UNIVERSITY EXAMINATIONS: 2011/2012
YEAR III EXAMINATION FOR THE BACHELOR OF SCIENCE IN
INFORMATION TECHNOLOGY
BIT 3102 INFORMATION SYSTEMS SECURITY AND CRYPTOGRAPHY
DATE: APRIL 2012 TIME: 2 HOURS
INSTRUCTIONS: Answer Question One and Any other Two Questions
QUESTION ONE
a) Define the four domains into which biometric measurements are classified. (4 Marks)
b) Striking the right balance between functionality and accessibility is a critical facet of IT security
supporting e-commerce. Discus the six basic steps involved. (6 Marks)
c) State four possible attacks on message authentication. (4 Marks)
d) Describe briefly the following categories, or types, of access control services that support the
phases of access control implementation:
(i) Identification and Authorization (I&A) (2 Marks)
(ii) Audit (1 Mark)
(iii) Authorization (1 Mark)
(iv) Accountability (1 Mark)
e) Security models provide guidelines and frameworks for implementing security policies to
protect the confidentiality, integrity, and availability of information on devices or networks.
Describe briefly the following security models:
(i) Lattice Model (2 Marks)
(ii) Bell-LaPadula (BLP) Model (2 Marks)
(iii) Brewer-Nash Model (2 Marks)
f) Discuss any five ways in which cryptographic algorithms are compromised. (5 Marks)
QUESTION TWO
a)Once security goals are in place, there are a number of concepts that can be applied to reinforce
security within your organization. Techniques such as personnel management are critical
components to strengthening organizational security. Employing these techniques will help you
increase security levels and protect your information systems from intrusive, unauthorized
access.
(i) When hiring a new employee, it is important to match the appropriate employee with
the applicable job and security responsibilities. Outline the Baseline hiring
procedures to facilitate this. (5 Marks)
(ii) From a security standpoint, what security benefit does mandatory vacations
provide? (2 Marks)
(iii) How is a sensitivity profiling developed and what is the benefit? (2 Marks)
(iv) How can you address the major considerations of sensitivity profiling for job
positions? (2 Marks)
b) Explain briefly the five steps undertaken in risk analysis (5 Marks)
c) What are some examples of typical ethics fallacies that information security criminals believe?
(4 Marks)
QUESTION THREE
a)The basis of protection is separation: keeping one user’s objects separate from other users.
Explain briefly four major ways that separation in an operating system can occur. (4 Marks)
b) There are many different security considerations that must be taken into account during the
software development process. Describe briefly best practices for the following:
(i) Buffer overflow (1 Mark)
(ii) Covert channel (1 Mark)
(iii) Social engineering (1 Mark)
(iv) Trapdoors and backdoors (1 Mark)
(v)Object reuse (1 Mark)
c) There are simpler, alternative ciphers available that are used to hide information rather than to
disguise information by standard encryption methods. Describe any three of these ciphers.
(6 Marks)
d) Define the following terminologies:
(i) Disaster Recovery Plan (DRP) (1 Mark)
(ii) Reference Monitor (1 Mark)
(iii)Mandatory Access Control (MAC) (1 Mark)
(iv)Emanation (1 Mark)
(v)Dumpster diving (1 Mark)
QUESTION THREE
a)Describe briefly the following encryption-based attack categories:
(i) Birthday attack (2 Marks)
(ii) Dictionary attack (2 Marks)
(iii) Side channel attack (2 Marks)
b) With the aid of relevant examples, describe what three types of information can be used to
authenticate a user. (6 Marks)
c) Application Embedded Secret Computation is a piece of program code embedded within an
application and performing some secret undocumented computation whenever the
application is running. Describe how the salami attack is conducted (5 Marks)
d) How would an attacker know the company’s infrastructure through job sites? (3 Marks)
QUESTION FIVE
a)Outline the key steps involved in developing a security plan (5 Marks)
b) Describe briefly five application areas in the current market that computer forensics provides
support to. (5 Marks)
c) Describe how secret key encryption is used in protecting pay TV transmissions. (6 Marks)
d) From a security perspective, information that is deleted or removed from a networked system
reduces the possibility of unauthorized access from that one system, but it creates new
opportunities for theft, loss and mischief in other ways. Creating a formal process with
multiple points of confirmation of security including an audit trail are critical elements of
ensuring information assurance. Outline any four concepts to keep in mind concerning the
security of obsolete information. (4 Marks)
