Karteikarten
A2 CS - Security
Karten in diesem Stapel (21)
- 1Define Public Key"public key: key widely available that can be used to encrypt messages
that only owner of private key can decrypt // can be used to decrypt a
message thereby confirming originator of message" -CIE A2 S15 QP 32 - 2Define Prvate Key"private key: key only known to owner that can be used to encrypt
message to confirm author of message // can be used by owner to decrypt a
message thereby ensuring only owner can read message" CIE A2 S15 QP 33 - 3Define ciphertext"post-encryption text that is not understandable" CIE A2 S15 QP 33
- 4What is encryption? #PhilosophicalPonder"Process of turning plain text into ciphertext" CIE A2 S15 QP 32
- 5Define/describe asymmetric key cryptographyProcess:
Receiver has the public key and private key. Private key is secret only to the receiver
Public key is sent to any number of senders. Sender uses this key to encrypt his message
Sender now has ciphertext, which he sends. The receiver receives the ciphertext and uses his private key (matched to the public key which he sent to the sender to encrypt the sender's message) to decrypt it. - 6How can public and private keys be used to send a verified message to the public?A sender with a private key who encrypts the message with this private key, sends the ciphertext to the public and provides them with the corresponding public key
- 7How is a digital certificate acquired?Obtained: 1. Sender contacts CA
2. CA confirms sender's identity
3. Sender gives his public key to CA
4. CA appends the sender's public key into a public-key certificate that it creates
5. The CA uses its private key and adds a digital signature to this certificate
6. Sender receives digital certificate
7. Sender posts this certificate onto its website or a certificate-listing website - 8What are the basic components of a digital certificate- CA signature
- Sender's public key
- Some other server ID info, e.g. bearer's name
- Expiration date - 9What makes a digital certificate trustworthy?- Authoritativeness of issuing body
- Date of expiration
- Whether the certificate actually belongs to the bearer - 10Encrypted Hash Digests are also known as Digital Signatures. In sending what type of data would the use of digital signatures be appropriate?Legal Documents
Financial Documents
Software distribution - 11How are digital certificate used to create digital signatures?1. Receiver sends sender his public keys
2. Sender uses cryptographic hashing and hashes his message to create a digest number
3. The digest is encrypted with the sender's private key to produce an encrypted digest, this is a digital signature
4. Digital signature added to message
5. The Certification Authority (CA) uses its own private key and encrypts a digital certificate which it sends to the sender so he can add it to the message
6. Message encrypted with receiver's public key
7. Encrypted message + signature sent to receiver - 12How are digital signatures and hashed digests used to verify the authenticity and unalteredness of a downloaded software [4]software is put through hashing algorithm
• hash total is encrypted with private key (encrypted hash = digital signature)
• software + encrypted hash (digital signature) are sent
• receiver is in possession of sender’s public key
• the received hash total / digital signature is decrypted with public key
(SH)
• the receiver hashes received software (RH)
• If SH matches RH then software is authentic and has not been altered - 13What is the purpose of SSL/TLS?Acts as an ecryption protocol for data packets being transmitted across the interwebz between applications (e.g. server and browser)
To provide Authentication: The receiver's certificates are checked
To provide security: Once the SSL initial verifications have been established, the following messages will be encrypted when transmitted - 14What kind of situations would make the use of SSL/TLS appropriate?+ Transferring sensitive information, e.g.
- bank account details
- logins to myspace (lololol)
- Hillary Clinton's emails deletion requests
+ Connection to public internet, e.g.
- at a cafe with lots of teenagers on their phones
+ at an airport
+ Avoiding scams
+ Connecting to pages for the first time (no DNS log and certificate logs in hdd yet) - 15Describe the SSL/TLS processHandshake protocol phase
-(CHello) client sends its supported algorithms, bit rate, hash functions, random numbers...
- (SHello)server returns the items it has selected, and sends its DCertificate + public key (SHello completes)
-client verifies DCertificate
- pre-master secrets encrypted with server's pubKey and sent to server
-Both sides use the selected random number and pre-master secret to generate master key.
- master key is used to hash a message, hashed message sent to server who compares his hash with the sent hash, Client Finishes
-Server repeats step above with a different hash (end of handshake); server finishes
-proceed to encrypted message exchanges - 16What is a virus?"A malware that replicates by inserting itself into another piece of
software." CIE A2 S15 QP33
It is activated when the file/software is open/ran, and spreads by distributing the files/software onto networks and other computers via email, downloads, file transfers... - 17What is spam? What vulnerabilities does it exploit? Potential problems that may arise and potential solutions?"Unsolicited emails containing advertising material sent to a
distribution list." CIE A2 S15 QP31
Users or firms who do not use spam filter email services. Exploits the gullibility of people and generates revenue from clicks.
Also exploits weak firewalls and can overload and clog up inboxes, making organisation of legitimate mails harder to organise. - 18What is a worm? What vulnerabilities does it exploit? Potential problems that may arise and potential solutions?"A standalone (requires no host program/file) piece of malicious software that can reproduce
itself automatically." CIE A2 S15 QP31. They can spread without human intervention. Problems: delete data on computer, consume bandwidth, Solution: Keep OS updated, install and run firewalls and antivirus - 19What is pharming?"redirect website to fake website // domain name server compromised
// proxy server compromised" CIE A2 S15 QP31 - 20What is Phishing?"through email attempt to obtain somebody’s confidential data / install
malware" CIE A2 S15 QP31 - 21Methods of restricting malwareKeep OS updated
Install and run antivirus software
Don't download software from malicious sources
Don't open suspicious email attachments
Use physical protection: lock rooms, hire guards etc.
Informationen
- Beschreibung
- Advanced Level (A- Level) Computer Science (A2 - Security) Karteikarten am A2 CS - Security, erstellt von TS P am 23/10/2016.
- Erstellt von
- TS P
- Aufrufe
- 4
- Bewertung