Applied Information Security

Question 1 :Chapter 1

1.1 What is the difference between a threat agent and a threat?A threat is a constant danger to an asset, whereas a threat agent is the facilitator of an attack.

1.2 What is the difference between vulnerability and exposure? Vulnerability is a fault witin the system, such as software package flaws, unlocked doors or an unprotected system port. It leaves things open to an attack or damage. 

Exposure is a single instance when a system is open to damage. Vulnerabilities can in turn be the cause of exposure.

1.3 Describe the critical characteristics of information. How are they used in the study of computer security?

* Availability: Authorised users can access the information

* Accuracy: free from errors

* Authenticity: genuine

* Confidentiality: preventing disclosure to unauthorized individuals.

* Integrity: whole and uncorrupted.

* Utility: has a value for some purpose

* Possession: Ownership

1.4 Identify the six components of an information system. Which are most directly affected by the study of computer security? Which are most commonly associated with its study?

* Software :  This is the most difficult part of the system to secure, 

because most software used is written by third parties. Also, since 

the software field is so competitive, many products are rushed to 

market before they have been thoroughly tested and debugged. These 

bugs and “security holes” quickly are discovered by members of the 

hacking community and soon information is spread about “exploits” that 

take advantage of those “holes,” which are then implemented by 

unscrupulous individuals. 

* Hardware: This is specifically the computers themselves. While 

there are very few ways to use hardware directly to defeat security, 

the data stored on the hardware can be stolen by the simple expedient 

of stealing the hardware itself. Laptop computers are especially 

vulnerable to theft. ...