Security Engineering

Question 1

Application security

Answer 1

• The application is designed to resist attacks.

Question 2

Infrastructure security

Answer 2

• The software is configured to resist attacks.

Question 3

Security dimensions

Answer 3

• Confidentiality
• Integrity
• Availability

Question 4

Three controls to enhance system security

Answer 4

• Vulnerability avoidance
• Attack detection and neutralization
• Exposure limitation and recovery

Question 5

Stages of preliminary risk assessment

Answer 5

• Asset value assessment/exposure assessment
• Threat identification/attack assessment
• Control identification
• Security requirements definition

Question 6

Operational security

Answer 6

• Primarily a human and social issue

Question 7

Security trade off

Answer 7

• More secure system, less usable

Question 8

Protection issues in system design

Answer 8

• How should the system be organized so that critical assets can be protected against an external attack?

Question 9

Distribution issues in system design

Answer 9

• How should system assets be distributed so that the effects of a successful attack are minimized?

Question 10

Design guidelines for secure systems engineering:

Answer 10

• Base security decisions on an explicit security policy.
• Avoid a single point of failure.
• Use redundancy and diversity to reduce risk.
• Validate all inputs.

Question 11

Experience-based testing

Answer 11

• The system is analyzed against known types of attack.

Question 12

Penetration testing

Answer 12

• An external team is contracted to discover security flaws in a system.

Question 13

Tool-based testing

Answer 13

• Tools are used to exhaustively test some features of a system, such as the strength of passwords.

Question 14

Formal verification

Answer 14

• A system is formally verified against a formal security specification.

Question 15

Interception threats

Answer 15

• Allows attacker to gain access to an asset

Question 16

Interruption threats

Answer 16

• Make part or all of a system unavailable

Question 17

Modification threats

Answer 17

• Attacker tampers with a system asset

Question 18

Fabrication threats

Answer 18

• Insert false information in the system

Question 19

Security specification

Answer 19

• Avoid something bad happening