You are an information systems security officer at a mid-sized business and are called upon to investigate a threat conveyed in an email from one employee to another. You gather the evidence from both the email server transaction logs and from the computers of the two individuals involved in the incident and prepare an executive summary. You find that a threat was sent from one user to the other in a digitally signed email. The sender of the threat says he didn't send the email in question. What concept of PKI - Public Key Infrastructure will implicate the sender?
Correct Answer: A
PKI - Public Key Infrastructure is an infrastructure of hardware, software, people, policies and procedures that makes use of the technology to provide some sort of confidentiality, integrity and authenticity as well as non-repudiation in our daily digital lives. In the case of the email threat, the fact that the email was digitally signed by the sender proves that he is guilty of conveying the threat. Non-repudiation is the aspect of PKI that proves that nobody else could have digitally signed the email using his private key that exists only on his identity card. In the Digital World: Regarding digital security, the cryptological meaning and application of non-repudiation shifts to mean: A service that provides proof of the integrity and origin of data. An authentication that can be asserted to be genuine with high assurance . Proof of data integrity is typically the easiest of these requirements to accomplish. A data hash, such as SHA2, is usually sufficient to establish that the likelihood of data being undetectably changed is extremely low. Even with this safeguard, it is still possible to tamper with data in transit, either through a man-in-the-middle attack or phishing. Due to this flaw, data integrity is best asserted when the recipient already possesses the necessary verification information. The most common method of asserting the digital origin of data is through digital certificates, a form of public key infrastructure, to which digital signatures belong. They can also be used for encryption. The digital origin only means that the certified/signed data can be, with reasonable certainty, trusted to be from somebody who possesses the private key corresponding to the signing certificate. If the key is not properly safeguarded by the original owner, digital forgery can become a major concern. The following answers are incorrect: -The digital signature of the recipient: No, this isn't right. The recipient's signature won't indict the sender of the threat. The sender's digital signature will prove his involvement. -Authentication: This is incorrect. Authentication is the process of proving one's identity. -Integrity: Sorry, this isn't the right answer either. Integrity in PKI only verifies that messages and content aren't altered in transit. The following reference(s) was used to create this question: http://en.wikipedia.org/wiki/Non-repudiation
Question 787
Which of the following is not an example of an operational control?
Correct Answer: B
Audit Trails are under Operations Security Auditing opposed to Operations Security Operations Controls. "Operations Controls embody the day-to-day procedures used to protect computer operations. The concepts of resource protection, hardware/software control, and privileged entity must be understood by the CISSP candidate." Pg. 311 Krutz: The CISSP Prep Guide: Gold Edition
Question 788
Which OSI/ISO layer is the Media Access Control (MAC) sublayer part of?
Correct Answer: C
The data link layer contains the Logical Link Control sublayer and the Media Access Control (MAC) sublayer. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, John Wiley & Sons, 2001, Chapter 3: Telecommunications and Network Security (page 83).
Question 789
A software interface to the operating system that implements access control by limiting the system commands that are available to a user is called a(n):
Correct Answer: B
Answer Interrupt refers to a software or hardware interrupt to a processor that causes the program to jump to another program to handle the interrupt request. Before leaving the program that was being executed at the time of the interrupt, the CPU must save the state of the computer so that the original program can continue after the interrupt has been serviced. *A physically constrained user interface is one in which a user's operations are limited by the physical characteristics of the interface device. An example would be a keypad with the choices limited to the operations permitted by each key. *View refers to database views, which restrict access to information contained in a database through content-dependent access control.
Question 790
Which of the following are the steps usually followed in the development of documents such as security policy, standards and procedures?
Correct Answer: C
The common steps used the development of security policy are initiation of the project, evaluation, development, approval, publication, implementation, and maintenance. The other choices listed are the phases of the software development life cycle and not the step used to develop ducuments such as Policies, Standards, etc... Reference: TIPTON, Harold F. & KRAUSE, MICKI, Information Security Management Handbook, 4th Edition, Volume 3, 2002, Auerbach Publications.
