro: gives vendors an opportunity to release a patch 

before making the vulnerability public

Con: vendors may not act promptly

(Chapter 1)

What are the pros and cons of full disclosure?

Pro: May result in faster response times from vendors

Con: May inform malicious parties of vulnerabilities 

before they are patched

(Chapter 2)

What is a buffer overflow attack?

it is when an attacker provides input that exceeds the buffer length

(Chapter 2)

What is shellcode?

It is the name applied to malicious code that 

allows an attacker to issue further commands

(Chapter 2)

What is a sled attack?

It is a sequence of instructions responsible for directing the flow of control towards the core code of a buffer overflow attack.

(Chapter 2)

What is No-Op?

Machine instruction that does nothing except move to the next instruction

(Chapter 2)

What is a trampoline sled?

instead of a sliding along no-ops, this sled contains control transfer instructions all pointing directly to the shellcode

(Chapter 2)

What is Return-to-libc attack?

Overwrites return address with a call to the desired library function.

(Chapter 2)

What is a Canary?

It is a value placed between a buffer and control data.

(Chapter 2)

What is Point-Guard?

It adds code which XOR-encodes pointers (including return address) before and after they are used.

(Chapter 2)

What is Address Space Layout Randomization (ASLR)?

It randomly rearranges the data of a process's address space making it extremely difficult to predict where to jump in order to execute code.

(Chapter 2)

What is a heap?

It is a portion of memory allocated dynamically for use by the program

(Chapter 2)

What is a memory leak?

It is memory allocated on the heap that 

was not explicitly deallocated (freed)

(Chapter 2)

What does data execution prevention do?

It only executes instructions in a control section

(Chapter 2)

What are the 4 main strategies to control access?

1. Islands
2. Vaults
3. Puzzles
4. Patterns

(Chapter 2)

What are the 3 main categories of controls?

Preventative, detective, and corrective

(Chapter 2)

What are the 6 classifications of security controls?

1. physical - e.g. walls
2. mechanical - protection that changes by mechanical intervention
3. logical- protection controlled by a structured set of rules or configuration data
4. functional - protection via the design and operation of functions in the system
5. procedural - protection from compliance with explicitly defined operation procedures
6. cryptographic -  protection based on transformation of the data using cryptographic techniques

(Chapter 3)

What is CRUD?

Create, Read, Update, Delete permissions

(Chapter 3)

What is the difference between global and tailored policies?

Global is applied to all users by defualt and tailored is for specific sets of files

(Chapter 3)

What is the difference between Deny by Default and Default Permit policy?

Deny by Defaut provides no access to anyone unless specifically granted while Default Permit provides permission for everything except for what is specifically prohibited.

(Chapter 3)

What is Cluster by columnn?

(Chapter 3)

What is Cluster by Row?

(Chapter 3)

What is a state diagram?

(Chapter 3)

What are the three information states?

Storage, processing, and transmission

(Chapter 3)

What is Window of Vulnerability?

It is the time during which an exploit exists but computers aren't patched.

(Chapter 4)

How do user groups work?

Each file has a set of group access rights, and the ID 

of an established group of users

(Chapter 4)

Traditional Unix uses ___ ___ ___ to indicate access rights.

file permission flags

(Chapter 4)

What are the three sets of RWX flags?

user, group, and other

(Chapter 4)

What is the best general approach for building effective ACLs?

Deny by Default

(Chapter 4)

In Windows, creating or copying a new file: the file ___ access rights from the 

enclosing folder

inherits 

(Chapter 4)

When moving a file or folder, it ___ its ACL but ___ the inheritence relationship from its previous location and ___ from the new location

retains, breaks, does NOT inherit

(Chapter 4)

What is transitive trust?

– If we trust Program 1, and it trusts Program 2, then we are also trusting Program 2

– If we run a program, then we trust its author

(Chapter 4)

What are ANSI X-standards?

Used by the banking industry to protect electronic funds 

transfers

(Chapter 4)

What is PCI-DSS? 

