Deck 11: Intruders

Question 1

The three classes of intruders identified by Anderson are: Masquerader, Misfeasor, and _________ .

Answer 1

Clandestine user

Question 2

Intrusion detection involves detecting unusual patterns of activity or patterns of activity that are known to correlate with intrusions.

Answer 2

True

Question 3

Password crackers rely on the fact that some people choose easily guessable passwords.

Answer 3

True

Question 4

Unauthorized intrusion into a computer system or network is one of the most serious threats to computer security.

Question 5

Password files can be protected in one of two ways: one-way function or __________ .

Question 6

_________ detection involves the collection of data relating to the behavior of legitimate users over a period of time.Statistical tests are applied to observed behavior to determine with a high level of confidence whether that behavior is not legitimate user behavior.

Question 7

System administrators can stop all attacks and hackers from penetrating their systems by installing software patches periodically.

Question 8

One important element of intrusion prevention is password management.

Question 9

Penetration identification is an approach developed to detect deviation from previous usage patterns.

Question 10

To be of practical use an intrusion detection system should detect a substantial percentage of intrusions while keeping the false alarm rate at an acceptable level.

Question 11

The ID determines the privileges accorded to the user.

Question 12

The main advantage of the use of statistical profiles is that a prior knowledge of security flaws is not required.

Question 13

Trojan horses and viruses are confined to network based attacks.

Question 14

Statistical approaches attempt to define proper behavior and rule- based approaches attempt to define normal or expected behavior.

Question 15

__________ systems have been developed to provide early warning of an intrusion so that defensive action can be taken to prevent or minimize damage.

Question 16

Traditional hackers usually have specific targets, or at least classes of targets in mind.

Question 17

The hacking community is a strong meritocracy in which status is determined by level of competency.

Question 18

A weakness of the IDES approach is its lack of flexibility.

Question 19

Insider attacks are among the easiest to detect and prevent.

Question 20

Metrics that are useful for profile-based intrusion detection are: counter, gauge, resource utilization, and _________ .

Question 21

A fundamental tool for intrusion detection is the _________ record.

Question 22

_________ identification takes a very different approach to intrusion detection.The key feature of such systems is the use of rules for identifying known penetration or penetrations that would exploit known weaknesses.Typically the rules used in these systems are specific to the machine and operating system.

Question 23

Designed to lure a potential attacker away from critical systems ____________ are decoy systems that divert an attacker from accessing critical systems, collect information about the hacker's activity, and encourage the attacker to stay on the system long enough for administrators to respond.

Question 24

One of the most important results from probability theory is known as ________ which is used to calculate the probability that something really is the case, given evidence in favor of it.

Question 25

_________ is based on the assumption that the behavior of the intruder differs from that of a legitimate user in ways that can be quantified.

Question 26

_________ techniques detect intrusion by observing events in the system and applying a set of rules that lead to a decision regarding whether a given pattern of activity is or is not suspicious.

Question 27

Two types of audit records used are Detection-specific audit records and _________ audit records.

Question 28

A _________ strategy is one in which the system periodically runs its own password cracker to find guessable passwords.

Question 29

An example of a metric used for profile-based intrusion detection is _________ which is a non-negative integer that may be incremented but not decremented until it is reset by management action.Examples include the number of logins by a single user during an hour, the number of times a given command is executed during a single user session, and the number of password failures during a minute.

Question 30

The focus of the __________ is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems and to management that may need to interact with them.