Week 5 - Systems security

Question 1

non-repudation

Answer 1

means’ that the owner of a message is unable to reupdate ownership. can be achieved by cryptography or accounting methods.

Question 2

what is a system?

Answer 2

a set of things working as part of a mechanism with an interconnection between its components, with a goal of providing a service.

Question 3

explain cyber-physical-social systems

Answer 3

integration of cyber, physical and social spaces.

Question 4

Define interface

Answer 4

a common point through which two systems interact

Question 5

what is the application layer?

Answer 5

sends and receives data

Question 6

what is the host layer?

Answer 6

the hardware that hosts the OS

Question 7

what is the operating system?

Answer 7

a collection of software that runs the interface, manages system components (storage, memory) and peripherals (printers, audio).

Question 8

What is the network layer (layer 3)

Answer 8

routing packets in a network.

Question 9

Availability from a computer systems perspective

Answer 9

key components ensure the system is always fully functional

(web and database server or backed up data by the system)

Question 10

Authentication from a computer systems perspective

Answer 10

allows legitimate users only.

Question 11

Authorisation from a computer systems perspective

Answer 11

role based access controls, e.g only admin can make changes

Question 12

Confidentiality from a computer systems perspective

Answer 12

techniques like cryptography and access control ensure authorised users have access to data

Question 13

Integrity from a computer systems perspective

Answer 13

techniques like cryptography and access control ensure authorised users have access to data

Question 14

Accounting and non-repudiation from a computer systems perspective

Answer 14

mechanisms to log all actions with identity, date, time.

Question 15

What is an attack vector?

Answer 15

how the attack targets the system

Question 16

what is packet sniffing?

Answer 16

monitoring network traffic to capture packets on a wired or wireless network

Question 17

Define interception attack vector

Answer 17

the act of preventing someone or something from reaching the intended destination

breaches confidentiality

Question 18

Define modification attack vector

Answer 18

making changes without permission or authorisation

breaches integrity

Question 19

Define interruption attack vector

Answer 19

stop or hinder communication

breaches integrity and availability

Question 20

Define replay attack vector

Answer 20

lays between modification and interception, attacker intercepts data then communicate it to target without modification with the intent of receiving a response that holds information of interest

Question 21

Define Man in the middle attack

Answer 21

a type of cyber attack in which the attacker secretly intercepts and relays messages between two parties who believe they are communicating directly with each other

may use replay attack vector or modification attack vector.

Question 22

define fabrication attack vector

Answer 22

masquerading as a sender or receiver to fabricate a message or data. observation over a long period of time

can be used to breach 1 of 5 security objectives-

confidentiality, integrity, availability, authentication and non-repudiation

Question 23

define transmission control protocol (TCP)

Answer 23

layer 4,
transport data segments
communications standard that enables application programs and computing devices to exchange messages over a network

Question 24

Define systems security

Answer 24

security of a whole system including applications, host devices, network components, people and processes.

Question 25

Define cryptography

Answer 25

encode and decode information to secure communication.

achieves confidentiality and integrity (CIA)

Question 26

what is the ISO 27000 information security standard?

Answer 26

International organisation for Standardisation (ISO)

a set of standards that if met demonstrates an organisation has met a level of security maturity.

implementation is accredited by a qualified auditor.

Question 27

What does ISO 2700:2018 address?

Answer 27

best practices for managing information risks by implementing security controls

Question 28

What does ISMS stand for?

Answer 28

information security management systems.