Used by “Payment Card Industry” to protect credit card 

transactions

(Chapter 4)

Family of international standards for security system 

quality improvement

(Chapter 5)

remediation

(Chapter 5)

digital forensics

(Chapter 5)

The notion that there are customary acts that

parties take for safety and security

Parties are less at fault if they show due diligence

in their actions

(Chapter 5)

Risk assessment, policy, or implementation

(Chapter 6)

1. Something you know - password or PIN
2. Something you have - key or token
3. Something you are - personal trait

(Chapter 6)

It is a checksum on a message this is either 

– One-way: It should be easy to compute Y=h(M), but hard to find

M given only Y

– Collision-resistant: It should be hard to find two messages, M

and N, such that h(M)=h(N)

(Chapter 6)

– ATM authentication: ATM card + PIN

– Biometric laptop: Fingerprint + password

– NOT: Password + PIN

(Chapter 6)

– UPPER/lower case characters

– Special characters

– Numbers

(Chapter 6)

List the strengths of the different password complexities. 

• Numbers: 1,000,000
• UPPER or lower case characters: 308,915,776
• UPPER and lower case characters: 19,770,609,664
• 32 special characters (&, %, $, £, “, |, ^, §, etc.) = 1,073,741,824

(Chapter 6)

– A = number of possible characters that can be in the

password

– L = length of the password

(Chapter 6)

A password attact that tries every possible character combination

(Chapter 6)

– Uses a list of likely passwords as the password space

– There are far fewer likely passwords than possible

passwords

(Chapter 6)

Uses random bits as part of the input to a hash function or encryption algorithm to increase the randomness of the output

(Chapter 6)

What the benefits of authentication tokens?

– Hard to attack - uses a stronger secret than in a typical password

– Hard to forge - must hack the hardware

– Hard to share – secret stored in hardware

(Chapter 6)

– Expensive - must buy hardware and/or special authentication software

– Can be lost or stolen

– Risk of hardware failure

(Chapter 6)

Stores an unchanging credential

(Chapter 6)

Stores a secret that generates a different credential for

each login

(Chapter 6)

An exchange of data to yield a shared result

(Chapter 6)

– Data collection may be intrusive or difficult in some environments

– Privacy issues may exist

– Some changes in characteristics may occur

– Overall, most have an uncomfortable level of false positives and

false negative

(Chapter 6)

Likelihood of incorrectly authenticating someone as an

authorized user

(Chapter 6)

Likelihood of incorrectly rejecting someone as an

unauthorized user. Can lead to a denial of service

(Chapter 6)

• Clone or borrow credential – often

– Demonstrated many times with fingerprints, faces, voices, etc.

• Sniff the credential and replay – often

– Possible in networked and remote systems

• Trial and error guessing – slight

– Requires a team of attackers

• Denial of service – possible

• Retrieve from backup – possible

– Attacker intercepts credential pattern database

(Chapter 7)

a cryptographic technique

(Chapter 7)

– Plaintext data

– Encryption key

(Chapter 7)

text letters of the message remain in the same order, but individual letters are substituted with others according to the key

(Chapter 7)

What is symmetric encryption?

sender and recipient must share a secret key

(Chapter 7)

What is the Caesar cipher? 

– Replace each letter in a text by the 3rd letter following it in the alphabet:

– ABCD becomes DEFG; CAT becomes FDW

– Variations rotate by different amounts

(Chapter 7)

– Uses a series of different rotations

– Uses a block of shift keys, (k1, k2, . . . , kn), to encrypt a plaintext, M, of length n, with each shift key being chosen in order

– There are potentially m different substitutions for any given letter

– Decryption is done by performing reverse shifts

– Can be easily broken using statistical techniques if the

ciphertext is long enough relative to the value of m

(Chapter 7)

– Uses a block of shift keys, (k1, k2, . . . , kn), to encrypt a plaintext, M, of length n, with each shift key being chosen uniformly at random

– The length m of the block of keys must be the same as the length n of the plaintext

– Since each shift is random, every ciphertext is equally likely for any plaintext

(Chapter 7)

– If a and b are different: a ⊕ b = 1

– If a and b are the same: a ⊕ b = 0

(Chapter 7)

readable data

(Chapter 7)

unreadable data

(Chapter 7)

secret information

(Chapter 7)

rearranges the text of the message through a systematic process

(Chapter 1)

What are the 6 general types of attacks on information?

