INF4831/101/0/2020

Tutorial Letter 101/0/2020

INFORMATION SECURITY
INF4831

Year module

School of Computing

IMPORTANT INFORMATION
Please register on myUnisa, activate your myLife email address and
make sure that you have regular access to the myUnisa module
website, MODULE INF4831-2020Y, as well as your group website.

Note: This is a fully online module and therefore it is only available on myUnisa.

BARCODE
 INF4831/101/0/2020

CONTENTS
Page

1 INTRODUCTION .......................................................................................................................... 3
2 OVERVIEW OF INF4831 .............................................................................................................. 4
2.1 Purpose ........................................................................................................................................ 4
2.2 Outcomes ..................................................................................................................................... 4
3 LECTURER AND CONTACT DETAILS ....................................................................................... 7
3.1 Lecturer ........................................................................................................................................ 7
3.2 Department ................................................................................................................................... 7
3.3 University ...................................................................................................................................... 7
4 RESOURCES ............................................................................................................................... 7
4.1 Joining myUnisa ........................................................................................................................... 7
4.2 Prescribed book ............................................................................................................................ 8
4.3 E-reserves .................................................................................................................................... 8
4.4 Library services and resources ..................................................................................................... 8
5 STUDENT SUPPORT SERVICES ................................................................................................ 9
6 HOW TO STUDY ONLINE ............................................................................................................ 9
6.1 What does it mean to study fully online? ....................................................................................... 9
6.2 myUnisa tools ............................................................................................................................... 9
7 STUDY PLAN ............................................................................................................................. 10
8 ASSESSMENT ........................................................................................................................... 11
8.1 Assessment plan ........................................................................................................................ 11
8.2 Due dates and unique assignment numbers ............................................................................... 11
8.3 Submission of assignments ........................................................................................................ 11
8.4 Year mark and final examination/other options ........................................................................... 12
8.5 Examination period ..................................................................................................................... 12
8.6 Duration of the examination ........................................................................................................ 12
9 CONCLUSION............................................................................................................................ 12
10 Assignment 01 – Multiple-choice questions .......................................................................... 13
11 Assignment 02 – Multiple-choice questions .......................................................................... 18
12 Assignment 03 – Community engagement project ................................................................ 23
13 Assignment 04 – Multiple-choice questions .......................................................................... 24
14 Assignment 05 – Long questions ............................................................................................ 29

2
 INF4831/101/0/2020

Dear Student

1 INTRODUCTION

Unisa has implemented a transformation charter based on five pillars and eight dimensions. In
response to this charter, we have placed curriculum transformation high on the agenda.
Curriculum transformation includes the following pillars: student-centred scholarship, the
pedagogical renewal of teaching and assessment practices, the scholarship of teaching and
learning, and the infusion of African epistemologies and philosophies. These pillars and their
principles will be integrated at both the programme and module levels, as a phased-in approach.
You will notice the implementation in your modules, and we encourage you to fully embrace these
changes during your studies at Unisa.

We have pleasure in welcoming you to Information Security, INF4831, and hope that you will find
this module both interesting and rewarding.

You will receive a number of tutorial letters during the semester. A tutorial letter is our way of
communicating with you about teaching, learning and assessment.

This tutorial letter contains important information about the scheme of work, the assignments and
assessment criteria, as well as instructions on preparing and submitting the assignments. It also
contains information about the prescribed study material and other resources, and where to find
them. Please obtain the prescribed book as soon as possible.

Read this tutorial letter carefully and keep it somewhere safe so that you can consult it if you need
to while working through the study material, preparing the assignments, preparing for the
examination and directing questions to your lecturers. We recommend that you read Tutorial
Letter 301 in combination with this tutorial letter, as it will give you an idea of generally important
information about studying at a distance through a particular college.

Because this is a fully online module, you will need to use myUnisa to study and complete the
learning activities. Visit the website for INF4831 on myUnisa frequently. The website for your
module is INF4831-20Y.

Getting started …
Given the nature of this module, you can read about it and find your study material online. Go to
the website at https://my.unisa.ac.za and log in using your student number and password. You
will see INF4831-20Y in the row of modules displayed in the orange blocks at the top of the web
page. Select the More tab if you cannot find the module you require in the blocks displayed. Then
click on the module you wish to open.
We wish you every success in your studies!

3
 INF4831/101/0/2020

2 OVERVIEW OF INF4831
2.1 Purpose
Information technology (IT) is being used in almost every facet of modern life. Computational
devices are being networked in large numbers. The number of internet and web users is doubling
every year. More and more services are moving to the cloud. This has changed how we do
business, how we socialise and how we spend our leisure time.

The American science fiction author, Robert Heinlein, popularised the expression, “There ain’t no
such thing as a free lunch”. In the IT context, we can interpret that to mean that the benefits of
technology come at a price: the barriers to crime and other unlawful behaviour have been lowered.
Corporate espionage is on the increase. The boundaries between government, military, business
and private networked devices are becoming increasingly porous. Many countries are taking the
concept of cyberwar seriously and are developing so-called cyberweapons. As a result, security
threats to IT have increased significantly. This makes it vital that we learn more about the risks
we face and how to control them.

Information and computer security have many sides to them, making it impossible for any one
person to master the entire field completely. There are not only deep theoretical and technical
issues, but also psychological, social, political, legal and policy issues, as well as maths and
physics issues. Nonetheless, a basic knowledge of the field is a necessity.

This module focuses on the subject of information security, which has evolved as a field of
research as well as a business practice in its own right. It is based on sound theoretical principles,
namely identification and authentication, authorisation, confidentiality, integrity and non-
repudiation. These principles form the basis of internationally accepted information security
architectures. In this module our aim is to provide you with sufficient knowledge to gain a thorough
understanding of these principles and a sound grasp of the subject of information security.

In today’s world where headline news scares about stolen or missing data are becoming a
frequent occurrence, organisations must be prepared to defend themselves against a growing
number and diversity of threats. Decision-makers must be familiar with the fundamental principles
and best practices of computer and information security to best protect their enterprises. This
module is a broad introduction to the most important areas of information security.

2.2 Outcomes
The focus of this module is on making you aware of the security pitfalls inherent in many important
computing tasks today and providing you with the knowledge and skills you need concerning the
countermeasures currently available to combat these weaknesses and point out where security
controls are inadequate. Some security controls that can be implemented to improve security of
personal computers up to the level of enterprise information systems are also introduced.

Specific outcome 1

Demonstrate a clear understanding of the underlying principles of information security.

(Refer to chapter 1.)

Assessment criteria
1. Describe threats, vulnerabilities and attacks as they apply to information security.
4
 INF4831/101/0/2020

2. Describe the countermeasures that are used in information security.

3. Identify and discuss the actors involved in the offence against and the defence of
computer systems.
4. Demonstrate an understanding of the necessity of the appropriate level of security for a
given computer system.
5. Apply knowledge of the principles of information security to recommend appropriate
measures of defence against attacks.

Specific outcome 2
Apply elementary cryptography.
(Refer to chapters 2 and 12.)

Assessment criteria

1. Describe substitution and transposition ciphers.

2. Describe symmetric and asymmetric cryptography.
3. Identify current cryptographic algorithms and discuss their function, application, strengths
and weaknesses.
4. Describe and discuss the uses of cryptography.
5. Apply cryptographic methods to encrypt and decrypt messages and digitally sign data.

Specific outcome 3
Demonstrate an understanding of program security and the design and protection of general-
purpose operating systems.
(Refer to chapters 3 and 5.)

Assessment criteria

1. Describe secure programs.

2. Discuss programming errors and complexity leading to vulnerabilities in computer
systems.
3. Demonstrate an understanding of the various types of malicious software, their effect,
and how to defend against them.
4. Understand and apply controls against program threats.
5. Discuss operating system security methods.
6. Demonstrate an understanding of memory and address protection in operating systems.

5
 INF4831/101/0/2020

7. Demonstrate an understanding of file protection mechanisms, access control and

authentication in operating systems.
8. Discuss security policies as they relate to operating systems.
9. Discuss and evaluate the models of security as they apply to operating systems.
10. Demonstrate an understanding of the methods of designing a secure operating system.

Specific outcome 4
Demonstrate an understanding of database security.
(Refer to chapter 7.)

Assessment criteria

1. Demonstrate an understanding of security requirements of databases.

2. Demonstrate an understanding of the concepts of reliability and integrity and discuss
methods of ensuring them.
3. Discuss the methods used to secure multilevel databases.
4. Demonstrate an understanding of data mining.

Specific outcome 5
Demonstrate an understanding of security in networks.

(Refer to chapters 4, 6 and 8.)

Assessment criteria

1. Discuss network threats.

2. Identify and describe the various network security controls, methods and techniques.
3. Identify and describe the various network security tools.
4. Apply the appropriate techniques or tools in design to secure a network.

Specific outcome 6
Demonstrate an understanding of privacy in computing.

(Refer to chapters 9 and 11.)

Assessment criteria

1. Critically discuss privacy in the age of the internet.

2. Identify and discuss the methods, principles, policies and tools used to ensure privacy.
6
 INF4831/101/0/2020

3. Discuss the effect of various online tools and methods on privacy.

4. Critically discuss the impact of emerging technologies on privacy.

Specific outcome 7
Apply and evaluate security policies and security models.
(Refer to chapter 10.)

Assessment criteria

1. Demonstrate an understanding of the purpose, creation and application of a security

policy.
2. Demonstrate an understanding of the purpose, creation and application of a security
model.

3 LECTURER AND CONTACT DETAILS

3.1 Lecturer
The name and contact details of the lecturer responsible for this module can be found in Tutorial
Letter 301 (COSALL Series/2020), compiled by the School of Computing. You can also find this
information on myUnisa under the option Official Study Material. The details of the lecturer
responsible will be supplied in the welcome message on myUnisa.

Lecturers are available by appointment only, and you will not be able to see a lecturer if you have
not made an appointment beforehand.

3.2 Department
Contact details for the School of Computing can be found in Tutorial Letter 301/2020.

3.3 University
To contact the university, follow the instructions in the brochure Study @ Unisa. Remember to
have your student number available whenever you contact Unisa.
When you contact a lecturer, please include your student number to enable him/her to help you
more effectively.
Tutorial Letter 301 can also assist you in this regard.

4 RESOURCES
4.1 Joining myUnisa
The myUnisa learning management system is the university's online campus which will help you
communicate with your lecturers, fellow students and Unisa’s administrative departments.

