CISSP Practice

Similarly, there is a trade-off between access and confidentiality; that is, a system meeting standards for access allows authorized users access to information resources on an ongoing basis. The emphasis given to confidentiality, integrity, and access depends on the nature of the application. An individual system may sacrifice the level of one requirement to obtain a greater degree of another. For example, to allow for increased levels of availability of information, standards for confidentiality may be lowered. Thus, the specific requirements and controls for information security can vary.

Passwords and controls also involve trade-offs, but at a lower level. Passwords require deciding between system-generated passwords, which can offer more security than user-generated passwords because system-generated passwords are randomly generated pseudo words not found in the dictionary. However, system-generated passwords are harder to remember, forcing users to write them down, thus defeating the purpose. Controls require selecting between a manual and automated control or selecting a combination of manual and automated controls. One control can work as a compensating control for the other.

233. Ensuring data and program integrity is important. Which of the following controls best applies the separation of duties principle in an automated computer operations environment?

a. File placement controls

b. Data file naming conventions

c. Program library controls

d. Program and job naming conventions

233. c. Program library controls enable only assigned programs to run in production and eliminate the problem of test programs accidentally entering the production environment. They also separate production and testing data to ensure that no test data are used in normal production. This practice is based on the “separation of duties” principle.

File placement controls ensure that files reside on the proper direct access storage device so that data sets do not go to a wrong device by accident. Data file, program, and job naming conventions implement the separation of duties principle by uniquely identifying each production and test data file names, program names, job names, and terminal usage.

234. Which of the following pairs of high-level system services provide controlled access to networks?

a. Access control lists and access privileges

b. Identification and authentication

c. Certification and accreditation

d. Accreditation and assurance

234. b. Controlling access to the network is provided by the network’s identification and authentication services, which go together. This service is pivotal in providing controlled access to the resources and services offered by the network and in verifying that the mechanisms provide proper protection. Identification is the process that enables recognition of an entity by a computer system, generally by the use of unique machine-readable usernames. Authentication is the verification of the entity’s identification. That is when the host, to whom the entity must prove his identity, trusts (through an authentication process) that the entity is who he claims to be. The threat to the network that the identification and authentication service must protect against is impersonation.

Access control list (ACL) and access privileges do not provide controlled access to networks because ACL is a list of the subjects that are permitted to access an object and the access rights (privileges) of each subject. This service comes after initial identification and authentication service.

Certification and accreditation services do not provide controlled access to networks because certification is the administrative act of approving a computer system for use in a particular application. Accreditation is the management’s formal acceptance of the adequacy of a computer system’s security. Certification and accreditation are similar in concept. This service comes after initial identification and authentication service.

Accreditation and assurance services do not provide controlled access to networks because accreditation is the management’s formal acceptance of the adequacy of a computer system’s security. Assurance is confidence that a computer system design meets its requirements. Again, this service comes after initial identification and authentication service.

235. Which of the following is not subjected to impersonation attacks?

a. Packet replay

b. Forgery

c. Relay

d. Interception