Question 1

There are two commonly used modes of encryption implementations. Which mode does not encrypt parameters that different link devices use to synchronize communication methods?

Accepted Answer

Link encryption does not encrypt parameters that different link devices use to synchronize communication methods. Link encryption encrypts all the data along a specific communication path. Not only is the user information encrypted, but the header, trailers, addresses, and routing data that are part of the packets are also encrypted. Link encryption provides protection against packet sniffers and eavesdroppers. It is usually provided by service providers and is incorporated into network protocols. All of the information is encrypted and the packets must be decrypted at each hop so the router or other intermediate device knows where to send the packet next. Link encryption is sometimes called online encryption.

Question 2

There are two commonly used modes of encryption implantations. Which mode of encryption implementation enables attackers to learn about a captured packet and where it is headed?

Accepted Answer

End-to-end encryption enables attackers to learn about a captured packet and where it is headed. This is because the headers, addresses, routing, and trailer information are not encrypted. However, advantages include more flexibility to the user, higher granularity of functionality, and the network does not need to have a key to decrypt each packet. With end-to-end encryption, the packets do not need to be decrypted and then encrypted again at each hop because the headers and trailers are not encrypted. The devices in between the origin and destination just read the necessary routing information and pass the packets on their way. The encryption is usually initiated by the user of the originating computer.

Question 3

What algorithm enables two systems to exchange a symmetric key securely without requiring a previous relationship?

Accepted Answer

The Diffie-Hellman algorithm enables two systems to exchange a symmetric key securely without requiring a previous relationship. The algorithm allows for key distribution, but does not provide encryption or digital signature functionality. The algorithm is based on the difficulty of calculation discretion logarithms in a finite field. Although the Diffie-Hellman algorithm is vulnerable to a man-in-the-middle attack, it does not mean this type of compromise can take place anywhere this algorithm is deployed. Most implementations include another piece of software or a protocol that compensates for this vulnerability.

Question 4

Jack is happy that he has not had to pay for e-mail security since 1991 because of Phil Zimmerman. What email security does Jack use?

Accepted Answer

Pretty Good Privacy (PGP) was designed by Phil Zimmerman as a freeware e-mail security program and was released in 1991. It was the first widespread public key encryption program. PGP is a complete cryptosystem that uses cryptographic protection to protect e-mail and files. It can use RSA public key encryption for key management and use the IDEA symmetric cipher for bulk encryption of data, although the user has the option of picking different types of algorithms for these functions. PGP does not use a hierarchy of CAs or any type of format trust certificates, but instead relies on "web of trust" in its key management approach. Each user generates and distributes his or her public key and users sign each other's public keys, which creates a community of users who trust each other.

Question 5

Jeff keeps trying to successfully attack against an algorithm that has yet to be successfully attacked. What algorithm is Jeff attempting to attack?

Accepted Answer

The International Data Encryption Algorithm (IDEA) has yet to be successfully attacked. The IDEA is a bloc cipher and operates on 64-bit blocks of data. The 64-bit data block is divided into 16 smaller blocks and each has eight rounds of mathematical functions performed on it. The key is 128 bits long and IDEA is faster than DES when implemented in software. IDEA is used in the PGP and other encryption software implementations. It was through to replace DES, but it is patented, meaning that licensing fees would have to be paid to use it.

Question 6

Cryptography is really an issue of mathematics being used to create code into an undecipherable form or algorithms. What algorithm is easier to perform than to decipher?

Accepted Answer

One-way Functions are mathematical functions that are easier to compute in one direction than in the opposite direction. This concept is similar to how a one-way function is used in cryptography, which is what the RSA algorithm and all other asymmetric algorithms is based upon. When a one-way function is carried out in the easy direction, encryption and digital signature verification functionality are available. When the one-way function is carried out in the hard direction, decryption and signature generation functionality are available. This means only the public key can carry out encryption and signature verification and only the private key can carry out decryption and signature generation.

