Note: Answer questions succinctly and clearly, explain your answer, and show your work. Answers, even if right but without an explanation, will get no credit. GRADING COMMENTS: NOTE: Your word...

1 answer below »
Note: Answer questions succinctly and clearly, explain your answer, and show your work. Answers, even if right but without an explanation, will get no credit. GRADING COMMENTS: NOTE: Your word document shall be prepared in the APA format) and make sure you include your references to each question.. each problem must have reference(s) and if you decide to use the Bishop textbook as one (1) of your reference: you must identify the Chapter and page # of your reference. You will not be allowed to reference Chapter 24 for example without a page # associated with it. When I am grading your final, I plan on checking out all your references since we will not be using Turnitin for this specific case. Lack of references or incorrect references/problem will result in a failure in your final. Questions taken from the following text book: http://books.google.com/books?id=pfdBiJNfWdMC&pg=PA495&lpg=PA495&dq=A+company+develops+a+new++security+product+using+the+extreme+programming+software+development&source=bl&ots=zZfry6w-sD&sig=J_8pCa1jPMjP8bLpExPx3WnNLhk&hl=en&sa=X&ei=FsF2UdzcA8m50AGa6oHICA&sqi=2&ved=0CDwQ6AEwAA Answer the following questions. 1) (12 pts.) Chapter 18 (pgs. 494-495) –Problem#7 A company develops a new security product using the extreme programming software development methodology. Programmers code, then test, the en add more code, then test, and continue this iteration. Every day they test the code base as a whole. The programmers work in pairs when writing code to ensure that at least two people review the code. How would you explain to this company how their software is in fact not high assurance” software? 2) (15 pts.) Chapter 22 (pgs. 642-643) –Problem#2 Consider how a system with capabilities as its access control mechanism could deal with Trojan Horses. A) In general, do capabilities offer more or less protection against Trojan horses than do access control lists? Justify your answer in light of the theoretical equivalence of ACLs and C-Lists B) Consider now the inheritance of properties of new processes. If the creator controls which capabilities the created process is given initially, how could the creator limit a damage that a Trojan Horse will do? C) Can capabilities protect against all Trojan Horses? Either show that they can or describe a Trojan horse process that can C-Lists cannot protect against 3) (18 pts.) Chapter 22 (pgs. 642-643) –Problem#12 Assume that the Clark –Wilson model is implemented on a computer system. Could a computer virus that scrambled constrained data items be introduced into the system? Why or why not? Specifically, if not identify the precise control that would prevent the virus from being introduced, and explain why it would prevent the virus from being introduced; if yes identify the specific control or controls that would allow the virus to be introduced and explain why they fail to keep it out. 4) (20 pts.) Chapter 23 (pgs. 685-687) –Problem#1 Classify the following vulnerabilities using the RISOS model. Assume that the classification is for the implementation level. Justify your answer: a)The presence of the wiz command in the sendmail program(see Sect. 23.2.8) b) The failure to handle the IFS shell variable by loadmodule(see section 23.2.8) c) The failure to select an Administrator password that was difficult to guess(see sect. 23.2.9) d)The failure of the Burroughs system to detect offline changes to files(see section 23.2.3.6) 5) (15 pts.) Chapter 23 (pgs. 685-687) –Problem#4 A common error in the UNIX system occurs during configuration of bind, a directory name server. The time-to-expire field is set at 0.5 because the administrator believes that this field unit is minutes (and wishes to set the time to 30 seconds) However, bind expects the field to be in seconds and reads the value as 0 – meaning that no data is ever expired. a) Classify this vulnerability using the RISOS model, and justify your answer b) Classify this vulnerability using the PA model and justify your answer c) Classify this vulnerability using the Aslam’s model and justify your answer 6) (20 pts.) Essay Question: Secure software certification. Your present company (assignment#2) is at EAL4. You are the new program manager on this effort and your job is to bring your present software secure package to EAL7. Explain to me your management plan on upgrading your present software package from EAL4 to EAL7. Your management plan should include discussing your past documentation (assignment#2), the difference between EAL4 and EAL7, what additional paperwork will be needed to reach EAL7 certification, and finally, define your risk based on reusing software code for this migration from EAL4 to EAL7 certification. Link to the book. http://books.google.com/books?id=pfdBiJNfWdMC&pg=PA495&lpg=PA495&dq=A+company+develops+a+new++security+product+using+the+extreme+programming+software+development&source=bl&ots=zZfry6w-sD&sig=J_8pCa1jPMjP8bLpExPx3WnNLhk&hl=en&sa=X&ei=FsF2UdzcA8m50AGa6oHICA&sqi=2&ved=0CDwQ6AEwAA GRADING: 1._________ (12 pts.) 2._________ (15 pts.) 3._________ (18 pts.) 4._________ (20 pts.) 5._________ (15 pts.) 6._________(20 pts.) FINAL EXAM GRADE = “ “
Answered Same DayDec 22, 2021

Answer To: Note: Answer questions succinctly and clearly, explain your answer, and show your work. Answers,...

