Choose the best answer for each question. Each question is worth 2 marks.
What is layer 4 of the OSI model?
What is a TCP wrapper?
Which of the following is NOT true regarding firewalls?
What is encapsulation?
Which component of an Information System is considered the weakest link?
In the CIA triad, what does 'I' stand for?
Which of the following is NOT a dimension in the McCumber Cube?
Data at Rest (DAR) refers to:
Which security characteristic ensures that information is genuine and original?
The main difference between SDLC and SecSDLC is:
Indicate whether each statement is True or False. Each question is worth 2 marks.
Defense in depth is used to provide a protective multilayer barrier against various forms of attack.
Wired Equivalent Privacy (WEP) uses a predefined shared secret key.
A breach of confidentiality always results in a breach of ownership/possession.
A breach of ownership always results in a breach of confidentiality.
Software is the easiest component of an Information System to secure.
Answer each question briefly. Sample answers are provided after checking.
List and briefly explain the three goals of the CIA triad.
1. Confidentiality: Prevents unauthorized disclosure of information. Only authorized individuals should be able to access sensitive data. Examples: encryption, access controls, authentication.
2. Integrity: Ensures data accuracy and completeness. Data should not be modified by unauthorized parties or corrupted. Examples: checksums, digital signatures, hashing.
3. Availability: Ensures authorized users can access information when needed. Systems should be operational and data accessible. Examples: redundancy, backups, disaster recovery.
What are the five components of an Information System? Which one is considered the weakest and why?
The five components are:
1. Software: Applications, operating systems, utilities
2. Hardware: Physical computing devices and infrastructure
3. Data: Information stored and processed by the system
4. People: Users, administrators, and other human elements
5. Procedures: Policies, guidelines, and operational instructions
Weakest Component: People are considered the weakest link because they can be manipulated through social engineering, make errors, fall for phishing, use weak passwords, and may not follow security policies. Technical controls can often be bypassed by exploiting human weaknesses.
Explain the three dimensions of the McCumber Cube.
1. Security Goals (CIA):
- Confidentiality, Integrity, Availability - the fundamental objectives of security
2. Information States:
- Storage (Data at Rest): Data stored on disks or in memory
- Transmission (Data in Transit): Data being transmitted across networks
- Processing: Data being actively processed or computed
3. Security Controls:
- Policy & Practices: Administrative controls and procedures
- Education & Training: Security awareness and skill development
- Technology: Hardware and software security solutions
List four additional security characteristics beyond the CIA triad and briefly explain each.
1. Accuracy: Information is free from errors and meets user expectations. If data contains incorrect values, it loses its usefulness.
2. Authenticity: Information is genuine and original, not a forgery or reproduction. Ensures data hasn't been fabricated.
3. Utility: Information has value and usefulness for its intended purpose. Data must be in a usable format to have utility.
4. Possession: Having ownership or control over information. Someone can possess data without being able to read it (like encrypted data).
What is the main difference between SDLC and SecSDLC? Provide examples.
Main Difference: SecSDLC integrates security at every phase of development, while traditional SDLC often treats security as an afterthought.
Key Distinctions:
- SecSDLC performs risk assessment during initial planning
- Security requirements are gathered alongside functional requirements
- Threat modeling occurs during design phase
- Security testing is integrated throughout, not just at the end
- Continuous security monitoring during operation
Example: In SDLC, you might design a login system and add security later. In SecSDLC, you'd identify authentication threats first, then design with multi-factor authentication, encryption, and session management from the start.
Answer in detail. Sample answers provided after checking.
Describe the Defense-in-Depth strategy in cyber security. Include all six layers and provide specific examples of security controls for each layer.
Defense-in-Depth is a comprehensive security strategy that implements multiple layers of security controls to protect information systems. If one layer is compromised, other layers continue to provide protection.
The Six Layers:
1. Physical Layer:
- Controls: Locks, security guards, CCTV cameras, biometric access controls, secure facilities
- Example: Badge readers at building entrances, locked server rooms, security cameras monitoring data centers
2. Perimeter Layer:
- Controls: Firewalls, border routers, DMZ, VPNs, intrusion prevention systems
- Example: Firewall rules blocking unauthorized ports, VPN encryption for remote access, DMZ isolating public-facing servers
3. Network Layer:
- Controls: Network segmentation, VLANs, NIDS (Network Intrusion Detection Systems), network monitoring
- Example: Separating guest WiFi from corporate network, monitoring unusual traffic patterns, isolating sensitive departments
4. Host/Computer Layer:
- Controls: OS hardening, antivirus software, host-based firewalls, patch management, authentication systems
- Example: Regular Windows updates, antivirus scanning, disabling unnecessary services, strong password policies
5. Application Layer:
- Controls: Application hardening, secure coding practices, input validation, application firewalls
- Example: SQL injection prevention, secure session management, regular security testing, code reviews
6. Data Layer:
- Controls: Encryption, access control lists (ACLs), backup strategies, data loss prevention (DLP)
- Example: AES encryption for sensitive files, role-based access control, regular backups, database activity monitoring
Benefits: No single point of failure, comprehensive protection, addresses different threat vectors, provides time to detect and respond to attacks.
Compare and contrast Information Security, Computer Security, IT Security, and Cyber Security. Explain how they relate to each other and provide examples of what each encompasses.
Information Security:
- Broadest term: Protects information in all forms (digital, physical, verbal)
- Encompasses: Paper documents, verbal communications, digital data
- Examples: Locked filing cabinets, NDAs, clean desk policies, shredding documents
- Focus: CIA triad applies to all information regardless of format
Computer Security:
- Protects: Individual computer systems and their components
- Encompasses: Desktop computers, laptops, servers, mainframes
- Examples: BIOS passwords, disk encryption, secure boot, system hardening
- Focus: Securing standalone computing devices
IT Security:
- Protects: Entire IT infrastructure of an organization
- Encompasses: Networks, servers, databases, applications, IT services
- Examples: Network security, server hardening, database security, IT governance
- Focus: Protecting technology infrastructure and services
Cyber Security:
- Protects: Internet-connected systems and online presence
- Encompasses: Web applications, cloud services, IoT devices, online data
- Examples: DDoS protection, web application firewalls, secure APIs, cloud security
- Focus: Threats from cyberspace and internet-based attacks
Relationships:
- Information Security is the umbrella term containing all others
- Computer Security is a subset focusing on individual systems
- IT Security covers the technology infrastructure
- Cyber Security specifically addresses internet-connected threats
- All share the common goal of protecting the CIA triad
- They overlap significantly in modern environments where most systems are interconnected
Modern Context:
In today's interconnected world, these distinctions are becoming less clear as most computer systems are networked, most IT infrastructure is internet-connected, and most information is digitized. Organizations typically need comprehensive strategies addressing all these domains.