7
 INF4831/101/0/2020

To access the myUnisa website directly, go to https://my.unisa.ac.za. Click on the Claim UNISA
Login on the top of the screen on the myUnisa website. You will then be prompted to enter your
student number in order to claim your initial myUnisa details, as well as your myLife email login
details.
For more information on myUnisa, consult the brochure Study @ Unisa, which you received with
your study material: www.unisa.ac.za/brochures/studies

4.2 Prescribed book

Pfleeger, PP, Pfleeger, SL & Margulies, J. 2015. Security in computing. 5th ed. Prentice Hall.
ISBN: 978-0-13-408504-3.

4.3 E-reserves
There are no e-reserves for this module.
4.4 Library services and resources
The Unisa Library offers a range of information services and resources:

 for brief information go to https://www.unisa.ac.za/library/libatglance

 for more detailed Library information, go to
http://www.unisa.ac.za/sites/corporate/default/Library
 for research support and services (e.g. personal librarians and literature
search services), go to
http://www.unisa.ac.za/sites/corporate/default/Library/Library-
services/Research-support

The Library has created numerous Library guides: http://libguides.unisa.ac.za

Recommended guides

 request and find Library material/download recommended material:

http://libguides.unisa.ac.za/request/request
 postgraduate information services:
http://libguides.unisa.ac.za/request/postgrad
 finding and using library resources and tools:
http://libguides.unisa.ac.za/Research_skills
 frequently asked questions about the Library: http://libguides.unisa.ac.za/ask
 services to students living with disabilities:
http://libguides.unisa.ac.za/disability

Important contact information

 https://libguides.unisa.ac.za/ask - ask a librarian

 Lib-help@unisa.ac.za - technical problems accessing Library online services
 Library-enquiries@unisa.ac.za - general Library-related queries
 Library-fines@unisa.ac.za - for queries related to Library fines and payments

8
 INF4831/101/0/2020

5 STUDENT SUPPORT SERVICES

The Study @ Unisa brochure is available on myUnisa: www.unisa.ac.za/brochures/studies

This brochure has all the tips and information you need to succeed at distance learning and,
specifically, at Unisa.

6 HOW TO STUDY ONLINE

6.1 What does it mean to study fully online?
Studying fully online modules differs completely from studying other modules at Unisa.

 All your study material and learning activities for online modules are designed to be
delivered online via myUnisa.
 All your assignments must be submitted online. This means that you will complete all
your activities and submit all your assignments via myUnisa. In other words, you may NOT
post your assignments to Unisa using the South African Post Office.
 All communication between you and the university takes place online. Your lecturers
will communicate with you via email and SMS, and by using the Announcements,
Discussion Forums and Questions and Answers tools. You can also use all of these ways
to ask questions and contact your lecturers.
6.2 myUnisa tools
We will be using mainly the Learning Units and Discussions, which provide the content of, and
assessments for, your module. At times you will be directed to join discussions with your fellow
students and to complete activities and assessments before continuing with the module.
It is crucial that you log in to myUnisa regularly. We recommend that you do so at least once a
week, to do the following:

 Check for new announcements. You can also set your myLife email account so that you
receive announcement emails on your cellphone.
 Complete the Discussion Forum activities. When you complete the activities for each
learning unit, we want you to share your answers with the other students in your group. You
can read the instructions and even prepare your answers offline, but you will need to go online
to post your messages. To this end we provide a Social Cafe where you can socialise with
other students taking this module.
 Complete other online activities. For certain learning unit activities you may need to post
something on the Discussion Forum. Do not skip these activities, because they will help you
complete the assignments and activities for the module.
We hope that by giving you extra ways of studying the material and practising all of the activities,
you will succeed in the online module. To get the most out of the online module, you MUST go
online regularly to complete the activities and assignments on time.

9
 INF4831/101/0/2020

7 STUDY PLAN
Date Chapter Assignments

March Chapter 1

Chapter 2

April Chapter 3

Chapter 4 Assignment 01:

Monday 20 April 2020
(MCQ: Chapters 1–4)
May Chapter 5

Chapter 6

June Chapter 7

Chapter 8 Assignment 02:

Monday 1 June 2020
(MCQ: Chapters 5–8)
July Chapter 9

Chapter 10 Assignment 03:

Monday 13 July 2020
(Community engagement project)

August Chapter 11

Chapters 12 and 13 Assignment 04:

Monday 11 August 2019
(MCQ: Chapters 9–13)
September Revision chapters 1–13 Assignment 05:
Monday 28 September 2019
(Long questions – all chapters)
October Revision chapters 1–13

November Revision chapters 1–13

December Revision chapters 1–13

January/February Examination

Examination: Dates to be announced – please check your examination timetable on

myUnisa!

10
 INF4831/101/0/2020

8 ASSESSMENT
8.1 Assessment plan
The following is a breakdown of the formal assessment activities as they become due during the
year:

Assignments Assignment Percentage of Percentage of

type semester mark final mark
Assignment 01 MCQ 10% of semester mark 2% of final mark
Assignment 02 MCQ 10% of semester mark 2% of final mark
Assignment 03 Community 35% of semester mark 7% of final mark
engagement
Assignment 04 MCQ 10% of semester mark 2% of final mark
Assignment 05 Long questions 35% of semester mark 7% of final mark
Combined assignment mark 20% of final mark
will count (year mark)
Examination will count 80% of final mark
Final mark 100%

8.2 Due dates and unique assignment numbers

When submitting Assignments 01 to 05, please ensure that you use the correct unique
assignment numbers as set out below.

