Computer Security book by Charles Chapter 1 Exercise Solutions

1. Distinguish between vulnerability, threat, and control.

In the above diagram, a man is standing near a wall with his finger placed inside a hole. There is water on left side of wall and a crack in a wall that you can see.
For understanding the threat and vulnerability difference, we will understand it by the above diagram as a analogy. 

By definition. Vulnerability is a weakness in the system ( loophole ) that might be exploited in the future to cause harm or loss. 
Threat is a set of events, circumstances that may happen and potential to cause harm.

Now, in the above diagram, If the water level rises, then the man may get wet, get harm either the water gets spilled out, overflows.
So Water is the threat to Man.

Now there is a weakness in the wall, i.e Crack is present, that some time it can diminish the entire wall, break the entire wall and thus it is a vulnerability. 

To address this Harm, Threats, Vulnerabilities, We have Control or CounterMeasures. 

Therefore, Control is a procedure, technique, tool, action that can remove vulnerability or reduces it and enhance protection.

2. Theft usually results in some kind of harm. For example, if someone steals your car, you may suffer financial loss, inconvenience (by losing your mode of transportation), and emotional upset (because of invasion of your personal property and space). List three kinds of harm a company might experience from theft of computer equipment.

In a theft of computer equipments, There may be harm like Software harm, hardware harm, networking harm, etc..

Hardware harm include Financial loss, Integrity, availability loss and confidentiality loss too.

3. List at least three kinds of harm a company could experience from electronic espionage or unauthorized viewing of confidential company materials.

Confidentiality aspect of computer security gets directly harmed.Unauthorized view of company materials lead to financial loss, many other types of harm like leak of personal information, future plans, marketing strategies, profit and loss, accounts, banking information, etc... 

4. List at least three kinds of damage a company could suffer when the integrity of a program or company data is compromised. 

This is serious as integrity is compromised that leads to unexpected results like unintentional media coverage, misleading information by modifying documents, etc.. Loss of Respect, Pride, honor, reputation of company due to loss of integrity.

5. List at least three kinds of harm a company could encounter from loss of service, that is, failure of availability. List the product or capability to which access is lost, and explain how this loss hurts the company.

Service will be hindered as availability is compromised. 
Harm can be lack of services to customers, clients, government, individuals,etc.

Harm can be no salary issue, no processing of computer services,etc.. 

6. Describe a situation in which you have experienced harm as a consequence of a failure of computer security. Was the failure malicious or not? Did the attack target you specifically or was it general and you were the unfortunate victim?

No particular situation that caused harm as a consequence of a failure of computer security. The failure was not malicious. The attack was not happened.

7. Describe two examples of vulnerabilities in automobiles for which auto manufacturers have instituted controls. Tell why you think these controls are effective, somewhat effective, or ineffective.

I dont have answer for this 

8. One control against accidental software deletion is to save all old versions of a program. Of course, this control is prohibitively expensive in terms of cost of storage. Suggest a less costly control against accidental software deletion. Is your control effective against all possible causes of software deletion? If not, what threats does it not cover?

One control for accidental software deletion is to have a backup all programs periodically or To have a authentication system so that two step confirmation takes place before deleting a software. By opting this method, The owner of system can be verified and secondly, Accidental software deletion can be prevented. 

9. On your personal computer, who can install programs? Who can change operating system data? Who can replace portions of the operating system? Can any of these actions be performed remotely?

On my personal computer, only root user can install programs and change OS data. Also only the user with admin rights can replace portions of OS. Any of these actions can be performed remotely if a shell server is set up.

10. Suppose a program to print paychecks secretly leaks a list of names of employees earning more than a certain amount each month. What controls could be instituted to limit the vulnerability of this leakage?

Best control to limit the vulnerability of this leakage is by having randomness in data and less obvious fields common. Instead, some important fields like name, number, etc .. should not be related to one another 

11. Preserving confidentiality, integrity, and availability of data is a restatement of the concern over interruption, interception, modification, and fabrication. How do the first three concepts relate to the last four? That is, is any of the four equivalent to one or more of the three? Is one of the three encompassed by one or more of the four?

CIA is closely related to other four aspects i.e Interruption, interception, modification, fabrication. the modification is directly related to integrity whereas fabrication is directly related to confidentiality. and other two interruption, interception are general in nature.

12. Do you think attempting to break in to (that is, obtain access to or use of)  a computing system without authorization should be illegal? Why or why not?

yes, it is illegal because Privacy is hindered, the Principle of Computer security is also damaged.

13. Describe an example (other than the ones mentioned in this chapter) of data whose confidentiality has a short timeliness, say, a day or less. Describe an example of data whose confidentiality has a timeliness of more than a year.

Ex- > NAme -> does not change over a long period

Date or transaction date and amount of balance  -> changes every year, so data here has less confidential timeliness.

14. Do you currently use any computer security control measures? If so, what? Against what attacks are you trying to protect?

Admin level access control, cryptography, etc...

15. Describe an example in which absolute denial of service to a user (that is, the user gets no response from the computer) is a serious problem to that user. Describe another example where 10 percent denial of service to a user (that is, the user’s computation progresses, but at a rate 10 percent slower than normal) is a serious problem to that user. Could access by unauthorized people to a computing system result in a 10 percent denial of service to the legitimate users? How?

yes indeed, Attacks like Ddos can completely left services unusable by a single user also, whereas a 10% rate of attack is comparatively less harmful.

16. When you say that software is of high quality, what do you mean? How does security fit in your definition of quality? For example, can an application be insecure and still be “good”?

It depends on the perspective of user. if user is security conscious, then sure individual will take care of it. High quality software definition for that person will be different than a naive user.