Question 7

Cryptography is really an issue of mathematics being used to create code into an undecipherable form or algorithms. Which algorithm is the most efficient, is mathematically rich, and uses the least resources?

Accepted Answer

The Elliptic Curve Cryptosystems (ECC) is the most efficient, is mathematically rich, and uses the least resources. The ECC provides digital signatures, secure key distribution, and encryption. ECC encryption functionality requires a smaller percentage of the resources, which makes it optimal for processing capacities, storage power supply, and bandwidth that affect wireless devices and cellular telephones. Compared to RSA, ECC offers the same level of protection with a key size that is shorter, even though in most circumstances, algorithms become more secure if the key is longer.

Question 8

Cryptography is really an issue of mathematics being used to put code into an undecipherable form or algorithms. Which algorithm takes a variable-length string and message and produces a fixed-length value?

Accepted Answer

A one-way hash is a function that takes a variable-length string and message and produces a fixed-length value called a hash value. This is called a message fingerprint. The secrecy of the one-way hashing function is its "one-wayness." The function is run in only one direction, not in reverse. The receiver does not attempt to reverse the process at the other end, but instead runs the same hashing function one way and compares the two results. The hashing one-way function takes place without the use of any keys. At this point, the function is called MAC.

Question 9

What prevents a pattern in Cipher Block Chaining mode by taking the value of one block and adding it to the next block value within the algorithm?

Accepted Answer

Cipher Block Chaining (CBC) prevents a pattern in Cipher Block Chaining mode by taking the value of one block and adding it to the next block value within the algorithm. This results in more random ciphertext. Ciphertext is extracted and used from the previous block of text. This provides dependence between the blocks, in a sense, chaining them together. This continues through the entire message and provides the necessary randomness that allows CBC to be used to encrypt large files and prevents an attacker from reverse-engineering and uncovering the key.

Question 10

Often, information security experts just focus on attacks through a port, modem, or wireless access port and overlook the possibility of physical attacks. What would be considered a physical attack?

Accepted Answer

Politically-motivated threats and manmade attacks are considered physical attacks. Physical attacks are broken into four groups: 1) Natural environmental threats, including floods, earthquakes, storms and tornadoes, fires, extreme temperature conditions, etc. 2) Supply systems threats, including power distribution outages, communications interruptions, and interruption of other natural energy resource such as water, steam, or gas. 3) Manmade threats are unauthorized access, explosions, damage by angry employees, employee errors and accidents, vandalism, fraud, and theft. 4) Politically-motivated threats, including strikes, riots, civil disobedience, terrorist attacks, and bombings.

Question 11

Peter has been hired by XYZ Corp. to design their new building. Peter is an expert in environmental design and crime. What discipline is practiced by Peter?

Accepted Answer

Crime Prevention through Environmental Design (CPTED) is a discipline that outlines how the proper design of a physical environment can reduce crime by directly affecting human behavior. The crux of CPTED is that the physical environment can be manipulated to create behavioral effects that will reduce crime and fear of crime. It looks at the components that make up the relationship between humans and their environment. This encompasses the physical, social, and psychological needs of the users of different types of environments and predictable behavior of these users and offenders.

Question 12

Environmental risks are always at hand and human behavior is unpredictable. What is usually the first line of defense?

Accepted Answer

A fence is usually the first line of defense. Although many focus on information security at the computer level, they often fail to understand that physical security protects information. Fences provide a barrier between a building and a potential intruder that may vandalize, steal, or attack property. However, artificial barriers often restrict the use, enjoyment, and aesthetics of an environment; thus, creating an environment that is uncomfortable to work in. limits creativity. Crime Prevention through Environmental Design experts should be employed to determine the best security options.

Question 13

Crime Prevention through Environmental Design (CPTED) professionals have three main strategies to protect properties. Which is not one of them?