1. physical theft
2. denial of service (DOS) - preventing access to a service
3. subversion - modifying a program to work for an attacker
4. masquerade - pretend to be an authorized user
5. disclosure - revealing confidential information
6. forgery - bogus message sent to a computer

(Chapter 1)

What are the concepts of least privilege?

• Restrict what people may do to an asset

• Provide the minimum privileges required

• Example: key opens my suite but not yours

(Chapter 1)

What are the concepts of confidentiality?

– Keeping information secret

– Avoiding disclosure vulnerabilities

(Chapter 1)

– Protecting information from improper changes

– Avoiding forgery, subversion, and masquerade

attacks

(Chapter 1)

– Keeping systems available and in operation

– Avoiding Denial of Service (DoS) attacks

(Chapter 2)

1. islands
2. vaults
3. puzzles
4. patterns

(Chapter 2)

• On an island, we can only touch what is there

– Everything else is brought from elsewhere

• A process can execute its instructions in RAM and 

modify variables in RAM

– It can only use resources brought into its RAM

– It can’t access anything else

• We restrict a process by not allowing it access to 

resources

• This approach is called isolation and mediation

(Chapter 2)

• We can retrieve things from the vault only if allowed

– Someone/something restricts access

– Least Privilege: we only have access to some items

• A bank safe deposit box – we have the key

– The banker lets us retrieve the box

– We can modify the box contents

– We can’t retrieve or modify any other boxes

• Computer access control – a process can retrieve a 

file or print data if granted the right permissions

(Chapter 2)

• Protect data by presenting a puzzle

– Authorized users know the puzzle’s answer

• Security Through Obscurity (STO)

– A weak puzzle, like protecting data by hiding it

– Invariably, this approach will fail

• Strong puzzles use Cryptography (“crypto”)

– Mathematical techniques to hide or protect data

– Quality cryptography is very hard to break

• Weak cryptography is simply a form of STO

(Chapter 2)

• Make decisions based on similarities

• Photo IDs – guard compares face against poor photo

– Photos are often laughably inaccurate

• Anti-virus software

– Searches computer for patterns found in viruses

– Must be updated continuously for new viruses

• Biometrics – fingerprint readers, for example

– Compare reading against a stored pattern

• Problems: false positives and false negatives

(Chapter 2)

A software program that exploits a computer vulnerability and copies itself across a network is an example of a/an ___

a. Trojan

b. drive by download

c. virus

d. worm

d. worm

(Chapter 2)

(True or False)

Steganography is a type of vault computer based access control. 

False

Steganography is a puzzle

(Chapter 2)

c. buffer overflow attack

(Chapter 2)

True

(Chapter 2)

True

(Chapter 2)

b. pattern

(Chapter 2)

puzzle

(Chapter 2)

a. report the status of individual computer users

(Chapter 2)

d. drive by download 

(Chapter 2)

d. has no software patch 

(Chapter 4)

When collecting digital evidence from a crime scene, often the best strategy for dealing with a computer that is powered on is to ___

a. remove the hard drive

b. transport it while running

c. perform a clean shutdown

d. unplug it

d. unplug it

(Chapter 4)

a. all of these

(Chapter 4)

d. all of these

(Chapter 4)

c. if a file is moved to a different folder on the same hard drive, it will inherit the access rights of the new parent folder

(Chapter 4)

b. deny permissions

(Chapter 4)

(True or False)

?

(Chapter 4)

True

(Chapter 4)

False, doing anything to the hard drive may change information

(Chapter 4)

?

(Chapter 4)

True

(Chapter 4)

c. remediation

(Chapter 6)

What are the 4 token vulnerabilities?

1. clone or borrow credential
2. sniffing and trial and error guessing
3. denial of service
4. retreive from backup

(Chapter 6)

What is a one time password token?

