Security

Explain asymmetric private/public keys and access-control lists.

Asymmetric cryptography uses a mathematically related public/private key pair. In the source's confidentiality example, a sender encrypts with the receiver's public key, and the receiver decrypts with the corresponding private key.

The source also describes “encrypt with private, decrypt with public” as a general reverse operation. This wording is retained in the original scan; it is not a universally valid description of all asymmetric schemes or digital signatures.

The source's ACL answer focuses on networking: an access-control list filters packets or routing updates entering or leaving an interface. Administrators use it to control traffic and add security restrictions.

Why is authentication essential? Explain authentication methods.

Authentication checks whether a user is the identity they claim to be, often by verifying credentials against a database or authentication server. The source describes proof based on something a user knows, such as a password; something they possess; or a biometric characteristic. Verifying identity helps protect access to secured resources.

Explain the Caesar cipher.

The Caesar cipher is a substitution cipher that shifts letters by a fixed number of positions in the alphabet. The source illustrates a shift of three positions. Its original alphabet mapping and encryption/decryption formulas are preserved exactly as scan images:

Explain active and passive security attacks.

Active attacks change a data stream or introduce false data. The source lists:

• Masquerade: One entity pretends to be another.
• Replay: Captured information is retransmitted later.
• Message modification: Data is altered, delayed, or reordered.
• Man-in-the-middle: An attacker interposes between parties and impersonates them to one another.
• Denial of service: Preventing normal use of a service, including overload or disabling it.

Passive attacks observe information without altering the data stream. The source names reading message contents and traffic analysis.

Explain protection domains.

A system contains hardware objects, such as CPUs, memory, disks, and printers, and software objects, such as processes, files, databases, and semaphores. Each object has a name and a set of permitted operations. A protection domain determines the objects and operations a process may access, restricting unauthorized use.

The original three-domain diagram and access labels are preserved here:

Explain cryptography, plaintext, encryption, and decryption.

The source describes cryptography as the science and art of transforming messages to secure them against attack. Plaintext is the original message. Encryption transforms plaintext into ciphertext. Decryption transforms ciphertext back into plaintext for an authorized recipient. Its original wording and notation are retained below.

Explain major threats associated with Internet use and why systems remain prone to attack.

The source groups malicious software into programs needing a host and independent programs. Host-dependent threats are fragments of application, utility, or system programs; examples given include Trojan horses, viruses, and logic bombs. Independent threats are self-contained programs that the operating system can schedule, with worms and zombies listed as examples.

It also distinguishes replicating and nonreplicating threats, listing viruses, worms, and zombies in the first group and trapdoors and Trojan horses in the second.

These categories reproduce the source's organization, including its treatment of zombies. They are not a corrected malware taxonomy. The source does not provide a separate developed answer to every clause of the question.

Explain security policy.

A security policy defines what it means for an organization or system to be secure. It sets constraints on behavior and identifies rules for handling adversaries and protecting resources. The source compares physical mechanisms such as doors, locks, keys, and walls with system rules governing functions, information flows, external programs, data, and people. Mechanisms must enforce the policy robustly.

Explain access-control lists and their security implementation.

An access matrix is often sparse, so it is inefficient to store all empty entries. One approach stores only nonempty entries. Associating each object with a list of permitted domains and their access rights produces an access-control list.

The original user/kernel, process, and file-permission figure is preserved below.

The source also refers to “slide 34,” which is not included in the supplied material; that external material has not been substituted or invented.

Explain information-security models.

An information-security model gives a formal or precise representation of the rules underlying a security policy. It may express procedures and constraints abstractly or through a state-machine description. The source lists Bell–LaPadula, Biba, Clark–Wilson, and noninterference among its examples.

The complete handwritten discussion is preserved here: