|
(a) Physical, temporal, cryptographic
and logical separation are four methods for separating one process
from others. Give an example (not a description) of each method. [4]
Some example:
physical: running critical processes on computers not connect to
a network.
temporal: running critical processes at night, when other activity
is prohibited;
cryptographic: password protection for access to critical code and
data;
logical: separate address spaces, especially for critical
processes.
(1 mark each; accept any reasonable example, but do not accept just
a
general description).
(b) The recent ILOVEYOU virus distributed
itself by reading a user’s address book and sending copies of
itself as email attachments to addresses found there; it was activated
by clicking on the attachment received.
(i) Why is this method of distribution very effective? [1]
Ans: The infected message is likely to come
from someone known to the recipient, so does not arouse suspicion.
(ii) What steps could be taken in the design of the operating system
to
prevent such a distribution method? [2]
Ans: Code should have different levels of
trust; (1 mark)
the address book should not be accessible to untrusted code (1 mark)
(be flexible; accept alternative answers.)
(iii) Why is this method of activation so successful? [1]
Ans: The same action used to activate the
virus (a simple click) is used
for innocuous attachments such as pictures too.
(iv) What steps could be taken to make activation of such viruses
less likely? [2]
Ans: Safe attachments (data) should be clearly
distinguished from
unsafe ones (programs, scripts, macros); (1 mark)
it should be harder to execute code than to view data. (1 mark)
(Again, be flexible, accept alternative answers.)
(c) When do we say a system is secure?
What are the two basic methods by which the computer system security
provides protection? Provide at least one example in each case. [5]
- The system is secure, when the computer
does what its supposed to
do, even if its users don’t do what they are supposed to do (1
mark)
- System Access Control, (1 mark)
eg; identification and authentication (1 mark)
- Data Access Control, (1 mark)
eg; discretionary access control or Mandatory access control (1 mark)
Accept suitable alternative answers.
|