1. Midterm Review Questions SOEN321 – Information-Systems Security

2. Trust What is Trust Model? –Its entities? –Implications?

3. Trust What is a trustworthy NIS? How can trustworthiness be achieved? –SOEN –Social –Detection/reaction What does trustworthiness include? –Correctness –Availability –…? :-)

4. Terminology What is –A vulnerability [tr1, tu1] –An attack [tr1, tu1] –An attacker [tu1] –A threat [tr1, tu1]

5. CIA N IS Requirements: CIA N What’s is it? –C … ? –I … ? –A … ? Related: non-repudiation

6. Terminology (2) Risk[tr2, tu1] –A combo of what? Risk management[tr2, tu1] Red teaming[tr2, tu1]

7. Concepts Cryptography Hashing Encryption

8. Crypto Symmetric Asymmetric

9. Protection and OS Security Protection? What does it provide? –… Access control –Authent. –Authorization Security policy

10. Protection and OS Security (2) What is UNIX Security Model? –Roles (accounts)? –Access control? –What are real and effective UID? Which one more important? –Permissions? –Suid-root programs & shell script –Password database NFS and file handles

11. Inside and Outside of your computer What is a security perimeter? Computer Security vs. Network Security Sandboxes and chrooted environment (WRT file and network access) Firewalls – What? Why? Where? –What they do and don’t do.

12. Inside and Outside of your computer (2) What does networking change? –Connectivity –New programs –Daemons –RPC –-> new holes

13. Know the differences… Security vs. Crypto Encryption vs. Hashing Discretionary vs. Mandatory Access controls Accidental vs. Deliberate causes of IS problems. In terms of –Scale –Harm –“Visibility” –… Computer Security vs. Network Security

14. Bellovin’s Firewall Theorems 1 2 3