Network Security
1.3 List and briefly define categories of passive and active network security attacks.
1.5 Explain the difference between an attack surface and an attack tree.
Problems
1.3 Consider a desktop publishing system used to produce documents for variousorganizations.
a. Give an example of a type of publication for which confidentiality of the stored datais the most important requirement.
b. Give an example of a type of publication in which data integrity is the most importantrequirement.
c. Give an example in which system availability is the most important requirement.
1.5 Consider the following general code for allowing access to a resource:
DWORD dwRet = IsAccessAllowed(…);if (dwRet == ERROR_ACCESS_DENIED) {// Security check failed.// Inform user that access is denied.} else {// Security check OK.}
a. Explain the security flaw in this program.
b. Rewrite the code to avoid the flaw.
1.7 Consider a company whose operations are housed in two buildings on the sameproperty: one building is headquarters, the other building contains network and computerservices. The property is physically protected by a fence around the perimeter. The onlyentrance to the property is through a guarded front gate. The local networks are splitbetween the Headquarters’ LAN and the Network Services’ LAN. Internet users connect tothe Web server through a firewall. Dial-up users get access to a particular server on theNetwork Services’ LAN. Develop an attack tree in which the root node representsdisclosure of proprietary secrets. Include physical, social engineering, and technicalattacks. The tree may contain both AND and OR nodes. Develop a tree that has at least15 leaf nodes.
Sample Solution
Network Security
A security attack is an unauthorized attempt to steal, change, damage, or expose data from an information system such as your website. Active and passive attacks are security attacks. In active attack, an attacker tries to modify the content of the messages. In passive attack, an attacker observes the messages, copy them and may use them for malicious purposes. Passive attacks can take various forms, including traffic analysis, eavesdropping, footprinting, and war driving. Types of active attacks include masquerade, repudiation, replay, and denial of service. There is a difference between attack surface and attack tree: the main theme of attack tree is to structure the process of identifying threats in information security. Attack surface, on the other hand, consists of the reachable and exploitable vulnerabilities in a system.