Assignment Unique assignment Content to be tested Due date

number
01 773597 Chapters 1 - 4 (MCQ) 20 April 2020
02 743567 Chapters 5 - 8 (MCQ) 1 June 2020
03 765004 Community engagement project 13 July 2020
04 828426 Chapters 9 -13 (MCQ) 11 August 2020
05 841635 Chapters 1 – 13 (Long questions) 28 September 2020

Assignments must reach Unisa either on or before the due date.

8.3 Submission of assignments
Assignments 01, 02 and 04 must be submitted online through myUnisa.

Complete Assignments 03 and 05 in Microsoft Word and save them in PDF. The maximum size
allowed for online submission is 10 MB.
Do not protect/secure the PDF document when saving it as we use online marking tools to mark
these assignments. Submit the PDF assignment online through myUnisa by following these steps:

 Go to myUnisa.

 Log in with your student number and password.

 Select the module.

11
 INF4831/101/0/2020

 Click on Assignments on the left-hand menu.

 Click on the number of the assignment you want to submit.

 Follow the instructions on the screen.

8.4 Year mark and final examination/other options

To gain admission to the examination, you must have a year mark subminimum of 50%.

To pass the module you have to achieve a final mark of 50% or more.

The final mark is calculated as follows:

Final mark = (Year mark x 0.2) + (Examination mark x 0.8)

For example: if you have a year mark of 68% and an examination mark of 50%, we would calculate
your final mark as follows:

Final mark = (68 x 0.2) + (50 x 0.8)

= (13.6) + (40)
= 53.6

8.5 Examination period

This module is offered as a year module. You will write your examination in January/February
2021.

8.6 Duration of the examination

You will write one 3-hour exam paper.

9 CONCLUSION
Do not hesitate to contact us via email if you are experiencing problems with the content of this
tutorial letter or with any academic aspect of the module.
We wish you a fascinating and satisfying journey through the learning material and trust that you
will complete the module successfully.

12
 INF4831/101/0/2020

10 Assignment 01 – Multiple-choice questions

1. The following are properties of information security:

1. passwords, encryption, back up and policies
2. availability, integrity and confidentiality
3. availability, integrity, confidentiality, authentication and non-repudiation
4. threats, controls and vulnerabilities [1]

2. ... is a set of circumstances that could cause harm.

1. A control
2. A vulnerability
3. A threat
4. Residual risk [1]

3. An online banking website requires you to type in a bank account number. The field where
you can type in the number accepts any length and type of character. This is an example of a
system …
1. control.
2. threat.
3. asset.
4. vulnerability. [1]

4. A denial-of-service attack launched against a network constitutes …

1. interception.
2. modification.
3. fabrication.
4. interruption. [1]

5. Integrity is defined as …
1. precise, accurate, unmodified or modified by authorised people/processes/ways,
consistent, internally consistent, meaningful and usable.
2. precise, accurate, unmodified by authorised people/processes/ways, consistent, internally
consistent, meaningful and usable.
3. precise, accurate, unmodified by authorised people, consistent, internally consistent,
meaningful and usable.
4. precise, accurate and consistent. [1]

6. Installing system patches is an example of … an attack.

1. preventing
2. deterring
3. deflecting
4. detecting [1]

13
 INF4831/101/0/2020

7. Social engineering is when an attacker …

1. contacts the system administrator or user to elicit a password.
2. uses a utility to scan a system for weak passwords.
3. guesses a password.
4. uses a password from a password list. [1]

8. An advantage of stream encryption algorithms is …

1. high diffusion and low error propagation.
2. low diffusion and low error propagation.
3. speed of transformation and low error propagation.
4. speed of transformation and high diffusion. [1]

9. A digital signature must meet two primary conditions. It must be …

1. authentic and unforgeable.
2. not alterable, but reusable.
3. not reusable, but alterable.
4. authentic and confidential. [1]

10. Which access control method has difficulty in managing a list that is too large as a result of
many shared objects and has difficulties relating to revocation of access?
1. access control directory
2. access control matrix
3. access control list
4. role-based access [1]

11. Cryptography involves two basic techniques, namely …

1. addition and subtraction.
2. replacing and addition.
3. shuffling and the mean.
4. replacing and shuffling. [1]

12. One-way hash functions are cryptographic constructs with multiple uses. They are used in
conjunction with public-key algorithms for …
1. encryption.
2. digital certificates.
3. integrity.
4. All of the above. [1]

13. Encrypt the following message using a 3-column permutation cipher: it is cold

1. isitcdiox
2. itiscoldx
3. iicltsod
4. dlocsiti [1]

14
 INF4831/101/0/2020

14. An encryption algorithm that encrypts with the first key, then encrypts or decrypts the result
with a second key, then encrypts the result with a third key is called …
1. RSA algorithm.
2. EAS.
3. three-key triple Des.
4. two-key triple Des. [1]

15. An extra bit (fingerprint) is added to an existing group of data bits which can have two kinds
of parity, namely 1 or 0, and is called …
1. collision.
2. parity.
3. hash value.
4. message digest. [1]

16. When malware exploits a product vulnerability for which the manufacturer has no
countermeasure, it is called a …
1. zero day attack.
2. trapdoor.
3. script attack.
4. hostile agent. [1]

17. A virus that can change its appearance is called …

1. a polymorphic virus.
2. multipartite.
3. a bot.
4. a Trojan horse. [1]

18. When a string overruns its assigned space or one extra element is shoved into an array, it is
called …
1. a beta test.
2. a buffer overflow.
3. incomplete mediation.
4. a stack. [1]

19. … is a program that intercepts and covertly communicates data on the user or the user's
activity back to the attacker/perpetrator.
1. Zombie
2. Scareware
3. Dropper
4. Spyware [1]

