Information Security

In distributed environments and systems, the fundamental security concern is determining trust - knowing which systems, users, or services to trust. Distributed systems inherently involve multiple autonomous entities communicating across networks, making trust relationships critical. Without proper trust establishment, other security measures become ineffective.

Management has ultimate responsibility for data classification and protection. While data owners define classification levels and access requirements, administrators implement controls, and users follow procedures - management establishes policies, allocates resources, and ensures accountability for the entire data protection program.

Employees represent the highest risk of fraud and compromise due to their authorized internal access, knowledge of systems, and potential for accidental mistakes or malicious insider actions. External attackers and hackers typically face more security barriers.

To solve this question, the user needs to have a basic understanding of cybersecurity. The user must be able to identify the correct definition of the term "spoofing."

Now, let's go through each option and explain why it is right or wrong:

A. Eavesdropping: This option is incorrect. Eavesdropping is the act of listening to private conversations or communications without authorization. It is not the same as spoofing.

B. Working through a list of words: This option is incorrect. Working through a list of words has no relation to spoofing. It might be related to password cracking or brute-force attack.

C. Session Hijacking: This option is incorrect. Session hijacking is a type of attack in which an attacker takes control of a user session after successfully obtaining or generating an authentication session ID.

D. Pretending to be someone or something else: This option is correct. Spoofing is a type of cyberattack in which an attacker creates a fake identity or uses a legitimate one to gain unauthorized access to information or to make it appear that someone or something else is communicating.

The Answer is: D

CAPTCHA challenges users to complete tasks that are easy for humans but difficult for automated scripts, effectively preventing bots from submitting forms or accessing services. Session management, whitelisting, and blacklisting are security practices but not specifically anti-automation techniques.

Secure configuration management requires disabling or removing all unnecessary elements to minimize the attack surface. This includes unused request methods, manuals, installation files, and sample applications, making 'All' the correct recommendation.

The principle of full privilege is insecure; applications must instead follow the principle of least privilege, granting users only the minimum access necessary. The other statements accurately describe application Denial of Service mechanisms and defenses.

A weak password policy allows short, simple, or common passwords, drastically increasing the probability of a successful brute-force attack. Cleartext transmission or storage vulnerabilities expose passwords to interception or theft but do not directly facilitate brute-force cracking.

To ensure secure access control, users need to follow some best practices. The answer is option D, which means that all the options mentioned are correct.

Explanation of each option:

A. Use role-based access: This option is correct because role-based access control (RBAC) is a secure practice to control access to resources based on the roles assigned to individual users within an organization. It ensures that users have the necessary access to complete their tasks and restricts access to resources that are not relevant to their role.

B. Enforce authorization on each request: This option is correct because enforcing authorization on each request helps to verify that the user has the necessary privileges to access the requested resource. Authorization ensures that users only access the resources that they need to complete their tasks and nothing more.

C. Enforce Business Workflow: This option is correct because enforcing business workflow ensures that the access granted to users is in alignment with the business processes. By enforcing business workflow, organizations can minimize the risk of unauthorized access to resources and ensure that the access granted is relevant to the user's role.

D. All: This option is correct because all the options mentioned are secure practices for access control. Using role-based access, enforcing authorization on each request, and enforcing business workflow, all contribute towards ensuring secure access control.

Therefore, the correct answer is: D. All.

Horizontal privilege escalation occurs when a user gains access to resources or functionality belonging to another user with the same role or privileges. Vertical escalation involves gaining higher privileges. Session hijacking involves stealing a session, and cross-functional escalation is not a standard security term.

Public key algorithms involve complex mathematical computations, making them significantly slower than symmetric algorithms for encrypting large volumes of data. Symmetric algorithms do not offer better access control or nonrepudiation, and are generally simpler to implement.

Sensitive databases require high-security standard compliance, which is met by using algorithms certified under FIPS or EAL. Random numbers do not encrypt, long passwords are keys rather than algorithms, and DES is outdated and insecure.

An anonymiser is a service that hides a user’s real identity, typically by routing traffic through another server or providing temporary aliases, enabling the user to appear as a different person online. The other choices describe unrelated activities like FBI work, phishing, or vishing, which do not match the definition.

Piggybacking into unsecured wireless networks allows attackers to use someone else's internet connection, masking their real IP address and location to avoid detection. Physical masks and changing clothes do not hide network footprints, while phishing is an active attack vector.

Botnets (networks of compromised computers) are the primary mechanism used to orchestrate and execute distributed denial of service (DDoS) attacks. Distributing malware via emails spreads infections but isn't the direct DDoS method itself, while phishing steals credentials.