DC2004, Chapter 11 Checkpoint Solution

This page modified on 01/02/04.

1. (e) System failure is the prolonged malfunction of a computer.
2. (a) Computer viruses, worms, and Trojan horses negatively alter a computer's operations.
3. (f) Unauthorized access and use is using a computer without permission.
4. (b) Hardware theft is stealing computer equipment.
5. (d) Software theft is stealing or illegally copying software.
6. (c) Information theft is stealing confidential information.

1. (b) quarantine: Area of the hard disk that holds an infected file until the infection is removed.
2. (h) recovery disk: Contains an uninfected copy of key commands and startup information.
3. (i) cracker: Someone who tries to access a computer or network illegally.
4. (c) personal firewall: Protects a personal computer from unauthorized intrusions.
5. (l) password: Private combination of characters associated with a user name.
6. (f) biometric device: Translates a personal characteristic into digital code.
7. (k) de(en)cryption key: programmed formula that a data recipient uses to decrypt ciphertext.
8. (j) certificate authority (CA): Company that issues and verified digital certificates.

1a. How do antivirus programs detect and identify a virus?

Detection:

Identification:

1b. What is a virus hoax?

    A virus hoax is an e-mail message that warns users of a nonexistent virus. [Worm and Trojan Horse are types of viruses.]

2a. How is identification different from authentication?

In network security,

2b. What are four methods of identification and authentication?

3a. What does a single user license agreement typically permit users to do?

3a. What conditions typically are included in a single-user license agreement?

3b. What does it not permit users to do?

4a. How is a brownout different from a blackout?

4b. How is a standby UPS different from an online UPS?

5a. How is a full backup different from a selective backup?

5b. What is a three-generation backup policy?

    Preserves three generations of backups of important files. [This is really wise for important files.  When you do your senior honors thesis, use the three-generation backup policy.]

1.a.  What is an Internet appliance?

    An Internet appliance, also called an information appliance, is a computer with limited functionality whose main purpose is to connect to the Internet from home.  A popular Internet appliance is a set-top box, such as WebTV.

    An Internet appliance is a special case of a network computer, characterized by no secondary storage devices such as a hard disk or floppy disk.  

1.b.  Why would someone want to use one of these devices?

    A motivation for using one of these devices is to surf the Web without buying a more expensive general purpose computer.

2.a.  What is CBT?

    Computer-Based Training, also called Computer-Aided Instruction (CAI), is the application of a computer to the instructional process.  Sophistication and cost varies greatly.

2.b.  What are some advantages of CBT?

    Computer-based training is (often much) more expensive to produce and deliver.  Compared to classroom lecture based teaching, computer-based training requires an order of magnitude more effort to do well.  It takes at least ten times the man hours to produce a CBT course as it does to produce a live classroom course. Unlike a live classroom, adaptive teaching requires you to think through in advance all the possible questions a student might ask.  In a live classroom, a teacher needs to spend adaptive time responding to questions that actually get asked. If video taping in a studio is involved, the production cost skyrockets. The cost of this approach is only recovered if enough students use it.

    CBT is cost effective for subjects at a level that are well established, such as undergraduate mathematics. Once the learning modules are constructed, they can be used for long periods of time without additional manpower required.

    CBT can be cost effective for subject areas in which there are not enough experts to satisfy demand, even if the subject area is changing rapidly.

    Some computer-based training requires specialized computer hardware and sometimes attached simulation devices.  Not all computer-based training is PC-based.

2.c.  How do simulations help someone learn?

    Simulations, or computer-based models of real-life situations, allow students to learn skills in hazardous, emergency, or other situations.  

3.a.  What is e-commerce?

    Electronic commerce is a financial business transaction that occurs over an electronic network such as the Internet.

3.b.  How has it changed the way in which an organization does business?

    E-commerce virtually eliminates the barriers of time and distance that slow traditional transactions.

3.c.  What are some examples of e-commerce transactions?

    Examples of e-commerce transactions include retail sales of goods and services, auctions, gambling, barter, financial management, online banking, insurance transactions, billing and payment for separately delivered goods and services, and stock trading.

4.a.  What is a global positioning system (GPS)?

    The global positioning system is a system of satellites, a local receiver, and software that computes the location of the receiver.

4.b.  What are some advantages of a GPS?

    A GPS system is used for automatic position determination and as an aid to navigation.  

