95-752 Midterm Examination
Examination length: No longer than 4 hours, not including reading and preparation time.
Due: Oct 9, 2008, 6:00pm  Eastern Time.
Instructions:
1.	You will need to add paper to record your responses to these questions. Please be sure that you put your name on EACH PAGE you wish included in the grading of this examination. Electronic submissions (including e-mail) must be edited so that your name appears on each page. E-mail submissions must have the subject line “Midterm Submission”; all e-mailed submissions will be acknowledged.  Please do not submit both via e-mail and physically in class.
2.	This examination is open book, open notes, closed neighbor. Students may consult any non-interactive reference they choose, but no direct or indirect (e.g., NO E-mail, NO netnews, NO conversation) contact with any human other than the instructor or teaching assistants. Any communication between students concerning the examination is forbidden. Citation of sources of information is mandatory, in compliance with the CMU Plagiarism policy.
3.	Ensure that you answer all parts of each question. Some questions have more than one part.
4.	Please read each question carefully. If the question is unclear then do not hesitate to ask for clarification.
Good Luck!
Grading: 
1 (25 points)

2 (25 points)

3 (25 points)

4 (25 points)

	Total:

1) (25 points) Assume you are working for an organization concerned with its internal security.  You have been tasked to study possible measures to prevent losses due to interception and interruption of proprietary e-mail..
a)	In a short paragraph, identify three risks to an organization associated with interception and interruption of proprietary e-mail.
b)	Briefly (1 short sentence) identify one way in which physical security may aid in this effort.
c)	Briefly (2 short sentences) identify one way in which asymmetric encryption methods may aid in this effort and one way in which asymmetric encryption methods may hamper this effort.
d)	Briefly (1-2 paragraphs) discuss the counterbalance of people-oriented solutions (e.g., user training) versus automated solutions (e.g., an improved mail transfer program) in dealing with e-mail security.  Identify at least one strength, one limitation and one risk associated with each approach.
2) (25 points) CrashUp  is developing a physical security policy. Their shipping center and offices occupy one floor of a building in the Pittsburgh Airport area, with only limited influence over the remainder of the building, but no other close buildings. In order to support the business, physical security measures must interfere with proper customer or employee behavior as little as possible. 
a)	Briefly (1-2 sentences each) describe four policies for CrashUp associated with conduct in the parts of the building not occupied by Geoffrey’s. 
b)	Briefly (1-2 sentences each) describe four policies for CrashUp regarding the physical security of the parts of the building that it occupies.
c)	Briefly (1 paragraph) describe one security technique that would improve CrashUp physical security in the building it currently occupies.
3) (25 points) Assume that your boss has direct purchase authority over all IT acquisitions for your organization.  Recently, your boss has read about multi-level secure operating systems and is enthusiastic that they will solve your organization’s problems with respect to malicious insiders (i.e., employee misuse of company equipment and information).  
a)	Briefly (1 short sentence each) identify one way in which multi-level secure operating systems may aid with respect to malicious insiders, and one way in which it would impede dealing with malicious insiders.
b)	What are four reasons you might give your boss as to why not to use a multi-level secure operating system within your organization.  List each in a brief sentence or phrase.
c)	Describe (1-2 paragraphs) a process by which your organization might deal with malicious insiders without using a multi-level secure operating system.  Address both detection of malicious activity and response to malicious activity..
4) (25 points) There have been a series of events that have demonstrated that physical security and information security have become interrelated.
a)	Describe (1 sentence each) three physical risks that can be affected by information security.
b)	Describe (1 sentence each) three information security risks that can be affected by physical security..  
c)	Discuss (1 paragraph) three risks to on-line organizations arising from organized crime’s use of  the Internet and similar wide-area networks.