Information Security

Digital signatures DO provide protection from tampering through their integrity verification mechanism. When a document is digitally signed, any modification after signing causes the signature verification to fail, alerting the recipient that tampering occurred. The signature is based on a cryptographic hash of the document content, so even a single bit change invalidates the signature. This is a fundamental security property of digital signatures.

One-time pads are theoretically unbreakable if implemented correctly with truly random keys that are used only once and never reused. This assumes unlimited time and resources for proper key generation and distribution. DES and Triple DES have known vulnerabilities, and Blowfish, while strong, is not provably 100% secure.

Mobile messaging devices like Blackberry and Treo continuously store emails, messages, and documents, making them repositories of confidential information. RAM is volatile memory that clears on power-off, VPNs are network tunnels not storage devices, and digital cameras store media but aren't typically business data repositories.

Ensuring users upgrade their hardware every 12 months is an impractical and ineffective security measure against malware. In contrast, standard recommended practices for avoiding Symbian Trojans include keeping the operating system updated, installing mobile antivirus software, and only downloading signed applications from official, trusted sources.

Unlocking specifically refers to removing carrier restrictions that lock a phone to specific networks or countries. Hacking is a broad term covering many activities, while jailbreaking refers to removing manufacturer software restrictions on iOS devices.

CFD is the designated primary data source for Secure web and External web interfaces in this system architecture. DWH (Data Warehouse) typically serves analytical rather than operational web needs. Core System and RRS are not the designated primary sources for these web interfaces.

SHA is correct because it's a cryptographic hash function, which is the proper way to store passwords. Passwords should be hashed (one-way), not encrypted (two-way). AES, 3DES, and RSA are encryption algorithms that can be reversed with the right key, making them unsuitable for secure password storage. If a database is compromised, encrypted passwords can be decrypted.

All of the above is correct because all four are valid password attack vectors. Eavesdropping captures passwords during transmission, replay attacks resyoken captured credentials, social engineering tricks users into revealing passwords, and Trojan horses can log keystrokes or steal stored passwords. Each represents a different attack surface.

BlueScolding is correct because it's not a real Bluetooth attack. BlueBugging (taking over device), BlueJacking (sending unsolicited messages/contacts), and BlueSmacking (ping-of-death DoS) are all documented Bluetooth attack vectors. 'BlueScolding' appears to be a fabricated term - the correct concept might be 'BlueSnarfing' (unauthorized data access).

Ensure users upgrade their devices every 12 months is correct because it's NOT a recommended security practice. Regular hardware upgrades don't protect against Trojans. The recommended practices are: keeping firmware/OS updated, using security software, and only installing trusted/signed applications. Upgrading devices on a fixed schedule is a security policy, not a Trojan defense.

Unlocking is correct. Unlocking removes SIM locks that restrict a phone to specific carriers or countries. Hacking is a general term, jailbreaking specifically refers to removing iOS restrictions (installing unapproved apps), and unlocking is the correct term for removing carrier restrictions from any phone.

SHA is a cryptographic hash function suitable for password storage because it's one-way (prevents recovery). AES and 3DES are reversible encryption algorithms, and RSA is asymmetric encryption used for key exchange, not password hashing.

All listed techniques are valid password attack vectors. Eavesdropping captures passwords in transit, replay attacks reuse captured credentials, social engineering tricks users into revealing them, and trojans steal them from infected systems.

OTPs offer superior security by generating unique, single-use credentials that become invalid immediately after use. This prevents password reuse attacks and significantly reduces vulnerability to theft compared to static passwords.