15
 INF4831/101/0/2020

20. Which of the following is not a characteristic of good software design?

1. None of the options given.
2. information hiding
3. encapsulation
4. complexity [1]

21. A code that triggers action when a predetermined condition occurs is called a …
1. toolkit.
2. zombie.
3. dropper.
4. time bomb. [1]

22. Which of the following is one of the ways in which viruses can be executed and activated?
1. If a SETUP program contains a virus, it can activate it, but it can never be part of a Autorun
feature.
2. A virus can attach to a program and activate when the program runs, but it can never
integrate itself in the original code.
3. A virus can be a document virus such as a spreadsheet or picture with commands or it can
be included as an executable code in an email attachment.
4. All of the above. [1]

23. Good program design principles specifically for security are …

1. validation of input.
2. complete mediation.
3. separation of privilege.
4. All of the above. [1]

24. Why do browser attacks succeed?

1. failed identification
2. failed authentication
3. failed identification and authentication
4. failed authorisation [1]

25. When executable code is included in the interaction between client and server and executed
by the client or server, it is called …
1. cross-site scripting.
2. SQL injection.
3. dot-dot-slash.
4. server-side include. [1]

26. A man-in-the-browser attack is an example of …

1. software that records all keystrokes entered.
2. an attack where a user is redirected to another page.
3. download substitution.
4. a Trojan horse that intercepts data passing through the browser. [1]

16
 INF4831/101/0/2020

27. ... is when an email message purports to come from a reliable company such as a bank and
tries to trick the recipient into disclosing private data or taking another unsafe option (e.g.
clicking on an internet link in the email).
1. Phishing
2. Spam
3. Dot-dot-slash
4. Framing [1]

28. Signatures, shared secrets, one-time passwords and out of band communications are all
countermeasures for attacks against …
1. identification and authentication in man-in-the-middle attacks.
2. industrial espionage.
3. website defacement.
4. social engineering. [1]

29. What can be used so that a server can distinguish between a human who makes a request
and an automated program generating the request?
1. substitution
2. CAPTCHA
3. one-time password
4. checksum [1]

30. An attacker uses a transparent box and slips it over an existing question on a website. The
user is unaware of clicking on the transparent box and is tricked into clicking on the
transparent link which performs a malicious action. This is an example of …
1. a web bug.
2. drive-by download.
3. clickjacking.
4. cross-site scripting. [1]

TOTAL [30]

17
 INF4831/101/0/2020

11 Assignment 02 – Multiple-choice questions

1. Which of the following are security functions of an operating system?

1. enforced sharing and protection of critical operating system data.
2. encryption and authentication
3. None of the above.
4. 1 and 2 [1]

2. Which of the following is not a service of an operating system?

1. concurrency
2. control
3. deadlock
4. adware [1]

3. The operating system kernel functions include the following:

1. utility functions, file systems and memory management
2. synchronisation, security functions and hardware
3. security functions and hardware
4. sub-processes of user processes and database managers [1]

4. When an operating system presents a user with just the resources that a class of user should
see, it is called …
1. an operating system.
2. database management.
3. virtualisation.
4. a fence. [1]

5. A fence, base/bound registers/tagged architecture, virtual memory, paging and segmentation

are …
1. effective methods to implement security in a database.
2. used to protect memory space making sharing efficient and highly resistant to tampering.
3. used to protect data.
4. effective methods to implement logical access. [1]

6. Which of the following is NOT a secure design principle?

1. least privilege, open design and separation of privilege
2. complete mediation and open design
3. ease of use and permission based
4. separation of privilege and incomplete mediation [1]

18
 INF4831/101/0/2020

7. A … is a protected environment in which a program can run and not endanger anything else
on the system.
1. virtual machine
2. sandbox
3. honeypot
4. kernel [1]

8. There are several good design reasons why security functions may be isolated in a security
kernel. Which of the following is not a good reason?
1. coverage
2. separation
3. unity
4. mediation [1]

9. … is the part of an operating system that performs the lowest level functions and is the locus
of all security enforcement.
1. A database
2. An operating system
3. A kernel
4. An application layer [1]

10. Which of the following network transmissions is regarded as most secure?

1. optical fibre
2. microwave
3. satellite
4. wire [1]

11. The network layer structures a … which contains the destination address, source address and
data.
1. message
2. protocol
3. port
4. packet [1]

12. Which protocol suit is used for Wi-Fi communication?

1. 802.11
2. POP
3. http
4. IP [1]

13. Which protocol addresses some known security shortcomings in wireless networks?
1. WEP
2. WPA
3. AES
4. EAP [1]

19
 INF4831/101/0/2020

14. An attacker on a 100 MB connection floods a 10 MB victim. This is an example of … attack.

1. a ping of death
2. a Smurf
3. an echo-chargen
4. a SYN-flood [1]

15. This technique is used as a first step in an attack to map the topology, hardware and software
components of a network segment, and does not cause harm itself.
1. port scanning
2. component failure
3. wiretapping
4. radiation [1]

16. … is used when the client requests an SSL session and the server responds with its public
key certificate so that the client can determine the authenticity of the server. The server and
client compute the session key and switch to encrypted communication using a shared session
key.
1. HTTPS
2. SHA
3. NIC
4. SMPT [1]

