midterm04 - IS2935 Introduction to Computer Security...

Info iconThis preview shows pages 1–4. Sign up to view the full content.

View Full Document Right Arrow Icon
IS2935 Introduction to Computer Security Midterm, Thursday, Oct 21, 2004 Name: Email: Total Time : 2:30 Hours Total Score : 100 The questions have been grouped into four parts. These parts roughly correspond to the different sets of chapters/topics indicated. Part 1: Total Score 20 Part 2: Total Score 30 Part 3: Total Score 25 Part 4: Total Score 25 Note that scores for each question may be different – so spend time accordingly on each question . Be precise and clear in your answers. A separate sheet has been provided that contains definitions that may be useful in answering the questions. Score Questions Part 1 Part 2 Part 3 Part 4 Total Total = Best of Lucks!! ( Read the questions carefully )
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Part 1 1. Define/explain the following terms: [2] Accountability Non-repudiation 2. Write T for true and F for false for the following statements: [8] [ ] One of the organizational problems in security is the question of who is responsible for the security of the computers. [ ] Disruption refers to unauthorized interruption of correct operation of a function. [ ] Covert channels makes the information flow problem more difficult to solve. [ ] In some systems (like Unix), if a subject s is owner of object o , then even if s has no read or write right over o , s may give read or write right over o to another subject. This violates the principle of attenuation of privilege . [ ] One way to prove that the general safety problem is undecidable is to reduce the safety problem to the Turing machine’s halting problem. [ ] In originator controlled access control, the owner of a file has no control over who may access the file. [ ] In a mandatory access control model, a system mechanism controls access to an object and an individual user can occasionally alter that access. [ ] Assume than any intrusion to a system eventually transitions the system state to an insecure state. If you install an intrusion prevention mechanism which ensures that only known intrusions to the system are blocked, the intrusion prevention mechanism is precise . 3. Let x and y be subjects, z a subject or object, and r be right. Write the following acces control command that captures the grant rule of the Take-Grant model. Assume that an access control matrix A contains the rights specified in a Take-Grant graph. The commands are specified as follows: [4]
Background image of page 2
a. command grant_right ( x , y , z , r ): y grants right r over z to y (provided x has grant right over y , and x has r right over z ) command grant_right ( x , y
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Image of page 4
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 11/02/2009 for the course SIS 2150 taught by Professor Joshi during the Spring '09 term at Philadelphia.

Page1 / 11

midterm04 - IS2935 Introduction to Computer Security...

This preview shows document pages 1 - 4. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online