Deck 13: Trusted Computing and Multilevel Security

Question 1

The Biba models deals with confidentiality and is concerned with
unauthorized disclosure of information.

Answer 1

False

Question 2

The _______ access mode allows the subject both read and write access to the object.

A)read
B)append
C)write
D)execute

Answer 2

C

Question 3

An entire database such as a financial or personnel database cannot be
maintained on a server with other files and still be classified as confidential or restricted.

Answer 3

False

Question 4

Functionality is the security features provided by a product.

Question 5

A component describes a specific set of security requirements.

Question 6

The BLP model effectively breaks down when (untrusted)low classified
executable data are allowed to be executed by a high clearance (trusted) subject.

Question 7

"No write down" is also referred to as the *-property.

Question 8

The addition of multilevel security to a database system does not increase
the complexity of the access control function.

Question 9

The ________ access mode allows the subject only write access to the object.

A)read
B)append
C)write
D)execute

Question 10

One of the most influential computer security models is the Bell-LaPadula
model.

Question 11

The BLP model includes a set of rules based on abstract operations that
change the state of the system.

Question 12

A subject can exercise only accesses for which it has the necessary
authorization and which satisfy the MAC rules.

Question 13

An object is said to have a security clearance of a given level.

Question 14

One way to secure against Trojan horse attacks is the use of a secure,trusted
operating system.

Question 15

A multilevel secure system for confidentiality must enforce:

A)no read up
B)ss-property
C)no write down
D)all of the above

Question 16

Problems with providing strong computer security involve only the design
phase.

Question 17

The Common Criteria for Information Technology and Security Evaluation
are ISO standards for specifying security requirements and defining evaluation criteria.

Question 18

Multilevel security is of interest when there is a requirement to maintain a
resource in which multiple levels of data sensitivity are defined.

Question 19

The ________ control the manner by which a subject may access an object.

A)security classes
B)security classifications
C)security clearances
D)security properties

Question 20

Security classes are referred to as __________.
A)security clearances

A)security levels
B)security classifications
D)security properties

Question 21

The ________ is the government agency that monitors the evaluation process.

A)sponsor
B)certifier
C)evaluator
D)developer

Question 22

The _______ is a hardware module that is at the heart of a hardware/software approach to trusted computing.

A)BLP
B)TC
C)CC
D)TPM

Question 23

_________ rules are security policy restrictions on the behavior of IVPs and TPs.

Question 24

_________ rules are built-in system security mechanisms that achieve the objectives of the certification rules.

Question 25

The __________ is a controlling element in the hardware and operating system of a computer that regulates the access of subjects to objects on the basis of security parameters of the subject and object.

Question 26

The _________ model is aimed at commercial rather than military applications and closely models real commercial operations.

Question 27

A subject is said to have a security _________ of a given level.

Question 28

A _______ is a collection of requirements that share a common focus or intent.

A)trust
B)family
C)class
D)component

Question 29

The _________ model is intended to deal with the case in which there is data that must be visible to users at multiple or all security levels but should only be modified in controlled ways by authorized agents.

Question 30

"An individual (or role)may grant to another individual (or role)access to a document based on the owner's discretion,constrained by the MAC rules" describes the _________.

A)ss-property
B)ds-property
C)*-property
D)cc-property

Question 31

Inserting a new row at a lower level without modifying the existing row at the higher level is known as ________ .

A)polyinstantiation
B)ds-property
C)trust
D)MAC

Question 32

__________ data are data that may be derived from corporate data but that cannot be used to discover the corporation's identity.

A)Reference
B)Trust
C)Sanitized
D)MAC

Question 33

The _________ Model was developed for commercial applications in which conflicts of interest can arise.

A)Biba
B)Clark-Wilson Integrity
C)Bell-Lapadula
D)Chinese Wall

Question 34

_________ is assurance that a system deserves to be trusted such that the trust can be guaranteed in some convincing way such as through formal analysis or code review.

A)TCB
B)Trustworthiness
C)Trusted computing
D)TPM

Question 35

________ is a process that ensures a system is developed and operated as intended by the system's security policy.

A)Trust
B)Assurance
C)Evaluation
D)Functionality

Question 36

An object is said to have a security ________ of a given level.

Question 37

"No read up" is also referred to as the _________ property.

Question 38

When multiple categories or levels of data are defined,the requirement is referred to as __________ security.

Question 39

________ is when a new document consolidates information from a range of sources and levels so that some of that information is now classified at a higher level than it was originally.

A)Classification creep
B)Trusted platform
C)Common criteria
D)Polyinstantiation

Question 40

The ________ access mode allows the subject neither read nor write access to the object but may invoke the object for execution.

Question 41

The __________ service is responsible for booting the entire operating system in stages and assuring that each portion of the OS,as it is loaded,is a version that is approved for use.

Question 42

Trusted computing provides three basic services: authenticated boot,certification, and _________.

Question 43

To structure the need for assurance the CC defines a scale for rating assurance consisting of _____ evaluation assurance levels ranging from the least rigor and scope for assurance evidence to the most.

Question 44

_________ secure is a class of system that has system resources at more than one security level and that permits concurrent access by users who differ in security clearance and need-to-know,but is able to prevent each user from accessing resources for which the user lacks authorization.

Question 45

In the United States the ______ and the NSA jointly operate the Common Criteria Evaluation and Validation Scheme.