- 2072 Asoj · 3+6 marks
Attack types; security of all components
Short answer
Attacks include passive (eavesdropping), active (masquerading, replay, DoS), malware, trap doors, buffer overflows, insider threats, and social engineering. Protection spans all components: hardware (locks, UPS), processes (user/kernel mode, domains), memory (base-limit, non-executable stack), files (permissions, ACLs, encryption), I/O (device permissions), accounts (strong passwords, MFA), network (firewall, VPN, IDS), software (antivirus, patches), and data (cryptography, backups). General measures: least privilege, auditing, updates, training.
Explain the types of attacks. Explain how you can implement security and protection on all components of a system.
Types of attacks
- Passive attacks: eavesdropping and traffic analysis; they do not change data.
- Active attacks: masquerading, replay, modification and denial of service.
- Malware: viruses, worms, Trojan horses, logic bombs, spyware.
- Trap doors, buffer overflow and login spoofing: exploit program flaws.
- Insider attacks: misuse by authorised persons.
- Social engineering and phishing: tricking users into giving away passwords.
Security and protection of system components
| Component | Threats | Protection |
|---|---|---|
| Hardware | Theft, damage, tampering | Physical locks, guards, CCTV, UPS, BIOS password |
| Processes/CPU | Malicious programs, privilege abuse | User/kernel mode, protection domains, least privilege |
| Memory | Illegal access, buffer overflow | Base-limit registers, paging protection, non-executable stack |
| File system | Unauthorised read/write | Permissions, ACLs, encryption, backups |
| I/O devices | Misuse of devices | Device permissions, access control for dedicated devices |
| User accounts | Password guessing, spoofing | Strong passwords, hashing and salting, multi-factor authentication, account lockout |
| Network | Sniffing, DoS, intrusion | Firewall, VPN, SSL/TLS, intrusion detection |
| Software | Malware, bugs | Antivirus, patches, trusted sources, code review |
| Data | Disclosure, loss | Cryptography, backups, audit logs |
General measures
- Authentication and authorisation for every access.
- Principle of least privilege and separation of duties.
- Auditing and logging of security events.
- Regular updates and backups.
- User training against social engineering.
✓ Answer checked by Claude Opus 5.5 (high effort)
Related questions
- Types of security attacks · Operating System, chapter 8 · asked 3×
- Attacks from inside; malware, spyware · Operating System, chapter 8
- Protection domain and ACL · Operating System, chapter 8 · asked 2×
- Short note: information security model · Operating System, chapter 8
- Short note: security policy · Operating System, chapter 8
- Authentication as security mechanism · Operating System, chapter 8
- Power system security assessment · Power Plant Design, chapter 2
- Bridge components sketch; river bank protection · Transportation Engineering II, chapter 5
- Concept of power system security · Power Plant Design, chapter 2 · asked 3×
- Power system security and reserve requirement · Power Plant Design, chapter 2