    Use of GPS receivers in the trucking and shipping industry has significantly reduced theft and aided recovery of stolen containers and trailers.  GPS is very helpful for emergency services navigation, such as fire, police, rescue, medical doctor, etc., to get help to the desired location.  It is a luxury item in some privately owned vehicles.

    GPS units are sometimes combined with other computer devices for remote use.

5.a.  What is the digital divide?

    The digital divide is the idea that you can separate people of the world into two distinct groups: (a) those who have access to technology with the ability to use it and (2) those who do not have access to technology or are without the ability to use it.  Technology includes items such as telephones, television, computers, and the Internet.

5.b.  What agencies and companies are working to eliminate the divide?

    The text cites Microsoft, Toshiba, Gateway, AOL, Hewlett-Packard, Federal Communications Commission as taking actions to make technology more widely available.

5.c.  What programs have been launched in an effort to eliminate the digital divide?

    Microsoft and Toshiba's Anytime Anywhere Learning program provides teachers and students with notebook computers equipped with Microsoft Office.  Gateway's Teach America! program provides online computer training to teachers.  Gateway's PowerUp program seeks to place technology in schools and community centers.  AOL offered free Internet access accounts at PowerUp sites.  Hewlett-Packard invested in a building to provide technology training to low-income Californians.  The Federal Communications Commission offered telephone service to Native Americans for $1 per month.

5a. Why do Web sites use cookies?

5b. What cookie-related practice often is considered unethical?

3a.  How is an electronic book different from an e-book?

3b.  What is a how-to guide?

    A "how-to guide" is a computer-based manual that can include a tutorial, guided procedures (like a Microsoft Wizard), and interactive instruction for infrequent non-vocational tasks.

    This could be useful for computer-aided decision making, such as 

    For home repairs and auto maintenance, I would get books from Home Depot or NAPA.

1a. In terms of computer viruses, how is a logic bomb different from a time bomb?

    A virus is a computer program.  It can do no harm until it is executed.  A logic bomb begins its destructive work when it detects a predetermined condition.  A time bomb begins its destructive work when a predetermined time on the system clock is detected.  There are two ways a virus such as a logic bomb or time bomb can begin execution, by interrupt or polling.

    The first way is for the virus code to become the target routine for servicing an interrupt.  This requires the virus to execute at least once prior to the condition in order to set the transfer address for servicing the selected interrupt request.  An efficient virus will copy its code into the normal system software on disk so that the needed interrupt service address is always in the state needed by the virus.  A less certain approach is for the virus to be on the startup list and modify the table after it is initialized in memory.  A way of countering this kind of virus is to check the interrupt jump tables against a known good copy immediately after startup to determine if the tables have been altered in an unauthorized way. You have to create a baseline image under benign conditions and check for deviations.  Some interrupt service routines depend on which legitimate program is running, so this approach is not foolproof.  Sophisticated programs may modify jump tables to do error trapping.  A bomb virus that is intended to execute upon the first occurrence of the predetermined condition, however, must choose an interrupt service request that is not likely to be altered by other programs. 

    The other way is for the bomb to actively poll to test if the predetermined condition has occurred yet.  This approach requires that the virus must be activated long before the destructive action takes place, and remain in the execution state.  This might be detected by checking for wasted CPU cycles.

    A sophisticated logic bomb will wait until the n^th occurrence or a randomly accepted occurrence of the bomb condition until taking its malicious action.  This means it must maintain a counter somewhere.

1b. What is a worm?

    A worm program copies itself repeatedly in memory or on a disk drive until no memory or disk space remains.  Some worms copy themselves to other computers on a network.

1c.  What are some other types of viruses?

    Other types of viruses are:

2a.  What is an Internet security risk?

    A computer security risk is any event or action that could cause unauthorized use, loss, misuse, theft, unwanted alteration, or damage to computer hardware, software, or data.  An Internet security risk includes these risks, applied to the Internet.

    Information is data; processing capability is the combination of hardware and software.

2b.  What are some security techniques?

    Some techniques for computer security include: 

3a. What is a computer security plan?

    A computer security plan summarizes in writing all of the safeguards that are in place to protect a company's information assets.

3b. What are the three steps for a security plan?

    A computer security plan should do the following:

    (1) Identify all information assets of an organization, including hardware, software, documentation, procedures, people, data, facilities, and supplies.
    (2) Identify all security risks that may cause an information asset loss.
    (3)  For each risk, identify the safeguards that exists to detect, prevent, and recover from a loss.

