UNIVERSITY EXAMINATIONS: 2013/2014
ORDINARY EXAMINATION FOR THE BACHELOR OF SCIENCE
IN INFORMATION TECHNOLOGY
BIT 3102 INFORMATION SYSTEMS SECURITY AND
CRYPTOGRAPHY
DATE: APRIL, 2014 TIME: 2 HOURS
INSTRUCTIONS: Answer Question ONE and any other TWO
QUESTION ONE
(a) Malicious programs are a threat to both business and personal computing. At
some point, most businesses worldwide have been infected. In this regard,
define the following malicious programs:
i. Virus (1 Mark)
ii. Worm (1 Mark)
iii. Trojan (1 Mark)
iv. Logic Bomb (1 Mark)
(b) A penetration test will not only point out vulnerabilities, it also will document
how the weaknesses can be exploited and how several minor vulnerabilities can
be escalated by an attacker to compromise a computer or network. Describe the
following types of penetration testing:
i. Black-box testing (3 Marks)
ii. Gray-box testing (3 Marks)
(c) Outline any five reasons why physical security is needed. (5 Marks)
(d) Describe the following methods that are used to detect an intrusion:
i. Signature recognition. (3 Marks)
ii. Anomaly detection (3 Marks)
(e) Brute force attack is a type of password attack, which uses exhaustive trial and
error methods for finding legitimate authentication credentials. State four issues
that the difficulty of a brute force attack depends on. (4 Marks)
(f) The first step in securing information systems is to conduct a risk analysis.
Explain briefly the five steps undertaken in risk analysis (5 Marks)
QUESTION TWO
(a) Cryptography attacks are based on the assumption that the cryptanalyst has
knowledge of the information encrypted. Describe briefly the following
cryptographic attacks:
i. Ciphertext only attack (2 Marks)
ii. Known-plaintext attack (2 Marks)
iii. Chosen-plaintext (2 Marks)
iv. Chosen-key attack (2 Marks)
(b) With the aid of diagrams explain how the DES algorithm operates (9 Marks)
(c) Discuss in detail Electronic money (digital cash) as a common application of
digital signatures (3 Marks)
QUESTION THREE
(a) List the steps involved in implementing access control services. (5 Marks)
(b) A firm security implementation plan can be launched and established using a
series of best practices. State any five of these best practices. (5 Marks)
(c) Describe briefly any five IDS categories. (5 Marks)
(d) A strong security process contains several layers of operational functionality.
State any five of these layers of operational functionality (5 Marks)
QUESTION FOUR
(a) New employees in sensitive jobs should sign employment agreements with non
disclosure provisions. Explain briefly any six specifications for this agreement.
(6 Marks)
(b) Scanning is one of most important phases of intelligence gathering for an attacker.
In the scanning phase, the attacker tries to find out various ways to intrude into
the target system. Discuss the three types of scanning that are used. (6 Marks)
(c) Outline four categories of computer fraud. (4 Marks)
(d) Explain briefly the legal process followed in the prosecution of a crime.
(4 Marks)
QUESTION FIVE
(a) In public key encryption, compare and contrast RSA and Diffie-Hellman
algorithms (7 Marks)
(b) Discuss any four design principles for secure systems. (8 Marks)
(c) In a non-electronic banking scenario, a customer, A, may write instructions to his
bank to transfer funds from his account to another customer B’s account. A third
party (messenger) delivers the instructions to the bank. Explain the integrity and
authentication concerns in this scheme and how they are typically addressed.
(5 Marks)
