1 a) There is two categories of passive attacks: Traffic Analysis and release of message content. In a release of message contents attack, an eavesdropper listens and pursues information shared between two individuals. In traffic analysis attack, an eavesdropper hijacks the conversation between two parties and analysis the packets send between the two parties to find out passwords within those packets.
1b) There are four categories of active attacks: Masquerade, Replay, and modification of message and denial of service. In the first category of active attack that is the masquerade, the attacker pretends or impersonates a validly authorized entity and tries to gain access to data or get higher privileges. In the replay attack, a data packet is passively captured by the attacker and then retransmitted to deliver an unapproved, detrimental impact. Modification of message attack, this form of active attack happens when an authorized legitimate data packet is modified or altered. The altered packet has an unauthorized impact. Finally, in the denial of service attack, also known as DOS attack; the servers are overloaded so that the servers can no longer process legitimate authorized user requests. The user request is not fulfilled, and the users are denied access. Thus, communication management is repressed and broken down.
2a) For the first, impact on confidentiality is not applicable, impact on availability and integrity are moderate. Since information is already public, it is not confidential thus impact is small. Integrity and availability are moderate because the information needs to be correct, accurate, and trustworthy and be available whenever it’s needed.
2b) For the second, impact on confidentiality is high while the impact on availability and integrity is moderate because the information being handled is very sensitive. Therefore, it needs to be very private and accessible to only a few high authoritative figures. Integrity and availability are moderate because the information needs to be correct, accurate, and trustworthy and be available whenever it’s needed.
2c) For the third, impact on confidentiality, availability and integrity are low. The information is not private therefore there is no need for high confidentiality. The packets being send should be available routinely and should be accurate.
2d (i) For the fourth, impact on confidentiality and integrity of contract information is moderate while on availability its low. Information is both private and public and must be accurate thus confidentiality and integrity are moderate. Information only needs to be available when needed thus availability are low.
2d (ii) For administrative, the impact on confidentiality, availability and integrity is low. This is because information is only available when needed and information should be trustworthy accurate and private.
2d (iii) For acquisition, impact on confidentiality and integrity is moderate while on availability its low. It is because the information needs to be private and be accurate and trustworthy. The information should only be available when necessary
2e (i) Impact for the fifth asset is divided into three parts. For sensory data, impact on integrity and availability is high and on confidentiality is low.
2e (ii) For administrative, impact on all three is low.
2e (iii) For SCADA, integrity and availability are high while confidentiality is low.
3a) Security flaw is that the code is not written to counter the unexpected. If some unexpected error like “NOT_ENOUGH_MEMORY_AVAILABLE” comes than the security check fails and every user has full unrestricted access.
3b) If (dwRet == no_error) { // security_check_ok // do_something} else{//security_check_failed //information_user_that_acess_denied }
