Principles of Information Security, 4th Edition
1 Chapter 1
1 Review Questions
1. What is the difference between a threat agent and a threat?
A threat agent is the facilitator of an attack, whereas a threat is a category of objects, persons, or other entities that represents a potential danger to an asset. Threats are always present. Some threats manifest themselves in accidental occurrences and others are purposeful. Fire is a threat; however, a fire that has begun in a building is an attack. If an arsonist set the fire then the arsonist is the threat agent. If an accidental electrical short started the fire, the short is the threat agent.
2. What is the ...view middle of the document...
These three components are frequently used to conveniently articulate the objectives of a security program that must be used in harmony to assure an information system is secure and usable.
6. If the C.I.A. triangle is incomplete, why is it so commonly used in security?
The CIA triangle is commonly used in security because it addresses the fundamental concerns of information: confidentiality, integrity, and availability. It is still used when not complete because it addresses all of the major concerns with the vulnerability of information systems.
7. Describe the critical characteristics of information. How are they used in the study of computer security?
The critical characteristics of information define the value of information. Changing any one of its characteristics changes the value of the information itself. There are seven characteristics of information:
• Availability enables authorized users - either persons or computer systems - to access information without interference or obstruction, and to receive it in the required format.
• Accuracy occurs when information is free from mistakes or errors and it has the value that the end user expects.
• Authenticity of information is the quality or state of being genuine or original, rather than a reproduction or fabrication. Information is authentic when it is in the same state in which it was created, placed, stored, or transferred.
• Confidentiality is achieved when disclosure or exposure of information to unauthorized individuals or systems is prevented. Confidentiality ensures that only those with the rights and privileges to access information are able to do so.
• Integrity of information is maintained when it is whole, complete, and uncorrupted.
• Utility of information is the quality or state of that information having value for some purpose or end. Information has value when it serves a particular purpose.
• Possession of information is the quality or state of ownership or control of some object or item. Information is said to be in one’s possession if one obtains it, independent of format or other characteristics.
8. Identify the six components of an information system. Which are most directly affected by the study of computer security? Which are most commonly associated with its study?
The six components are software, hardware, data, people, procedures, and networks.
People would be impacted most by the study of computer security. People can be the weakest link in an organization’s information security program. And unless policy, education and training, awareness, and technology are properly employed to prevent people from accidentally or intentionally damaging or losing information, they will remain the weakest link. Social engineering can prey on the tendency to cut corners and the commonplace nature of human error. It can be used to manipulate the actions of...