95-752 Midterm Examination
Examination length: No longer than 4 hours, not including reading and preparation time.
Due: Oct 15, 2009, 5:30pm  Eastern Time.
Instructions:
1.	You will need to add paper to record your responses to these questions. Please be sure that you put your name on EACH PAGE you wish included in the grading of this examination. Electronic submissions (including e-mail) must be edited so that your name appears on each page. E-mail submissions must have the subject line “Midterm Submission”; all e-mailed submissions will be acknowledged.  Please do not submit both via e-mail and physically in class.
2.	This examination is open book, open notes, closed neighbor. Students may consult any non-interactive reference they choose, but no direct or indirect (e.g., NO E-mail, NO netnews, NO conversation) contact with any human other than the instructor or teaching assistants. Any communication between students concerning the examination is forbidden. Citation of sources of information is mandatory, in compliance with the CMU Plagiarism policy.
3.	Ensure that you answer all parts of each question. Some questions have more than one part.
4.	Please write clearly (if I cannot read it, I cannot grade you anything but a 0 on that portion).
5.	 Please read each question carefully. If the question is unclear then do not hesitate to ask for clarification.
Good Luck!
Grading: 
1 (25 points)

2 (25 points)

3 (25 points)

4 (25 points)

	Total:

1) (25 points) Assume you are working for an organization concerned with security in its customer relations.  You have been tasked to study possible measures to prevent losses due to possible email from attackers directing users to a malicious clone of your organization’s web site. (a.k.a. “Phishing”)
a)	In a short paragraph, identify three risks to an organization associated with phishing.
b)	Briefly (1 short sentence) identify one way in which authentication methods may aid in protecting users from phishing.
c)	Briefly (2 short sentences) identify one way in which asymmetric encryption methods may aid in this effort and one way in which asymmetric encryption methods may hamper this effort.
d)	Briefly (1-2 paragraphs) discuss the counterbalance of people-oriented solutions (e.g., user training) versus automated solutions (e.g., an improved mail transfer program) in dealing with phishing.  Identify at least one strength, one limitation and one risk associated with each approach.
2) (25 points) Flightfree  is developing a physical security policy. They occupy one floor of a business park  building near the Pittsburgh airport, with only limited influence over the remainder of the building. It is expected that customers would rarely visit the Flightfree site, but rather that sales would occur at the web site and engineering coordination would occur at the venue of the installation. Currently, FlightFree uses proximity card for building access enforced by electronic locks, with ACLs limiting employees based on their duties. The space also has audible alarms installed, which are activated by the last supervisor leaving the facility.
a)	Briefly (1-2 sentences each) describe four policies for FlightFree associated with conduct in the parts of the building it doesn’t occupy. 
b)	Briefly (1-2 sentences each) describe four policies for FlightFree regarding conduct at venue sites.
c)	Briefly (1 paragraph) describe one physical security technique that would improve FlightFree’s physical security in the building it currently occupies, without greatly harming employee productivity
3) (25 points) Assume that your boss has direct purchase authority over all IT acquisitions for your organization.  Recently, your boss has read about vulnerability management systems and is enthusiastic that they will solve your organization’s problems with respect to outside hackers.  
a)	Briefly (1 short sentence each) identify one way in which vulnerability management systems may aid with respect to hackers, and one way in which it would impede dealing with hackers.
b)	What are four reasons you might give your boss as to why not to use a vulnerability management system within your organization.  List each in a brief sentence or phrase.
c)	Describe (1-2 paragraphs) a process by which your organization might evaluate the effectiveness of a vulnerability management system in dealing with hackers.
4) (25 points) After several highly-publicized worm attacks a few years ago, there have not been as many broad-scale worm attacks. Instead, malware authors appear to be working on much more directed attacks restricted to specific industries.
a)	Describe (1 sentence each) three risks to organizations from this shift in malware behavior (regardless of any affiliation of the author of the malware).
b)	Describe (1 sentence each) three ways that organizations might use a combination of access control and encryption to prevent directed malicious software from compromising proprietary data.
c)	Discuss (1 paragraph) three risks to on-line organizations arising from organized crime’s use of  the Internet and similar wide-area networks, specifically related to directed malicious software.