UNIVERSITY EXAMINATIONS: 2016/2017
EXAMINATION FOR THE DEGREE OF BACHELOR OF SCIENCE IN
INFORMATION TECHNOLOGY/BACHELOR OF BUSINESS
INFORMATION TECHNOLOGY/BACHELOR OF SCIENCE IN
INFORMATION AND COMMUNICATIONS TECHNOLOGY
BIT3102 BBIT 301BCT 2106 INFORMATION SYSTEMS SECURITY AND
CRYPTOGRAPHY/NETWORK SECURITY/INFORMATION SECURITY
POLICY
FULL TIME/PART TIME/DISTANCE LEARNING
DATE: AUGUST, 2017 TIME: 2 HOURS
INSTRUCTIONS: Answer Question One & ANY OTHER TWO questions.
QUESTION ONE [30 MARKS]
a) Define the following terminologies:
(i) Bot 1 Mark
(ii) Zombie 1 Mark
(iii) Forensics 1 Mark
(iv) Dumpster diving 1 Mark
b) Discuss briefly any six factors that can increase or decrease the level of impact a threat
may have on an enterprise and its assets. 6 Marks
c) List any five real weaknesses that compromise the security of cryptographic algorithms.
5 Marks
d) With the aid of a diagram, explain how an end user will use the Public Key Infrastructure
(PKI) to transact business with a shop. 7 Marks
e) Outline briefly any four important factors to consider when choosing a firewall solution.
4 Marks
f) Describe how the salami attack is conducted 4 Marks
QUESTION TWO [20 MARKS]
a) Discuss in detail three common applications of digital signatures 6 Marks
b) Discuss the concepts of confusion and diffusion as applied in encrypting algorithms.
4 Marks
c) Let’s assume that there are two parties A (Alice ) and B (Bob), who exchange a finite
number of messages:
| |
| M1 |
| ———————>|
| M2 |
A| <——————– | B
| M3 |
| ———————>|
| M4 |
| <——————- |
| |.
A starts the protocol by sending a message to B, M1. B replies with M2, etc. We assume
that message N+1 is not sent until message N has been received and understood. During
or after the exchange of the messages what do we need to be sure of? 2 Marks
d) In general, it is not possible to satisfy the beliefs in (c) above until the protocol has
completed its exchange. The contents of the messages can be verified for their integrity in
a number of ways.
(i) How do we ensure that no-one has messed with the messages in transit?
2 Marks
(ii) We must also verify that the message is not just a replay of an older message
which someone picked up by snooping on the network. List two methods used to
verify this. 2 Marks
e) State the four characteristics of a good cryptographic algorithm. 4 Marks
QUESTION THREE [20 MARKS]
a) Describe any five processes that help in achieving information assurance. 5 Marks
b) State any four basic rules governing privacy policies in the workplace. 4 Marks
c) Discuss the phases involved in the Network Vulnerability Assessment Methodology.
5Marks
d) With the aid of a diagram, explain in detail how an e-banking trojan is deployed to
manipulate banking transactions. 6 Marks
QUESTION FOUR [20 MARKS]
a) New employees in sensitive jobs should sign employment agreements with nondisclosure provisions. Explain briefly any six specifications for this agreement.
6 Marks
b) Discuss any three design principles for secure systems. 6Marks
c) (i) State any two human behaviors that are vulnerable to social engineering attacks.
2 Marks
(ii) Why is social engineering effective? 2 Marks
(iii) Explain the phases involved in a social engineering attack. 4 Marks
QUESTION FIVE [20 MARKS]
a) (i) You work for a large multi-national corporation. As the chief security officer, you
have been asked to chair the Business Continuity Planning (BCP) advisory team for the
company headquarters. Who might you invite to join the team? 2 Marks
(ii) The advisory committee has met for its monthly meeting and you have left the
meeting with a beta-level draft of the BCP. You have been charged with evaluating the
BCP prior to implementation. What are some examples of items that you will be
evaluating? 5 Marks
b) Outline any five reasons why physical security is needed. 5 Marks
c) You have been assigned the role of a security consultant for an organization that uses
computers for their day-to-day operations. You first task is to prepare a defence plan for
this organization with a view to securing the organization’s data. Describe any FOUR
major considerations you must take into account when choosing the design.
8 Marks