An active token that transmits different credentials based on an internal clock or counter

(Chapter 6)

(True or False)

a dictionary attack on passwords uses every possible character combination

False, a dictionary attack uses a dicionary of likely passwords (pg 252)

(Chapter 6)

you are using a one way cryptographic hash function to encrypt two messages. In order to be described as ___, the hash function should provide different output for the two messages

a. randomly generating

b. collision resistant

c. collision free

d. unique

b. collision resistant

(Chapter 6)

(True or False)

when selecting a password, random collections of letters contain far more entropy than English words

True

(Chapter 6)

an authentication system that requires the user to provide two different passwords and a fingerprint scan is an example of ___

a. mixed mode authentication

b. three factor authentication

c. two factor authentication

d. single factor authentication

c. two factor authentication (password and fingerprint are two different types of authentication: something you know and something you are)

(Chapter 6)

(True or False)

Challenge response authentication relies on a shared secret

True, the calculation relies on a shared secret (slide)

(Chapter 6)

(True or False)

a brute force password cracking attempt uses every possible English word as its search space

False, brute force tries every possible character combination (slides)

(Chapter 6)

When attempting to use a computer system, which occurs first?

a. authorization

b. authentication

c. access control

b. authentication

(Chapter 6)

attacking the easiest targets is referred to as ___

a. doorknow rattling

b. footprinting the system

c. grabbing the low hanging fruit

d. reducing the search space

c. grabbing the low hanging fruit (pg 236)

(Chapter 6)

which of the following has the most entropy?

a. random character combinations containing all possible characters

b. random character combinations containing only letters

c. English words

d. Spanish words

a. random character combinations containing all possible characters

(Chapter 6)

which type of change will improve the strength of a password most significantly?

a. an increase in the set of possible characters that can be used

b. an increase in the length of the password

c. the inclusion of special characters such as %$@!

d. the use of real English words

b. an increase in the length of the password

(Chapter 6)

in a password system, the total number of possible passwords is called the ___

a. heap size

b. search space

c. complexity strength

d. hash space

b. search space (pg 247)

(Chapter 6)

(True or False)

A garage door opener transmits the same code each time you use it

False, a garage door opener uses a hopping or rolling code which creates a pseudo random number (slides)

(Chapter 6)

(True or False)

Entropy refers to the strength of a password system

False. Entropy refers to the uncertainty in the value of a data item (pg 253)

(Chapter 6)

all of the following are fundamental strategies for authenticating people on computer systems except ___

a. something you are

b. something you make

c. something you know

d. something you possess

a. Incorrect - something you are (pg 231)

b. Correct - something you make

c. Incorrect - something you know (pg 231)

d. Incorrect - something you possess (pg 231)

(Chapter 6)

(True or False)

When you are biased in selecting a password, you choose your password from the entire search space

False. When people are biased in their password selection, they choose passwords from only part of the total possible search space. (pg 254)

(Chapter 7) 

Given the following binary values

PLAINTEXT 1011

Key Stream 0110

Using XOR, the resulting ciphertext would be ___

a. 0010

b. 0101

c. 1101

d. 1001

c. 1101, it produces a '0' when the data match and a '1' when the data differs (pg 300)

(Chapter 7) 

if a cryptoanalyst can select plaintext to be encrypted with the target's secret key, what technique is he using?

a. chosen plaintext

b. known ciphertext

c. known plaintext

a. chosen plaintext, the analyst can celect plaintext to be encrypted with the target's secret key (pg 295)

(Chapter 7) 

A cipher which retains the original characters of the message but rearranges them is referred to as ___

a. assymetric encryption

b. substituion cipher

c. transposition cipher

d. symmetric encryption

c. Correct - transposition cipher, we rearrange the text of the message (pg 289)

d. Incorrect - substitution cipher, the text letters remain in the same order, but individual letters are substituted  with others, according to the key (pg 289)

(Chapter 7) 

(True or False)

The Enigma machine was an encryption device used by the US and the UK during World War II

False, Enigma, a rotor machine used by Germany during World War II (pg 297)

(Chapter 7) 

You are creating an encryption procedure. You replace each letter in a message with a letter that appears 5 places to the left of the original letter. What type of process is this?

