IT Computer Security

Chapter 3
1. (60%) Assume an 8-letter password from the 95 printable ASCII characters is used in a computer system.
a. If passwords are chosen by the users, what is the total password population? What is the probability of an adversary guessing a password correctly?
b. If passwords are generated automatically by a pseudorandom number generator, what is the total password population? What is the probability of an adversary guessing a password correctly?

2. (40%) Explain why, for the biometric authentication protocols, the biometric capture device is authenticated in the case of static biometric but not authenticated for a dynamic biometric.

Chapter 4
1. (25%) UNIX treats file directories in the same fashion as files; that is, both are defined by the same type of data structure, called an inode. As with files, directories include a nine-bit protection string. If care is not taken, this can create access control problems. For example, consider a file with protection mode 644 (octal) contained in a directory with protection mode 730. How might the file be compromised in this case?
(25%) Consider user accounts on a computer system with a Web server configured to provide user Web areas. In general, this uses a standard directory name, such as “public_html,” in a user’s home directory. However, access control needs to be properly set to allow users (with or without user accounts on the system) to browse the webpages. Assuming there are one main page (index.html), two pictures files (a.jpg and b.jpg) stored in an sub-directory (Image) and one pdf file (c.pdf) stored in an sub-directory (Doc), all under the public_html. Specify the access control for each directory and files that allows everyone to view the webpage.

(50%) For the DAC model discussed in Section 4.3, an alternative representation of the protection state is a directed graph. Each subject and each object in the protection state is represented by a node (a single node is used for an entity that is both subject and object). A directed line forms a subject to an object indicates an access right, and the label on the link defines the access right.
Draw a directed graph that represented to the access matrix of Figure 4.2a.
Draw a directed graph that represented to the access matrix of Figure 4.3.
Is there a one-to-one correspondence between the directed graph representation and the access matrix representation? Explain your answer.

Last Completed Projects