Chapter 1 It Sec

1. What is the difference between a threat agent and a threat?
Threat: a category of objects, persons, or other entities that presents a danger to an asset
Threat agent: the specific instance or component of a threat
2. What is the difference between vulnerability and exposure?
Vulnerability: a weakness or fault in a system or protection mechanism that opens it to attack

or damage.
Exposure: a condition or state of being exposed. It exists when a vulnerability known to an
attacker is present.
3. How is infrastructure protection (assuring the security of utility services) related to
information security?
Information security is the protection of information and it is critical elements,

including the systems and hardware that used, store, and transmit that information, Thus,
assuring the security of utility services are critical elements in information system.
4. What type of security was dominant in the early years of computing?
The type of security was dominant in the early years of computing security was entirely
physical security. And MULTICS was first noteworthy operating system to integrate
security in to its core system.
5. What are the three components of the C.I.A. triangle? What are they used for?
Confidentiality: Informations should only be accessible to its intended recipients.

Integrity: Information should arrive the same as it was sent.
Availability: Information should be available to those authorized to use it.
6. If the C.I.A. triangle is incomplete, why is it so commonly used in security?
The CIA triangle is still used because it addresses the major concerns with the vulnerability of
information systems.
7. Describe the critical characteristics of information. How are they used in the study of
computer security?
Availability: Authorised users can access the information

Accuracy: free from errors
Authenticity: genuine
Confidentiality: preventing disclosure to unauthorized individuals.
Integrity: whole and uncorrupted.
Utility: has a value for some purpose
Possession: Ownership
8. Identify the six components of an information system. Which are most directly affected
by the study of computer security? Which are most commonly associated with its
study?
Software, Hardware, Data, People, Procedures,Networks

9. What system is the father of almost all modern multiuser systems?
10. Which paper is the foundation of all subsequent studies of computer security?
Rand Report R-609
11. Why is the top-down approach to information security superior to the bottom-up
approach?
Bottom up lacks a number of critical features such as participant support and organizational
staying power, whereas top down has strong upper management support, dedicated funding,
clear planning and the opportunity to influence organizations culture.
12. Why is a methodology important in the implementation of information security? How
does a methodology improve the process?
A formal methodology ensures a rigorus process and avoids missing steps.

13. Which members of an organization are involved in the security system development
life cycle? Who leads the process?
Security professionals are involved in the SDLC. Senior magagement, security project team
and data owners are leads in the project.
14. How can the practice of information security be described as both an art and a science?
How does security as a social science influence its practice?
Art because there are no hard and fast rules especially with users and policy.
Science because the software is developed by computer scientists and engineers. Faults are a
precise interaction of hardware and software that can be fixed given enough time.
15. Who is ultimately responsible for the security of information in the organization?
The Chief Information Security Officer (CISO)

16. What is the relationship between the MULTICS project and the early development of
computer security?
It was the first and operating system created with security as its primary goal. Shortly after
the restructuring of MULTICS, several key engineers started working on UNIX which did not
require the same level of security.
17. How has computer security evolved into modern information security?
In the early days before ARPANET machines were only physically secured. After ARPANET
it was realised that this was just one component.
18. What was important about Rand Report R-609?
RR609 was the first widely recognized published document to identify the role of management
and policy issues in computer security.
19. Who decides how and when data in an organization will be used or controlled? Who
is responsible for seeing that these wishes are carried out?
Control and use of data in the Data owners are responsible for how and when data will be
used, Data users are working with the data in their daily jobs.
20. Who should lead a security team? Should the approach to security be more managerial
or technical?
A project manager with information security technical skills. The approach to security should
be managerial, top down.
The next day at SLS found everyone in technical support busy restoring computer systems
to their former state and installing new virus and worm control software. Amy found herself
learning how to install desktop computer operating systems and applications as SLS made a
heroic effort to recover from the attack of the previous day.
Questions:
1. Do you think this event was caused by an insider or outsider? Why do you think this?
2. Other than installing virus and worm control software, what can SLS do to prepare for
the next incident?
3. Do you think this attack was the result of a virus or a worm? Why do you think this?

Chapter 1 It Sec

Uploaded by

Copyright:

Available Formats

Chapter 1 It Sec

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 1 It Sec

Uploaded by

Copyright:

Available Formats

1. What is the difference between a threat agent and a threat?

Vulnerability: a weakness or fault in a system or protection mechanism that opens it to attack

Information security is the protection of information and it is critical elements,

Confidentiality: Informations should only be accessible to its intended recipients.

Availability: Authorised users can access the information

Software, Hardware, Data, People, Procedures,Networks

Rand Report R-609

A formal methodology ensures a rigorus process and avoids missing steps.

The Chief Information Security Officer (CISO)

You might also like