Similarly, there is a trade-off between access and confidentiality; that is, a system meeting standards for access allows authorized users access to information resources on an ongoing basis. The emphasis given to confidentiality, integrity, and access depends on the nature of the application. An individual system may sacrifice the level of one requirement to obtain a greater degree of another. For example, to allow for increased levels of availability of information, standards for confidentiality may be lowered. Thus, the specific requirements and controls for information security can vary.
Passwords and controls also involve trade-offs, but at a lower level. Passwords require deciding between system-generated passwords, which can offer more security than user-generated passwords because system-generated passwords are randomly generated pseudo words not found in the dictionary. However, system-generated passwords are harder to remember, forcing users to write them down, thus defeating the purpose. Controls require selecting between a manual and automated control or selecting a combination of manual and automated controls. One control can work as a compensating control for the other.
233. Ensuring data and program integrity is important. Which of the following controls
a. File placement controls
b. Data file naming conventions
c. Program library controls
d. Program and job naming conventions
File placement controls ensure that files reside on the proper direct access storage device so that data sets do not go to a wrong device by accident. Data file, program, and job naming conventions implement the separation of duties principle by uniquely identifying each production and test data file names, program names, job names, and terminal usage.
234. Which of the following pairs of high-level system services provide controlled access to networks?
a. Access control lists and access privileges
b. Identification and authentication
c. Certification and accreditation
d. Accreditation and assurance
Access control list (ACL) and access privileges do not provide controlled access to networks because ACL is a list of the subjects that are permitted to access an object and the access rights (privileges) of each subject. This service comes after initial identification and authentication service.
Certification and accreditation services do not provide controlled access to networks because certification is the administrative act of approving a computer system for use in a particular application. Accreditation is the management’s formal acceptance of the adequacy of a computer system’s security. Certification and accreditation are similar in concept. This service comes after initial identification and authentication service.
Accreditation and assurance services do not provide controlled access to networks because accreditation is the management’s formal acceptance of the adequacy of a computer system’s security. Assurance is confidence that a computer system design meets its requirements. Again, this service comes after initial identification and authentication service.
235. Which of the following is not subjected to impersonation attacks?
a. Packet replay
b. Forgery
c. Relay
d. Interception