1) What is the first step in problem-solving? A) Writing code B) Debugging C) Understanding the problem D) Optimizing the solution Answer: C 2) Which of these is not a step in the problem-solving process? A) Algorithm development B) Problem analysis C) Random guessing D) Testing and debugging Answer: C 3) What is an algorithm? A) A high-level programming language B) A step-by-step procedure to solve a problem C) A flowchart D) A data structure Answer: B 4) Which of these is the simplest data structure for representing a sequence of elements? A) Dictionary B) List C) Set D) Tuple Answer: B 5) What does a flowchart represent? A) Errors in a program B) A graphical representation of an algorithm C) The final solution to a problem D) A set of Python modules Answer: B 6) What is pseudocode? A) Code written in Python B) Fake code written for fun C) An informal high-level description of an algorithm D) A tool for testing code Answer: C 7) Which of the following tools is NOT commonly used in pr...
Computer-Security Classifications
* No computer system can be 100% safe, and attempts to make it so can fastly make it not usable.
* However one can establish a level of faith to which one feels "safe" using a given computer system for specific security needs.
* The U.S. Department of Defense’s "Trusted Computer System Evaluation Criteria" defines four broad levels of faith, and sub-levels in some cases:
• Level D is the minimum trustworthy, and incorporate all systems that do not meet any of the more strict criteria. DOS and Windows 3.1 fall into level D, whichhas no user identification or authorization, and anyone who sits down has full process and control over the machine.
• Level C1 adds user identification and authorization, and some means of
controlling what users are permited to process what files. It is constructed for use by a group of mostly cooperating users, and describes most common UNIX systems.
• Level C2 adds individual-level control and monitoring. For example file access
control can be permited or delayed on a per-individual basis, and the system
administrator can monitor and log the activities of particular individuals. Another
limitation is that when one user uses a system resource and then turns it back to the system, another user who uses the same resource later cannot read any of the data that the first user stored there. (I.e. buffers, etc. are wiped out
between users, and are not left full of old contents.) Some special safe versions
of UNIX have been verified for C2 security levels, such as SCO.
• Level B adds responsiveness labels on each object in the system, such as "secret", "top secret", and "confidential". Individual users have different clearance levels, which controls which objects they are able to process. All human-readable documents are labeled at both the top and bottom with the responsiveness level of the file.
• Level B2 enlarge sensitivity labels to all system resources, including devices. B2
also supports turn channels and the auditing of events that could exploit turn channels.
• B3 allows creation of access-control lists that signify users NOT given access to
specific objects.
• Class A is the highest level of security. Architecturally it is the same as B3, but it
is developed using formal methods which can be used to prove that the system
meets all needs and cannot have any possible bugs or other vulnerabilities.
Systems in class A and higher may be designed by trusted personnel in secure
facilities.
• These classifications defines what a system can implement, but it is up to
security policy to define how they are implemented in practice. These systems
and policies can be reviewed and verified by trusted organizations, such as the
National Computer Security Centre. Other standards may dictate physical protections and other problems.
An Example: Windows XP
* Windows XP is a normal purpose OS designed to support a vast variety of security features and methods. It is based on user accounts which can be collected in any manner.
* When a user logs on, a security process token is gives that includes the security ID for the user, security IDs for any groups of which the user is a member, and a list of any special privileges the user has, such as performing backups, shutting down the system, and modifying the system clock.
* Every process running on behalf of a user gets a duplicate of the user’s security token, which defines the privileges of that process running on behalf of that user.
* Authentication is generally complete via passwords, but the modular design of XP permits for another authentication such as retinal scans or fingerprint readers.
* Windows XP includes built-in auditing that permits many common security threats to be monitored, such as successful and unsuccessful logins, logouts, attempts to write to executable files, and process to certain sensitive files.
* Security attributes of objects are defined by security descriptors, which adds the ID of the owner, group ownership for POSIX subsystems only, a discretionary access-control list defining exactly what permissions each user or collection on the system has for this specific object, and auditing control information.
* The access control lists adds for each specified user or group either Access Allowed or Access Denied for the following types of actions: Read Data, Write Data, Append Data, Execute, Read Attributes, Write Attributes, ReadExtendedAttribute, and WriteExtendedAttribute.
* Container objects such as directories can logically consists of other objects. When a new object is created in a container or duplicate into a container, by default it inherits the permissions of the new container. No container objects inherit any other permission. If the permissions of the container are changed later, that does not affect the access of the contained objects.
* Although Windows XP is effective of supporting a secure system, many of the security features are not enabled by default, resulting in a fair number of security breaches on XP systems. There are also a large number of system daemons and other programs that start
automatically at start-up, whether the system administrator has thought about them or not. (My system currently has 54 processes running, most of which I did not intentionally start and which have short cryptic names which makes it hard to divine exactly what they do /or why. Faced with this situation, most users and administrators will simply leave alone
anything they don't understand. )