Accepted Answer

Crime Prevention through Environmental Design (CPTED) does not have a people placement control strategy. CPTED uses natural access control, natural surveillance, and natural territorial reinforcement as strategies. Natural access control is the guidance of people entering and leaving a space by the placement of doors, fences, lighting, and landscaping with the goal of clear lines of site to deter potential offenders. Natural surveillance uses security guards, mechanical means (such as CCTV), and natural strategies such as low landscaping and raised entrances with the goal of making criminals feel uncomfortable by providing many ways observers could potentially see them and to make all other people safe and comfortable by providing open and well-designed environments. Natural territorial reinforcement creates physical designs that emphasize or extend the company's physical sphere of influence so legitimate users feel a sense of ownership of that space by implementing the use of walls, fences, landscaping, flags, etc. The goal is to create a sense of a dedicated community.

Question 14

What should not be used in protected areas and are used to create barriers between areas?

Accepted Answer

Internal compartments should not be used in protected areas or to create barriers between areas. Internal partitions are used to create barriers between one area and another. These partitions can be used to segment separate work areas, but should never be used in protected areas that house sensitive systems and devices. Many buildings have dropped ceilings, meaning the interior partitions do not extend to the true ceiling-only to the dropped ceiling. An intruder can lift a ceiling panel and climb over the partition. In many situations, this would not require forced entry, specialized tools, or much effort. These types of internal partitions should not be relied upon to provide protection for sensitive areas.

Question 15

Electric power is necessary for modern life. Companies must understand power issues to protect their computer systems. When clean power is used, there is no interference or voltage fluctuation. What is the proper term for line noise?

Accepted Answer

The proper term for line noise is electromagnetic interference. Electromagnetic interference is disturbance to the flow of electric power while it travels across a power line. Electromagnetic interference can be created by the difference between three wires: hot, neutral, and ground, and the magnetic field they create. Lightning and electrical motors can induce electromagnetic interference, which could then interrupt the proper flow of electrical current as it travels over wires to, from, and with buildings.

Question 16

What does a device using a metal oxide varistor protect against?

Accepted Answer

Metal oxide varistors protect against power surges. A surge is a prolonged rise in voltage from a power source. Surges can cause a lot of damage very quickly. A surge is one of the most common power problems and is controlled with surge protectors. The metal oxide varistor moves the excess voltage to ground when a surge occurs. Its source can be from a strong lightning strike, a power plant going online or offline, a shift in the commercial utility power grid, and electrical equipment within a business starting and stopping.

Question 17

What do constant voltage transformers regulate?

Accepted Answer

Constant voltage transformers regulate brownouts. Brownouts are caused by a reduction in voltage. This happens when power companies are experiencing high demand and reduce the voltage in an electrical grid. Constant voltage transformers are used to regulate this fluctuation of power. They can use different ranges of voltage and only release the expected 120 volts of alternating current to devices.

Question 18

It has been raining on and off the last month and extremely hot on some days. There has been a lot of static and it appears that one of the wires at your desk is corroding. What can cause these two problems?

Accepted Answer

When humidity is high it can cause corrosion, while low humidity can cause excessive static electricity that can cause the loss of information and short out devices. Maintaining appropriate temperature and humidity is important in any facility. Humidity should be kept between 40% and 60% and temperatures should be between 70°F and 74°F.

Question 19

What type of air-conditioning system maintains air quality and lessens contaminants?

Accepted Answer

Closed-loop air-conditioning systems maintain air quality and lessen contaminants. Closed-loop means the air within the building is reused after it has been proper filtered, instead of bringing outside air in. Positive pressurization and ventilation should be used in addition to closed-loop systems to further control contamination. Positive pressurization allows air to go out while preventing outside air from coming when a door is opened.

Question 20

What type of lock provides protection from bystanders learning a set code?

Accepted Answer

Cipher locks provide protection from bystanders learning a set code. Cipher locks are also known as programmable locks, are keyless, and use keypads to control access into an area or facility. The lock requires a specific combination to be entered into the keypad and possibly a swipe card. These locks usually have a corresponding visibility shield so a bystander cannot see the combination as it is keyed in. Automated cipher locks must have a backup battery system and be set to unlock during a power failure so personnel are not trapped inside during an emergency.

Quiz 4: Engineering