Information Security Fundamentals

Online banking users face multiple threats: Phishing attacks trick users into revealing credentials on fake sites; Key Loggers maliciously record keystrokes to capture passwords; HTTPS indicates secure encrypted connections that users should verify before entering sensitive data. All three are essential security awareness topics for online banking users, making 'All of the Above' the correct answer.

To solve this question, the user needs to understand the concept of security in database applications and the limitations of username/password access controls.

Option A: Sufficient to secure the application

This option is incorrect because relying solely on username/password access controls is not sufficient to secure a database application. While these controls can provide a basic level of security, they can be easily bypassed by attackers using techniques like brute force attacks or social engineering. Therefore, additional security measures are needed to ensure the safety of the application.

Option B: Sufficient only when combined with other controls

This option is correct. Username/password access controls can be an effective security measure when combined with other controls such as data encryption, firewalls, and intrusion detection systems. By layering multiple security measures, the application becomes more difficult to compromise and provides a higher level of protection against unauthorized access.

Option C: Sufficient if the passwords are longer than six characters

This option is incorrect. While longer passwords are generally more secure than shorter ones, the length of a password alone is not sufficient to secure a database application. Passwords can still be guessed or cracked using other techniques, and therefore additional security measures are needed to provide adequate protection.

Option D: Sufficient if none of the users have administrative access

This option is incorrect. Even if none of the users have administrative access, the application can still be compromised through other means such as SQL injection attacks or phishing scams. Therefore, additional security measures are needed to ensure the safety of the database application.

The Answer is: B

Before conducting any penetration test, obtaining explicit written permission from system owners is not just a best practice - it's a legal and ethical requirement. Unauthorized penetration testing, even for benevolent purposes, is illegal. Monitoring systems (A), creating test plans (D), and identifying weaknesses (C) all come AFTER securing proper authorization. Permission protects both the tester and the organization.

Digital certificates (X.509) contain the certificate expiry date, subject identity, issuer information, and the subject's PUBLIC KEY - but NEVER the private key. The private key must remain secret and is stored separately by the certificate holder. Option B and C are wrong because certificates don't contain private keys. Option A is correct as expiry date is a standard certificate field.

Computer Viruses, Loss of data, and Unauthorized access are all fundamental security threats that organizations must protect against. Viruses are malicious code that can damage systems; data loss can occur from deletion, corruption, or disaster; unauthorized access violates security principles. 'All the above' is the only correct answer as all three represent significant security threats.

RSA is the most widely used digital signature algorithm, providing both authentication and non-repudiation through asymmetric cryptography. DES is a symmetric encryption algorithm, not a signature algorithm. DSA (Digital Signature Algorithm) is specifically designed for digital signatures, but RSA is more common in practice. HMAC is a message authentication code using hash functions, not a digital signature algorithm. RSA is the correct answer based on widespread adoption.

A Denial of Service (DoS) attack aims to overwhelm a network resource, server, or service with excessive traffic or requests, making it unavailable to legitimate users. Option A correctly describes this. Option B incorrectly suggests DoS attacks don't cause permanent damage - some DoS attacks can cause data corruption or system damage. Option C describes malware or Trojan attacks, not DoS. Option A is the accurate definition.

Cryptography provides four fundamental security functions: Authenticity (verifying the origin of data), Confidentiality (keeping data secret), Integrity (ensuring data is unaltered), and Non-repudiation (preventing denial of actions). Option A correctly lists all four. Options B, C, and D describe other security processes (incident response, basic operations, audit procedures) but not the core functions of cryptography itself.

Integrity is the cryptography security function that ensures encrypted data cannot be altered without detection. It verifies that data has not been modified in transit. Confidentiality ensures secrecy, authenticity verifies the sender's identity, and nonrepudiation prevents a sender from denying their actions.

Symmetric encryption uses the same secret key for both encryption and decryption, which is why it's called private key or secret key encryption. Public key encryption (asymmetric) uses different keys for encryption and decryption. Option A correctly identifies symmetric encryption.

AES (Advanced Encryption Standard) is the strongest encryption algorithm listed and is currently the standard adopted by the US Government. DES and Triple DES are older, less secure algorithms that have been largely replaced by AES due to vulnerabilities and insufficient key lengths.

A public key server (or Certificate Authority) is needed to support encryption on a server by providing public keys and certificates to clients. This enables asymmetric encryption and secure key exchange. Firewalls filter traffic, and private keys must be kept secret on the server itself, not exposed.

The most effective tactical approach for securing database applications is using a combination of all approaches: top-down (policy-driven), bottom-up (secure coding practices), end-to-end (data protection across layers), and across the entire lifecycle (continuous security). A multi-layered defense provides comprehensive protection.

SNMP, Telnet, and FTP are legacy protocols that transmit data in clear text (unencrypted). This makes them vulnerable to eavesdropping and man-in-the-middle attacks. Modern secure alternatives include SNMPv3, SSH, and SFTP/FTPS which encrypt traffic.

Unsecured LANs pose a threat to data confidentiality because data is accessible at each network node as packets travel through switches and routers. Any device on the network can potentially capture traffic using packet sniffing tools. This is different from spoofing or authentication issues.

Structured threats come from highly motivated and technically competent hackers (often organized crime or state-sponsored). They use sophisticated methods and significant resources. Unstructured threats are from opportunistic attackers with limited skills. Internal and external refer to the source location, not the attacker's capability level.