CO2521 Information Security Management - 3 week revision

Match the following

• Ensures that information is available to authorized parties

• Availability

• Ensures that only authorized parties can view the information.

• Integrity

• Ensures that information is correct and there is no unauthorized modification

• Confidentiality

Assets can be any resource of value to organisation, they can be ​ (a)   like a website or they can be ​ (b)   such as people and hardware.

• logical
• physical
• expensive
• difficult
• remote

Answer explanation

Asset – Any resources that are of value to an organization. (Items to be protected). • An asset can be: • Logical – e.g. website; software information or data. • Physical – e.g. person; hardware or computer system

Match the following

• the technique used to compromise a system and take advantage of a vulnerability.

• Threat

• a single instance of an information asset suffering damage or destruction.

• Exploit

• an intentional or unintentional act that causes damage/compromise information or systems

• Loss

• an action that has the potential to adversely affect operations and assets.

• Attack

A weakness that could allow an attacker to bypass security is ​ (a)  

• Vulnerability
• Risk
• Exploit
• Attack

​ (a)   is the mechanism that represents the matching of an authenticated entity to a list of information assets and corresponding access levels

• Authorisation
• Authentication
• Auditability
• Accountability

Answer explanation

Authentication – process by which a control establishes whether a user/ system is the entity it claims to be. • Authorisation – mechanism that represents the matching of an authenticated entity to a list of information assets and corresponding access levels. • Accountability/Auditability – mechanism that records all actions on a system (authorised or unauthorised).

Which of these is NOT a description of Confidentiality?

• Ensures that no one other than the intended recipient of a message receives it or is able to read it.

• Allows authorised users to access and interact with resources, but it actively prevents unauthorised users from doing so.

• Measures to ensure the protection of the secrecy of data, objects, or resources.

• Ensures that data remains correct, unaltered, and preserved.

Which of these is NOT a description of Integrity?

• Protecting the reliability and correctness of data.

• Ensures that data remains correct, unaltered, and preserved

• Prevents unauthorised alterations of data.

• Authorised subjects are granted timely and uninterrupted access to objects.

Match the following

• not being able to deny having performed an action

• Validity

• being factually or logically sound.

• Truthfulness

• being authentic or genuine.

• Authenticity

• being a true reflection of reality.

• Non-repudiation Integrity

• being correct and precise.

• Accuracy

Which of these is NOT a description of Availability?

• Ensures that no one other than the intended recipient of a message receives it or is able to read it.

• Offers a high level of assurance that the data, objects, and resources are accessible to authorised subjects.

• protection controls support sufficient bandwidth and timeliness of

  processing as deemed necessary by the organisation or situation.

• Includes efficient uninterrupted access to objects and prevention of denial-of service (DoS) attacks.

Answer explanation

Availability • Authorised subjects are granted timely and uninterrupted access to objects. • Availability protection controls support sufficient bandwidth and timeliness of processing as deemed necessary by the organisation or situation. • Offers a high level of assurance that the data, objects, and resources are accessible to authorised subjects. • Includes efficient uninterrupted access to objects and prevention of denial-of service (DoS) attacks.

The process of verifying identity is known as ​ (a)  

• Authentication
• Authorisation
• a password
• bio-metrics

Answer explanation

dentification and authentication are often used together as a single two-step process: • Providing an identity • Providing the authentication factors. • Authentication can be based on what a user knows (such as a password), what a user has (like a token or a card), or what a user is (biometrics).