a. symmetric encryption

b. Vigenere cipher

c. assymetric encryption

d. substitution cipher

b. Incorrect (this uses a series of shifts) - Vigenere cipher, uses a series of shifts to encrypt each letter differently. (pg 294)

d. Correct (this uses a shift of 5 places to the left)- substitution cipher, the text letters remain in the same order, but individual letters are substituted  with others, according to the key (pg 289)

(Chapter 7) 

If a cryptoanalyst has only ciphertext to work with, what technique is he using?

a. chosen plaintext

b. known plaintext

c. known ciphertext

c. known ciphertext. The analyst works exclusively from the ciphertext (pg 295)

(Chapter 7) 

Which type of cipher is unbreakable if not reused?

a. one time pad

b. substititution cipher

c. exclusive or cipher

d. Caesar cipher

a. one time pad. When properly used, it is mathematically impossible to crack a message encrypted by a one time pad (pg 306)

(Chapter 7) 

(True or False)

The Vigenere cipher uses a series of shifts to encrypt each letter in a message

True, we use a series of shifts and we encrypt each letter differently with each shift. (pg 294)

(Chapter 7)

(True or False) 

Kerckhoff's principle effectively says that the security of a cryptosystem should depend only on the secrecy of the key.

True, the secrecy of our plaintext relies entirely on the secrecy of the key (pg 288)

(Chapter 8)

Which of the following statements is correct?

a. When a key is combined with a nonce for the purpose of encrypting a file, only the encrypted nonce is written to the file header

b. When a key is combined with a nonce for the purpose of encrypting a file, the unencrypted nonce is written to the file header along with the encrypted key

c. When a key is combined with a nonce for the purpose of encrypting a file, the nonce is not written to the file header

d. When a key is combined with a nonce for the purpose of encrypting a file, the encrypted nonce is written to the file header along with the encrypted key

b. When a key is combined with a nonce for the purpose of encrypting a file, the unencrypted nonce is written to the file header along with the encrypted key (pg 337)

(Chapter 8)

True, also known as a bucket brigade attack. A forgery can be distributed. The file claims to contain the True public key but in fact it contains the Attacker's public key (pg 369)

(Chapter 8)

a public key certificate generally does not contain ___

a. a private key

b. the name of the public key's owner

c. a public key

d. a digital signature that covers the name and the public key

a. Correct - a private key

b. Incorrect - the name of the public key's owner

c. Incorrect - a public key

d. Incorrect - a digital signature that covers the name and the public key

(Chapter 8)

Which of the following statements about key wrapping is correct?

a. The CEK is used to encrypt the KEK

b. The KEK is produced by hashing the CEK combined with a nonce

c. The KEK is used to encrypt the data in the file

d. The KEK is used to encrypt the CEK

d. The KEK is used to encrypt the CEK, the program wraps the CEK by encrypting it with the KEK (pg 339)

(Chapter 8)

True, to construct a certificate, we calculate the hash over the owner's name and public key, then we use a private key to construct the signature. (pg 370 & slides)

(Chapter 8)

b. have weak collision resistance

(Chapter 8)

False

(Chapter 8)

False, shares the same CEK among everyone, but wrap the CEK separately with each passphrase (KEK)

(Chapter 8)

?

(Chapter 8)

False, the asymmetry in public key cryptography allows us to produce digital signatues (pg 345)

(Chapter 8)

False, we encrypt the key itself using the passphrase (pg 338)

(Chapter 8)

True, Alice uses her private key to produce a digital signature (slides)

(Chapter 8)

The property of ___ on a digital signature scheme indicates that it is difficult for an attacker to use an existing signature on a different message.

a. nonrepudiation

b. nonmutability

c. nonrevocation

d. nonforgeability

a. Incorrect - nonrepudiation - proof that the key's owner signed the digital data

b. Correct - nonmutability - difficult for an attacker to convert an existing signature into a valid signature on a different message

c. Incorrect

d. Incorrect- Nonforgeability - difficult for an attacker to forge a signature

(Chapter 8)

(True or False)

False, it is used for key exchange

(Chapter 8)

c. SHA-256 is a cryptographic compression function, SHA-256 uses a compression function with inputs of m=512 bits and n = 256 bits, and produces hash values of n = 256 bits (slides)