Introduction to Information Assurance Assignment 1

1. Classify each of the following as a violation of confidentiality, of integrity, of availability,

or of some combination thereof.

a. John copies Mary's homework. [2]

Answer: Confidentiality Copying a data is a violation of confidentiality.

b. Paul crashes Linda's system. [2]

Answer: Availability This crashing causes unavailability of the system to Linda.

c. Carol changes the amount of Angelo's check from $100 to $1,000. [2]
Answer: Data Integrity The data on the check got changed which is a data integrity
violation.

d. Gina forges Roger's signature on a deed. [2]

Answer: Source Integrity Gina forged the signature of Roger. The deed appears is coming
from Roger which is not true and hence it is related to source integrity.

e. Rhonda registers the domain name "AddisonWesley.com" and refuses to let the publishing
house buy or use that domain name. [2]
Answer: Availability, Integrity The name of the website will not be available to the
publishers to buy and it is violation of availability. The users of the website may believe that
Rhondas website is the legitimate site and it is violation of Integrity.

f. Jonah obtains Peter's credit card number and has the credit card company cancel the card
and replace it with another card bearing a different account number. [2]
Answer: Confidentiality, Integrity, Availability - Jonah obtained the credit card of Peter
and caused for the cancellation. Here the credit card information has been used without any
authorization and hence it is related to confidentiality. The card number got changed due
to the false representation of Jonah and hence it is a violation of integrity in specific Source
Integrity.
Due to this Peter will no longer able to use his credit card and it is violation of availability.

So this scenario is a violation of Confidentiality, Integrity, and Availability.

g. Henry spoofs Julie's IP address to gain access to her computer. [2]

Answer: Source Integrity, Confidentiality Henrys message appears coming from Julies
IP address which is not true. So it is a violation of Integrity in specific source integrity. By
doing this Henry can access the data of Julie and it is the violation of Confidentiality.
2. Consider a computer system with three users: Alice, Bob, and Cyndy. Alice owns the file
alicerc,and Bob and Cyndy can read it. Cyndy can read and write Bob's file bobrc, but Alice can
only read it. Only Cyndy can read and write her file cyndyrc. Assume that the owner of each of
these files can execute it.

a. Create the corresponding access control matrix. [3]

Answer: Here the rights are O Own, X Execute, R Read, W Write. The access control
matrix is as follows.

alicerec bobrc cyndyrc

Alice O, X R
Bob R O, X
Cyndy R R, W O, X, R, W

b. Cyndy gives Alice permission to read cyndyrc, and Alice removes Bob's ability to read alicerc. Show
the new access control matrix. [3]
Answer:
alicerec bobrc cyndyrc
Alice O, X R R
Bob O, X
Cyndy R R, W O, X, R, W

3. Let c be a copy flag and let a computer system have the rights {read, write, execute, append, list,
modify, own}.
a. Write a command copy_all_rights(p, q, s) that copies all rights that p has over s to q. [3]
Answer:
Here copy_all_rights is the copy flag and the following is the command to copy all the rights {read,
write, execute, append, list, modify, own} that p has over s to q.

command copy_all_rights(p, q, s)
if read in a[p, s] then
enter read in a[q, s];
if write in a[p, s] then
enter write in a[q, s];
if execute in a[p, s] then
enter execute in a[q, s];
if append in a[p, s] then
enter append in a[q, s];
if list in a[p, s] then
enter list in a[q, s];
if modify in a[p, s] then
enter modify in a[q, s];
if own in a[p, s] then
enter own in a[q, s];
end
b. Modify your command so that only those rights with an associated copy flag are copied. The new
copy should not have the copy flag. [3]
Answer:

command copy_all_rights(p, q, s)
if read in a[p, s] and copy in a[p, s]
then
enter read in a[q, s];
if write in a[p, s] and copy in a[p, s]
then
enter write in a[q, s];
if execute in a[p, s] and copy in a[p, s]
then
enter execute in a[q, s];
if append in a[p, s] and copy in a[p, s]
then
enter append in a[q, s];
if list in a[p, s] and copy in a[p, s]
then
enter list in a[q, s];
if modify in a[p, s] and copy in a[p, s]
then
enter modify in a[q, s];
if own in a[p, s] and copy in a[p, s]
then
enter own in a[q, s];
delete copy in a[q,s];
end

c. In part (b), what conceptually would be the effect of copying the copy flag along with the right? [4]
Answer:
If the copy flag is copied along with the right to q, then q gets the copy right on object s and
it can grant the same rights on s to another process again.