CS 450/650 Fundamentals of Integrated Computer Securit

Spring 2010

Homework 4 : O.S. and Network Security

Due on Friday, May 7 at 11:00 am

1 : What is the recent controversy regarding Facebook and why it is important?

The following problems are from the text book (Pfleeger, 4th edition):

Chapter 4:

3 : Give an example of an object whose security level may change during execution.

10 : If two users share access to a segment, they must do so by the same name. Must their protection rights to it be the same? Why or why not?

19 : List two disadvantages of using physical separation in a computing system. List two disadvantages of using temporal separation in a computing system.

Chapter 5:

5 : Can a user cleared for <secret;{dog, cat, pig}> have access to documents classified in each of the following ways under the military security model?

<top secret;dog>
<secret;{dog}>
<secret;{dog,cow}>
<secret;{moose}>
<confidential;{dog,pig,cat}>
<confidential;{moose}>

6 : According to the BellLa Padula model, what restrictions are placed on two active subjects (for example, two processes) that need to send and receive signals to and from each other? Justify your answer.

Chapter 7:

10 : List the major security issues dealt with at each level of the OSI protocol stack.

19 : A port scanner is a tool useful to an attacker to identify possible vulnerabilities in a potential victim's system. Cite a situation in which someone who is not an attacker could use a port scanner for a nonmalicious purpose.

22 (partial) : How many 4-digit numeric PINs are there? Suppose a ban prohibits "obvious" PINs like 0000 and 1234. What would you define as "obvious," and how many PINs would that disallow?

24 : Suggest a countermeasure for traffic flow analysis.

What to turn in: A softcopy of your solutions (could be a scanned version of the hard copy of the solutions) to be uploaded to WebCT.