17. Which firewall joins two subnetworks?

1. Packet filter
2. Stateful inspection
3. Application proxy
4. Circuit gateway

18. ... firewall maintains state information from one packet to another in the input stream.
1. A stateful inspection
2. An application proxy
3. A circuit gateway
4. A guard [1]

19. What is the name of the model that uses a collection of forwarding hosts, each of which knows
only from where a communication was received and where to send it next?
1. email
2. spoofing
3. onion routing
4. firewall [1]

20
 INF4831/101/0/2020

20. When data is encrypted just before it is placed on the physical communications link, this is
called …
1. link encryption.
2. end-to-end encryption.
3. browser encryption.
4. an SSL session. [1]

21. The integrity of the database elements is their correctness or accuracy. Which one of the
following is not a method for taking corrective action to correct integrity errors?
1. separate files
2. field checks
3. access control
4. change log [1]

22. Element integrity of a database can be achieved through …

1. field checks, access control and a change log.
2. redundancy.
3. statistical analysis.
4. aggregation. [1]

23. Which of the following methods is a good way of protecting the database as a whole?
1. ensuring user authentication
2. ensuring user identification
3. ensuring element integrity
4. ensuring that the database as a whole is regularly backed up [1]

24. … is a framework used by companies like Yahoo and LinkedIn, for running big data projects
which support data storage and processing.
1. Hadoop
2. Nmap
3. DBMS
4. Dropbox [1]

25. In the event of a database failure, the database can be reloaded from a back-up copy. What
can be used to implement any changes that occurred after the backup?
1. A second database copy can be used.
2. The changes should be recaptured by staff.
3. The audit log is applied.
4. The changes are lost. [1]

21
 INF4831/101/0/2020

26. The minimum requirement for protecting data confidentiality in a public cloud scenario is to
use …
1. an industry-standard symmetric encryption algorithm.
2. public and private key encryption.
3. hash functions.
4. two-factor authentication. [1]

27. In which cloud architecture can the user control the underlying systems in order to enable any
desired logging?
1. SaaS
2. PaaS
3. IaaS
4. hybrid cloud [1]

28. Which one of the following statements is correct?

1. One way in which a company can ensure data loss prevention when moving data to a cloud
is not to use a cloud environment at all.
2. One way in which a company can ensure data loss prevention when moving data to a cloud
is to force users to go through the company network to access the cloud environment.
3. Data loss prevention is not a concern in a cloud environment.
4. Data loss prevention is the responsibility of the cloud provider, and the company does not
have to implement controls. [1]

29. In a … cloud architecture the customer develops his or her own application, but the provider
affords the languages and tools for creating them.
1. SaaS
2. PaaS
3. IaaS
4. IaaS and Paas [1]

30. … cloud is a cloud that has an infrastructure that is operated exclusively by and for the
organisation that owns it, but the management may be contracted out to a third party.
1. A public
2. A community
3. A private
4. An international [1]

TOTAL [30]

22
 INF4831/101/0/2020

12 Assignment 03 – Community engagement project

The instructions and rubric for the community engagement project will be sent to you via an
announcement and will also be uploaded to the myUnisa project site of this module.

23
 INF4831/101/0/2020

13 Assignment 04 – Multiple-choice questions

1. Which of the following is true in the case of ethical considerations?

1. The same ethical principles apply to everyone; courts can therefore decide what the ethical
principles of a country are.
2. Ethical values can be assessed differently and people may have different ethical
frameworks.
3. The ethics code of conduct in an organisation defines what is acceptable for a country’s
ethical values.
4. Ethical values are universal and all people use the same ethical framework, which is based
on international privacy principles. [1]

2. In South Africa the … was signed into law to regulate the right to privacy in South Africa.
1. Promotion of Access to Information Act
2. Electronic Communications and Transactions Act
3. Protection of Personal Information Act
4. Regulation of Interception of Communications and Provision of Communication-related
Information Act [1]

3. Controlled disclosure means that a person …

1. decides what information is sensitive.
2. chooses what personal data to give out, when and to whom.
3. encrypts all sensitive data.
4. never discloses any personal information. [1]

4. Which of the following principles can be used to protect stored data?

1. Collect only the minimal amount of data.
2. Encrypt data.
3. Remove or modify identifying data items.
4. All of the above. [1]

5. Which of the following options is the foundation of privacy?

1. notice of collection and consent
2. notice of sharing and breaches
3. preventing data breaches
4. secrecy and confidentiality [1]

6. When data is replaced with untraceable codes, this is called …

1. data minimisation.
2. data anonymisation.
3. data left in place.
4. restricted usage. [1]

24
 INF4831/101/0/2020

7. Which of the following options describes eight privacy rights of individuals with regard to
sensitive data?
1. HIPAA Act
2. Rand Corporation
3. Fair Information Practices
4. COPPA Act [1]

8. Cellphones can be affected by viruses.

1. True
2. False [1]

9. You connect your home security system to your cellphone, view the video recordings on your
laptop and receive SMSs when the alarm goes off. This is an example of the connection of
devices called …
1. the internet.
2. the internet of things.
3. a network.
4. a security system. [1]

10. A CISA, CISM, CGEIT and CIPT are examples of …

1. international certifications to advance one's security career and employability.
2. encryption standards.
3. security teams.
4. international surveys. [1]

11. What is the name of the law which the South African government is working on to address
cyber crime such as hacking and ransomware in the country?
1. Electronic Communications and Transactions Act
2. Protection of Personal Information Act
3. Promotion of Access to Information Act
4. Cybercrimes and Cybersecurity Bill [1]