4a. How is private key (12.16) encryption [Single Key, or Secret Key] different from public key encryption [Paired Key, Public Key - Private Key, or Asymmetric Key] ?

Single key encryption requires the originator and recipient to use the same key.  The Data Encryption Standard (DES) is an example.

Paired key encryption requires the originator to use one key, and the decoder to use the associated (different) key.

The paired key system is most secure if both keys are kept secret.  If only one key is kept secret, you have solved important portions of communications security problems, but not all.

4b. What is the government's key escrow plan?

    The original plan wanted government to be the holder of all encryption keys.  That plan was strongly opposed by industry and citizenry.  The backup plan was for all encryption keys to be held by a trusted third party not under direct government control, but from which government could obtain keys when it needed to.  This approach also has been strongly opposed.  The government has renamed the concept the "Key Recovery Plan".  Court battles have relaxed the restrictions on development and marketing of encryption standards.  The competing interests of corporate and personal privacy, law enforcement, government encrypted communications security, and intelligence gathering will ensure this issue will continue to be examined and fought over.  None of these plans are practical.  

    It is not possible to archive all the keys that are generated.  It is possible to generate a new key pair for each message transmitted.  Archiving all keys ever used is a stupid approach.  It is also a long term huge risk to personal freedom.

    See web sites:

    Basics of cryptography from Center for Democracy and Technology:

5a.  What is a password?

    A password is a secret combination of characters associated with a user name that allows access to specific computer resources.

5b.  How can you create a good password?

5c.  What are some password precautions?

1. user ID and password: (b)  Word or series of characters that must match an authentication file stored on a computer.
2. possessed object: (f)  Item that must be carried to gain access to a computer or computer facility.
3. personal identification number (PIN) = (e)  Numeric password, either assigned by an organization or selected by the user.
4. biometric device: (a)  Authenticates by verifying a physical characteristic such as fingerprints or retinal pattern.
5. callback system: (d)  Connects to a computer only after the computer calls back at a previously established number.

2a. What is a virus signature?

    A virus signature is a specific pattern of known virus code.

    Anti-virus programs that rely exclusively upon matching suspect code against copies of selected segments of virus code will do a good job against cataloged viruses.  Exhaustive checks are time consuming, and cannot detect viruses that have code not already cataloged.  Updating the library is crucial to continued reliability.

    Another approach is to search for privileged instructions in suspect files. If such instructions are detected, then subject the file to more exhaustive checks to determine if use of such instructions is permitted or not.  For example, a write instruction to the boot sector of a disk is not common for application software (except Norton Utilities and similar products).  This approach has the potential for detecting new viruses, takes less time to execute, and requires significantly less disk space for cataloged viruses.  It cannot as successful in detecting previously discovered viruses as the matching approach.

    For those interested in the history of computing, there once was a computer language called MAD which ran on the IBM 7040 in the late 1960s.  When a programmer made a level 7 error, the compiler would print a picture of Alfred E. Newman with the caption, "What, Me Worry?".  I think this compiler originated at MIT.

2b. Why is a polymorphic virus difficult to detect ?

    A polymorphic virus modifies its code each time it attaches itself to another file (which can be program or data).

    Dynamic programming is the art of creating programs that modify themselves.  Most serious computer science students do this at least once just to demonstrate the skill to do it, but usually not in a virus application.  High class dynamic programming involves changing the OPCODE field(s) of an instruction.  Normal assembly language programming will frequently change the ADDRESS field, and is not usually accorded the status of being called a dynamic program.

    A program that merely changes the address field of instructions (such as a memory load location, called a program ORIGIN) should still be detectable by pattern matching by examining the sequence of opcode fields without paying attention to the address fields.  A program that permutes segments of its code (along with new address fields) can be a more difficult program to match against.  A program that can do this would be a significant achievement for an undergraduate computer science major, but it can be done.  This kind of program would require more code than the average virus.

3b. What is the Business Software Alliance (BSA)?

    The Business Software Alliance (BSA) is an international organization of software and e-commerce developers.  Its goals are to educate computer users about software copyrights, advocate public policy that fosters innovation and expands trade opportunities, and fight software piracy.  See website at http://www.bsa.org/ 

5. What are some common points shared by federal and state laws regarding the storage and disclosure of personal data ?