Eliminate Risk of Failure with ISC2 ISSMP Exam Dumps

The Biba model is a formal state transition system of computer security policy that describes a set of access control rules designed to ensure data integrity. Data and subjects are grouped into ordered levels of integrity. The model is designed so that subjects may not corrupt data in a level ranked higher than the subject, or be corrupted by data from a lower level than the subject.

The Clark-Wilson security model provides a foundation for specifying and analyzing an integrity policy for a computing system.

Answer option C is incorrect. The Bell-LaPadula access control model is mainly used in military systems.

Answer option A is incorrect. There is no such access control model as Clark-Biba.

In the discretionary access control, an authority, within limitations, specifies what objects can be accessed by a subject.

Answer option D is incorrect. In the mandatory access control, a subject's access to an object is dependent on labels.

Answer option A is incorrect. In the role-based access control, a central authority determines what individuals can have access to which objects based on the individual's role or title in the organization.

Answer option C is incorrect. The task-based access control is similar to role-based access control, but the controls are based on the subject's responsibilities and duties.

Physical Configuration Audit (PCA) is one of the practices used in Software Configuration Management for Software Configuration Auditing. The purpose of the software PCA is to ensure that the design and reference documentation is consistent with the as-built software product. PCA checks and matches the really implemented layout with the documented layout.

Answer option D is incorrect. Functional Configuration Audit or FCA is one of the practices used in Software Configuration Management for Software Configuration Auditing. FCA occurs either at delivery or at the moment of effecting the change. A Functional Configuration Audit ensures that functional and performance attributes of a configuration item are achieved.

Answer option C is incorrect. Configuration control is a procedure of the Configuration management. Configuration control is a set of processes and approval stages required to change a configuration item's attributes and to re-baseline them. It supports the change of the functional and physical attributes of software at various points in time, and performs systematic control of changes to the identified attributes.

Answer option A is incorrect. Configuration identification is the process of identifying the attributes that define every aspect of a configuration item. A configuration item is a product (hardware and/or software) that has an end-user purpose. These attributes are recorded in configuration documentation and baselined. Baselining an attribute forces formal configuration change control processes to be effected in the event that these attributes are changed.

Eavesdropping is the process of listening in private conversations. It also includes attackers listening in on the network traffic. For example, it can be done over telephone lines (wiretapping), e-mail, instant messaging, and any other method of communication considered private.

Answer option B is incorrect. Spoofing is a technique that makes a transmission appear to have come from an authentic source by forging the IP address, email address, caller ID, etc. In IP spoofing, a hacker modifies packet headers by using someone else's IP address to hide his identity. However, spoofing cannot be used while surfing the Internet, chatting on-line, etc. because forging the source IP address causes the responses to be misdirected.

Answer option A is incorrect. Shielding cannot be done over e-mail and instant messaging. Shielding is a way of preventing electronic emissions that are generated from a computer or network from being used by unauthorized users for gathering confidential information. It minimizes the chances of eavesdropping within a network. Shielding can be provided by surrounding a computer room with a Farady cage. A Farady cage is a device that prevents electromagnetic signal emissions from going outside the computer room. Shielding can also protect wireless networks from denial of service (DoS) attacks.

Answer option D is incorrect. Packaging is a process in which goods are differentiated on the basis of the container in which they are stored, such as bottles, boxes, bags, etc.

The following concepts represent the three fundamental principles of information security.

1.Confidentiality

2.Integrity

3.Availability

Answer option C is incorrect. Privacy, authentication, accountability, authorization and identification are also concepts related to information security, but they do not represent the fundamental principles of information security.