Information Security Fundamentals

Asymmetric cryptography is used for encryption (A), access control through digital signatures and certificates (B), and nonrepudiation via digital signatures that prove origin (C). Steganography (D) is about hiding the existence of a message itself, not encrypting it - it's a different field entirely. Steganography can be combined with encryption but is not a use case for asymmetric cryptography itself.

The private key must be kept secure and confidential because if compromised, an attacker can impersonate the key owner, decrypt intercepted messages, or forge digital signatures. Public key algorithms don't use shared keys (B), message integrity (C) is important but secondary to key protection, and session key history (D) is not the most critical principle. The entire security model depends on private key secrecy.

Public key encryption allows anyone to encrypt with the receiver's public key, but only the receiver with the matching private key can decrypt. This ensures confidentiality during transmission. The sender does not need to share a secret key with the receiver beforehand.

Sending an encrypted hash (digital signature) along with the message allows the recipient to verify message integrity. The recipient can decrypt the hash with the sender's public key and compare it with a freshly computed hash of the received message. If they match, the message hasn't been tampered with.

The two fundamental methods of encrypting data are based on how the encryption algorithm operates: block ciphers (which encrypt fixed-size blocks of data) and stream ciphers (which encrypt data as a continuous stream, bit by bit or byte by byte). Symmetric/asymmetric refers to key management, not the encryption method itself.

Steganography is the practice of concealing a message within another file. Because digital picture, music, and video files contain redundant or unused bits, any of them can serve as a carrier to hide secret messages. Therefore, all of the listed formats are viable transmission mediums.

A covert channel is an unauthorized communication path that violates a system's security policy to transfer information, often hiding data within normal traffic. Secret links are not standard security terms, covert encryption is a cryptographic technique, and communication pipes are authorized OS IPC mechanisms.

The primary risk is that if the cryptographic key is lost (due to disgruntled employee, poor key management, or system failure), the encrypted data becomes permanently inaccessible. Unlike data loss from hardware failure, encrypted data cannot be recovered without the key, making key management critical.

To solve this question, the user needs to know the definitions of different security concepts and their applications. The user must identify the concept that refers to the testing or reconciliation of evidence of a user's identity.

Now, let's go through each option and explain why it is right or wrong:

A. Authorization: Authorization refers to the process of granting or denying access to a resource based on a user's identity and the permissions associated with that identity. This option is not the correct answer since it does not refer to the testing or reconciliation of evidence of a user's identity.

B. Accountability: Accountability refers to the state of being responsible or answerable for one's actions. This option is not the correct answer since it does not refer to the testing or reconciliation of evidence of a user's identity.

C. Auditing: Auditing refers to the process of tracking and evaluating the use of resources or actions taken by users to ensure compliance with policies and regulations. This option is not the correct answer since it does not refer to the testing or reconciliation of evidence of a user's identity.

D. Authentication: Authentication refers to the process of verifying the identity of a user or system. This includes the testing or reconciliation of evidence of a user's identity such as passwords, biometric data, or security tokens. This option is the correct answer.

Therefore, the answer is: D. Authentication.

Monitoring is an ongoing, real-time activity that observes systems or users to detect anomalies or intrusion attempts. Auditing is a periodic, retrospective review of records to verify compliance. Accounting tracks resource consumption, and eavesdropping is an unauthorized interception of communications.

To solve this question, the user needs to have knowledge of basic cybersecurity concepts.

The correct answer is:

B. Accountability

Option A, Authentication refers to the process of verifying the identity of a user or system before granting access.

Option C, Authorization is the process of granting or denying access to specific resources or actions.

Option D, Nonrepudiation refers to the ability to prove that a particular action or event occurred and that it cannot be denied by the party who performed it.

Option B, Accountability is the ability to determine the actions and behaviors of a single individual within a system and to identify that particular individual. It is the answer to the question "who did what, when, and how" in a given system.

Therefore, the correct answer is B. Accountability.

Defense-in-depth is a layered security approach where multiple controls are implemented so that if one control fails or is bypassed, another layer continues to provide protection. This security-in-depth strategy creates redundant safeguards against threats.

Black box testing assumes the testing team has zero prior knowledge of the target system's internal structures or configurations, requiring them to gather information externally. White box testing involves full knowledge, while grey box testing involves partial knowledge of the system's internals.

Privacy refers specifically to an individual's right to control how their personally identifiable information is collected, used, and disclosed. Confidentiality is the protection of data from unauthorized access, authorization determines what users can access, and security is the overall practice of protecting assets.

PCI DSS (Payment Card Industry Data Security Standard) is the comprehensive framework for credit card security. It consists of 12 requirements organized under 6 control objectives: build and maintain a secure network, protect cardholder data, maintain vulnerability programs, implement strong access controls, monitor networks, and maintain information security policies.

The OWASP Top Ten Project is the widely recognized standard that lists and explains the most critical security vulnerabilities for web applications based on consensus from security experts. ISO 27002 and BSI 7799 are broader information security standards, and TSP-Secure is not a standard web vulnerability list.

A patent provides an inventor with the legally enforceable right to exclude others from making, using, or selling a covered invention for a set period. Copyrights protect original works of authorship, trade secrets protect confidential business information, and warranties are guarantees of product performance.

Columns of an access matrix represent objects, and the list of permissions for a given object across all subjects is called an Access Control List (ACL). In contrast, rows represent subjects and correspond to capability lists. Triples represent (subject, object, rights) entries, and properties are unrelated attributes.

SSE-CMM (Systems Security Engineering Capability Maturity Model) specifically describes the characteristics of security engineering processes. It provides a framework for assessing and improving the capability of security engineering processes, unlike CMMi (general software engineering) or Bell-LaPadula (access control model).

A worm is specifically designed to reproduce itself by exploiting system resources and network vulnerabilities to propagate independently. Unlike viruses (which require host files), worms are self-contained and can spread across networks without attaching to existing programs.