Definitions of security principles covered by the CIA triad.

1. (5 points)
   Provide the definitions of security principles covered by the CIA triad.
   Answer:
2. (25 points)
   Classify each of the following acts (not necessarily related to computing infrastructures) as a violation of confidentiality, integrity, authenticity, or availability, or some combination thereof:
   Hint: Answers may not be unique. Explain your answers as well as possible!

a. A hacker obtains millions of Facebooks passwords.
Answer:

b. Bob accidentally cuts the electricity from the server room.
Answer:

c. The National Security Agency (NSA) that is in charge of cryptographic and communications intelligence and security, finds an efficient method to break Advanced Encryption Standard (AES).
Answer:

d. Hanna registers the domain name “JohnSmith.com” and refuses to let John Smith buy or use the domain name.
Answer:

e. Ransomware attacks victim’s hard drive by locking with a secret key, and a criminal asks for a ransom to decrypt it.
Answer:

f. The NSA wiretaps the cell phone of a suspect in a criminal investigation.
Take into consideration that, according to Executive Order 12333 (EO 12333), NSA is prohibited the collection, retention, or dissemination of information about U.S. persons except pursuant to procedures established by the head of the agency and approved by the Attorney General.
Answer:

g. A foreign state actor finds a zero-day vulnerability for voting machines used in the US.
A zero-day vulnerability is a vulnerability in a software that exists and maybe known to the vendor, or developer, or a hacker, but there is no “patch” for it yet.
Answer:

h. A result of Tom’s college admission test was sent to Tim.
Answer:

3. (15 points)
   Read the following scenarios, provide the analysis of the situations and described what you would do. Justify your answers.

a. A friend sends an electronic greeting card (e-card) to your work email. You need to click on the attachment to see the card. What should you do? Justify.
Answer:

b. Your supervisor is very busy and asks you to log into the HR Server using her user-ID and password to retrieve some reports. What should you do? Justify.

A: It’s your boss, so it’s okay to do this.