12. … can be a key predictor of how a firm uses security information, makes choices about security
practices and values positional goods like esteem and trust.
1. Organisational culture
2. Ethics
3. Regulations
4. Policies [1]

13. Web content can be protected by …

1. copyright.
2. patents.
3. trade secrets.
4. intellectual property rights. [1]

25
 INF4831/101/0/2020

14. People who investigate computer security vulnerabilities for malicious intent are called …
1. white hat hackers.
2. black hat hackers.
3. analysts.
4. ethical hackers. [1]

15. Which of the following options makes it difficult to assess the status of information in the cloud
as well as the privacy and confidentiality protections available to users?
1. cloud service providers
2. legal uncertainties
3. location of information
4. cloud infrastructure [1]

16. … protects inventions in the form of tangible objects, not their design or idea.
1. Copyright
2. Patent
3. Fair use of material
4. Intellectual property [1]

17. When a purchaser can use a product in the manner that it was intended for and in a way that
does not interfere with the author's rights, this is referred to as …
1. originality of work.
2. intellectual property.
3. copyright.
4. fair use of material. [1]

18. It is hard to prosecute computer crime due to …

1. lack of understanding.
2. lack of physical evidence.
3. complexity of case and age of the defendant.
4. All of the above. [1]

19. The steps in acting ethically in a situation are to …

1. obtain the facts, ask about uncertainties, acquire any additional information and identify
ethical principles involved.
2. conduct a regulatory review and then identify the risks.
3. identify the incident and conduct a vulnerability analysis.
4. obtain consent and acquire information. [1]

26
 INF4831/101/0/2020

20. … is a field in which computer security experts examine artefacts such as disk drives, log files,
program code, even volatile memory, to discern facts about data contained, often to satisfy
themselves and then the court what the retained data is and means.
1. Forensic analysis
2. Content analysis
3. Data analysis
4. Data mining [1]

21. Which of the following plans tells the staff of an organisation how to deal with a security
incident?
1. incident response plan
2. security plan
3. risk analysis plan
4. business continuity plan [1]

22. Risk … is the probability of occurrence associated with each risk measured from impossible
to certain.
1. impact
2. leverage
3. likelihood
4. analysis [1]

23. Consider the following scenario: A colleague reports to you that he clicked on a link he
received in an email, and now his computer is “acting funny”. In determining how best to
respond, which of the following should be consulted?
1. SLA
2. security policy
3. incident response plan
4. business continuity plan [1]

24. Consider the scenario where your city experiences severe flooding. The next day you go to
the bank, but they cannot assist you because their computers are down due to the flood. This
is an example of the bank failing to …
1. complete a risk analysis.
2. make adequate backups.
3. purchase waterproof computers.
4. create and execute a business continuity plan. [1]

25. Power surge variation of … is acceptable.

1. 40%
2. 30%
3. 20%
4. 10% [1]

27
 INF4831/101/0/2020

26. Which one of the following is not a step in risk analysis?

1. Identify assets and determine vulnerabilities.
2. Estimate the likelihood of exploitation.
3. Compute expected annual loss and project annual savings of controls.
4. Implement the surveyed controls. [1]

27. A … is a facility in which both power and cooling are available, and in which a computer system
can be installed for immediate operation.
1. cold site
2. hot site
3. backup
4. business continuity plan [1]

28. …. is the destruction of magnetic fields to cleanse a magnetic medium with electronic data.
1. Shredding
2. Deleting
3. Degaussing
4. Wiping [1]

29. Enclosing a computer screen in a copper conductive case helps protect against ...
1. static electricity.
2. emissions from the screen being detected and analysed from a distance.
3. the screen being stolen.
4. surges from lightning strikes.

30. A cipher should spread the information from the plaintext over the entire ciphertext so that
changes in the plaintext affect many parts of the ciphertext. This is called …
1. substitution.
2. transposition.
3. confusion.
4. diffusion. [1]

TOTAL [30]

28
 INF4831/101/0/2020

14 Assignment 05 – Long questions

Chapter 1
1.1 Explain the difference between identification, authentication and authorisation. (3)
1.2 List at least three kinds of damage a company could suffer when the integrity of a program
or company data is compromised. (3)
1.3 Explain the difference between a threat and a vulnerability. (2)
1.4 Your organisation tasks you to propose two procedural and two technical controls to protect
financial data of clients that will be hosted by a third party of your organisation. Discuss two
procedural and two technical controls that you will propose. (4)
[12]
Chapter 2
2.1 What is a transposition cipher? (1)
2.2 What is a substitution cipher? (1)
2.3 Encrypt the following message by applying four-column columnar transposition: (3)
the application passed

2.4 Encrypt the result of your answer in 2.3 using a Caeser cipher with a shift of 3. (4)
2.5 Watch the “Cryptography fundamentals” online video of the IEEE. Discuss the Triple Des
and Twofish encryption algorithms.
https://ieeexplore.ieee.org/servlet/opac?mdnumber=EW1455 (4)

2.6 Watch the “Cryptography fundamentals” online video of the IEEE and give advantages of
asymmetric encryption:
https://ieeexplore.ieee.org/servlet/opac?mdnumber=EW1455 (2)

2.7 Watch the “Cryptography fundamentals” online video of the IEEE and answer the following
question:
https://ieeexplore.ieee.org/servlet/opac?mdnumber=EW1455

Discuss what a hash function is (2 marks) and also discuss the hashing function which
security experts mainly use (2 marks). (4)

