Karteikarten
Remaining lectures
Karten in diesem Stapel (42)
- 1How can you ensure each signature is different, so an attacker cannot copy&paste the signature?By making the signature a function of the content being signed.
- 2What is blind signature used for?When Alice does not want Bob to see the content of the message (M)
- 3Why are group signatures used?To keep your identity hidden.
- 4What is an arbitrated signature?When there is a third party involved called a: "trusted arbiter." The trusted arbiter verifies the integrity of the signed message or data. Then it will include a time-stamps on the document, verifying receipt and then it passes the signed document to its intended final destination.
- 5How do you verify a digital certificate is valid?1. Calculate the H(Cert)
2. DPKCA(EscCA (H(cert))
3. Verifies hashes are equal - 6What can users do when they have the certification authority's public key?Users can verify other user's public key certificate and obtain a trusted copy of the users public key.
- 7What is a CA hierarchy?In large organisations it is appropriate to delegate the responsibilities for issuing certificates to several certification authorities.
- 8Why is a CA hierarchy used in large organisations ?Because the number of certificates issued may be too large for a single CA to handle.
- 9What is a Root CA?A self-signed certificate
- 10Where is a root CA located?At the top of a hierarchy.
- 11What is certificate revocation?When the CA must inform all users that the certificate containing this public key is no longer valid.
- 12What is included in a certificate revocation list?The serial numbers of the certificates that are revoked.
- 13What are some reasons for revocation?Invalid period of use: certificate specifies a period of time of validity/ Attempts to use a certificate before or after will fail.
-Bad use, or if someone leaves a company. - 14What is challenge-response authentication? (Handshake)This is a method to ensure a message is not a replay or an old message.
- 15How does challenge response authentication work?One party sends a challenge message.
The second party send a response in a pre-agreed manner that indicates freshness. - 16Challenge response mechanism can be achieved with?Nonces which is when random numbers are used at once.
Timestamps
Sequence numbers - 17What is a time-stamp used for?To authenticate Trent to Bob without adding a extra message. (entity authentication)
T is encrypted so it cannot be impersonated. - 18Name the three common attacks on protocols.-DDOS attack
-Replay attack
-Reflection attack. - 19How can you stop an replay attack?By using a time-stamp to ensure the freshness of a message so it cannot be replayed.
- 20What is a software development life cycle?Describes the activities at each stage.
- 21What are the 5 stages if software development life cycle?Gather requirements,
Design (Data structure),
Develop (Source code, documentation)
Testing (Functionalities)
Release/Maintenance(Release of product) - 22When should you use the waterfall method?-When requirements are well-known.
-When the product definition is stable.
-When you want a new version of an existing product. - 23What is the V shape model?It emphasizes verification and validation of product. Testing is planned in parallel with corresponding phase of development.
- 24Advantages of V shape model?Verification and validation of product in early stages.
Project management can track progress by milestones.
Easy to use. - 25Disadvantages of V shape model?Does not contain risk analysis.
Does not handle dynamic changes in requirements. - 26When to use V shape model?When all requirements are well known
When the solution and technology are known. - 27What is verification testing?Determent whether the original design specification has been met.
- 28What is validation testing?Takes an higher level view and determent whether original purpose of software has been achieved.
- 29What is Acceptance testing?Ensures whether the customer (internal/external) is satisfied with the functionalities of a software.
- 30Regression TestingTakes place after codes have been changed to ensure they are not affecting the security or functionality.
- 31How do you test security?Penetration testing.
- 32What is penetration testing?Is a method to evaluate the security of a computer system by simulating an attack from a malicious source known as a cracker.
- 33Difference between a pen-tester and a hacker?Pen's testers have prior approval from the Senior Management
Hackers have prior approvals from themselves.
Pen tester's social engineering attacks are to raise awareness and hackers will steal data. - 34What are the 5 key steps for a business's continuity plan?1. Business Impact analysis.
2. Risk assessment.
3. Resources requirements
4. Key information
5. Incident management. - 35What does business impact analysis include?Identify the business activities of your organisation.
Realistic timescale of each activity before it impacts when the activity cannot be performed.
What the impact could be. (Internal, extrernal, financial, legal) - 36What does risk assessment include?What are the risks of your business.
What resources are needed to recover.
Key information: Who are the key people you need.
Incident management: Who will response? - 37How can you deter security?Bench, guards and warning signs.
- 38How can you delay a risk from happening?Locks, security, barrier
- 39How can you detect a risk?Smoke detectors, CCTV
- 40How to assess a risk?Incident assessment process who does what to check whether a incident is a problem
- 41How to respond?Who responds to a incident.
How? - 42What is a baselineDoors, Walls, Floor, windows , ceilings.
Informationen
- Beschreibung
- Karteikarten am Remaining lectures, erstellt von xManisha12 . am 09/01/2017.
- Erstellt von
- xManisha12 .
- Aufrufe
- 0
- Bewertung