Robert answered on Dec 22 2021
125 Votes
1) (12 pts.) Chapter 18 (pgs. 494-495) –Problem#7
A company develops a new security product using the extreme programming software
development methodology. Programmers code, then test, the en add more code, then
test, and continue this iteration. Every day they test the code base as a whole. The
programmers work in pairs when writing code to ensure that at least two people review
the code. How would you explain to this company how their software is in fact not high
assurance” software?
Extreme programming is that programming language in which the result driven appro
ach is
followed and then a methodology is applied to derive the required result. This approach
follows an incremental approach in which the module is continuously tested and then revised
according to the requirements. This approach has various advantages and disadvantages. The
main goals of this approach are as follows:
 This approach aims to develop higher quality software products with more
productivity.
 The overall cost to develop the product is reduced because the development process
consists of multiple short development cycle instead of having a longer one.
 This approach provides flexibility to the system. New requirements can be
accommodated with ease using this technique of software development.
This approach of extreme programming executed by a pair of programmers does not make
the system as highly assurance. This approach suffers from the following disadvantages:
• Unstable Requirements: The requirements are unstable. It keeps on varying and hence
sometimes the product developed so far needs to be recreated from scratch to fulfill
the new requirements.
• Lack of documentation: As the requirements keeps on varying, it results in a lack of
documentation. Documentation is a very important part of the product development
Comment [QM1]: Can we have at least a def and
goals of extreme programming software
development methodology, then show the
disadvantages as they tie to the question ? Please.
Comment [QM2]: This is just a list of the
disadvantages. Can the expert explain them also
please discuss these as it relates to the question. It
not acceptable to have not even half a page of
meaningful material but half a page for references
this makes no sense.
life cycle. This helps the new members to understand the project requirements and its
working. The documentation is really helpful in the maintenance stage of the product.
• Lack of design specification: This results in lack of planning for the software
development.
• Most of the people cannot perform efficiently under tight supervision so it directly
affects their outcome and productivity.
• It is very common that the programmers may have the differences in their logic and
coding styles. This may result in programming conflicts which will directly affect the
quality of the product.
• The product can be developed effectively only if the programmers have the same
level of coding expertise and logic thinking. This approach increases the dependency
on the understanding level of the programmers. And it is very difficult to find the
programmers having the same level of programming expertise and knowledge.
References
1. Emery, P. (n.d.). The Dangers of Extreme Programming. Retrieved April 27, 2013, from
http://members.cox.net: http://members.cox.net/cobbler/XPDangers.htm
2. Hutagalung, W. (2006). Extreme Programming. Retrieved April 27, 2013, from
http://www.umsl.edu: http://www.umsl.edu/~sauterv/analysis/f06Papers/Hutagalung/
3. Jarvis, B. &. (n.d.). Extreme Programing (XP), Six Sigma and CMMI How they can work
together. Retrieved April 27, 2013, from http://www.sei.cmu.edu:
http://www.sei.cmu.edu/library/assets/jarvis-gristock.pdf
2) (15 pts.) Chapter 22 (pgs. 642-643) –Problem#2
Consider how a system with capabilities as its access control mechanism could deal with
Trojan Horses.
A) In general, do capabilities offer more or less protection against Trojan horses than
do access control lists? Justify your answer in light of the theoretical equivalence of
ACLs and C-Lists
B) Consider now the inheritance of properties of new processes. If the creator controls
which capabilities the created process is given initially, how could the creator limit a
damage that a Trojan Horse will do?
A) Yes, Capabilities offer more protection against Trojan Horses than access control lists.
This is because the capabilities works on the "Confused Deputy" scenario in which the
issue in which a process can run is addressed with authorization from 2 different
resources.
In ACL design, multiple authorities are used, which can act simultaneously on the
process. In the capability design, the process can act only as one authority instead of
multiple authority and this helps in resolving the issue by blocking the Trojan Horse
access to the process.
Reference:
Hardy, N. (n.d.). The Confused Deputy. Retrieved April 27, 2013, from http://www.cap-
lore.com: http://www.cap-lore.com/CapTheory/ConfusedDeputy.html
B) As the creator controls the capabilities of the created process, it can limit a damage that a
Trojan Horse will do by executing only the capabilities which are mandatory for the
process to complete its task. The scope of actions is narrowed down and so the damage is
minimized.
References:
1. Hardy, N. (n.d.). The Confused Deputy. Retrieved April 27, 2013, from http://www.cap-
lore.com: http://www.cap-lore.com/CapTheory/ConfusedDeputy.html
2. MEADE, F. G. (n.d.). Retrieved April 27, 2013, from NATIONAL COMPUTER
SECURITY CENTER: http://csrc.nist.gov/publications/secpubs/rainbow/tg003.txt
C) No Capabilities cannot protect against all Trojan horses. The complexity of the system is
extremely...
SOLUTION.PDF

Answer To This Question Is Available To Download

Related Questions & Answers

More Questions »

Submit New Assignment

Copy and Paste Your Assignment Here