29
 INF4831/101/0/2020

2.8 Bob has to send an electronic message to Alice. Two requirements must be met, namely
that only Alice must be able to read the document and Alice must be sure that Bob sent
her the document. Discuss with which public key (Alice or Bob’s) and private key (Alice or
Bob’s) the message must be encrypted and decrypted. (2)
[25]
Chapter 3
3.1 Explain what a buffer overflow is (3 marks) and give three implications of a buffer overflow
(3 marks). (6)
3.2 Explain the following programming errors:

 Incomplete mediation
 TOCTTOU
 Undocumented access point
 Off-by-one error (4)

3.3 Discuss seven ways in which a virus can be executed. (7)

3.4 Programmers must program in such a way that they maintain security. Identify six software
engineering techniques to enhance security. (6)
[23]
Chapter 4
4.1 Contrast the man-in-the-browser, page-in-the-middle and user-in-the-middle attack. (6)
4.2 Define the following in one sentence each:
a) Defaced website
b) Web bug
c) Clickjacking
d) Drive-by download
e) Cross-site scripting
f) SQL injection
g) Spam
h) Phishing
i) S/MIME
j) PGP (10)

4.3 Discuss three countermeasures that can be used for attacks against identification and
authentication. (3)
[19]

30
 INF4831/101/0/2020

Chapter 5
5.1 The operating system runs applications, supports network connections and manages and
communicates with the computer’s resources. It is critical to implement security functions
for the operation system. Discuss each of the following security functions:
a) Virtualisation
b) Separation and sharing
c) Hardware protection of memory (3)

5.2 Discuss six reasons why security functions should be isolated in a security kernel. (6)
[9]
Chapter 6
Watch the IEEE “System Fundamentals for Cyber Security” video and answer the following
questions:
https://ieeexplore.ieee.org/servlet/opac?mdnumber=EW1454
6.1 Discuss how a proxy can be used to implement security in a network. (4)
6.2 Draw the layers of the ISO model as presented in the IEEE System Fundamentals for
Cyber Security video. (7)
6.3 What would you recommend as the basic security measures to protect Windows? (3)
[14]
Chapter 7
7.1 Discuss the seven security requirements of a database. (7)
7.2 Geotagging and tracking of devices can result in inference or correlation concerns.
Discuss five methods that can be used to address inference and aggregation problems. (5)
7.3 Contrast big data and data mining. (4)
[16]
Chapter 8
8.1 An organisation requires a cloud deployment model in which employees of the organisation
have exclusive access to it and the organisation owns it. Which cloud deployment model
would you recommend and why? (4)

8.2 An organisation requires a cloud service model in which the organisation can deploy and
run arbitrary software and can also request operating systems and some network
components.
a) Which cloud service model would you recommend? (2)
b) Why would you not recommend the other two cloud service models? (4)

[10]

31
 INF4831/101/0/2020

Chapter 9

Consider images A and B below and answer questions 9.1 and 9.2.

Image A Image B

9.1 Name and explain two Fair Information Practice principles that are implemented in image
A and explain why you identified the specific principles (2 marks each). (4)

9.2 Name and explain two Fair Information Practice principles that are implemented in image
B and explain why you identified the specific principles (2 marks each). (4)

[8]
Chapter 10

10.1 Discuss the six requirements of a security plan. (6)

10.2 Contrast a business continuity and incident response plan. (4)

10.3 Discuss what the following security models are:

a) ISO27001/2
b) NIST Security Publications
c) Control Objectives for Information and Related Technology (COBIT)
d) Information Technology Infrastructure Library (ITIL)
(Note: You can search on the internet for the answers to question 10.3.) (4)

32
 INF4831/101/0/2020

10.4 There are three types of security policies according to Whitman and Mattord (2010),
Management of information security, 5th edition, Cengage Learning.

“The enterprise information security policy (EISP): The high-level information security policy
that sets the strategic direction, scope and tone for all of an organisation’s security efforts.
An EISP is also known as a security program policy, general security policy, IT security policy,
high-level InfoSec policy, or simply an InfoSec policy.”

“Issue-specific security policy (ISSP): An organisational policy that provides detailed, targeted
guidance to instruct all members of the organisation in the use of resources, such as one of
its processes or technologies.”

“System-specific security policy (SysSP): Organisational policies that often function as

standards or procedures to be used when configuring or maintaining systems. SysSPs can
be separated into two general groups, managerial guidance and technical specifications, but
may be written as a single unified SysPS document.”

Indicate if the following statements are true or false in terms of the above definitions:
(Only type your answer as True or False.)

a) The EISP must support the organisation’s vision and mission statements and is an
executive-level document drafted by the Chief Information Security Officer. (1)

b) The EISP shapes the security philosophy of the organisation and therefore requires
frequent updates. (1)

c) User access, email usage, virus protection requirements, password selection, penalties
for violation and prohibited uses of assets are typical topics covered in an ISSP. (1)

d) The ISSP must always be written as separate documents that each covers a specific issue,
it must not be created as a single policy document. (1)

e) Procedural elements are not typically included in the SysSP. (1)

f) The SysSP often functions as standards or procedures like a firewall configuration or local
security policy settings for the Windows 7 operating system. (1)

[20]

Chapter 11

11.1 What is the purpose of the Protection of Personal Information Act 2013 of South Africa?
(1)
11.2 What is the purpose of the Electronic Communications and Transactions Act 2002 of
South Africa? (1)

[2]

Total [150]
33