95-752 Homework Assignment #1
Due 6:00pm 10/01/2009

A.  Assume you work for a fictitious travel clearing house “flightfree.com”. This company provides travel clearance for faster traversal of security lines in 15 airports across the United States. To facilitate this, the company has stand-alone kiosks in which travelers insert a company-provided identity card and flight information, and are provided with a marked boarding pass indicating pre-cleared travel. The kiosk computers run  Microsoft Windows Vista operating systems and connect to corporate computers running Linux server. You’ve just been hired in as a corporate security officer for flightfree and tasked with a thorough review of their security.

1.   Concern has been raised about the authentication of travelers. Describe 2 methods flightfree could use for improved authentication. Justify the use of each method. Compare the strengths and weaknesses of each method in contrast to the other method.

2.   Describe 2 methods flightfree could use for file protection. Justify the use of each method. Compare the strengths and weaknesses of each method in contrast to the other method.

3. In terms of physical protection, what are 3 policies should be identified to suit the specific characteristics of the business of flightfree? (NOT generic policies dealing with protection common to many organizations: email, internal memos, external memos, etc.)?

4. What special exposures might apply for flightfree that would not apply for a company in another part of the computer industry?  What special advantages might flightfree enjoy?

B.   Answer the following questions:
1.   Explain why a physical security strategy is critical to information security.

2.   Explain why a password might be more secure than a security token (smartcard, strip-card, etc.).

3.   What is one reason that encryption with a long key (e.g., 2048 bits) might not be more secure than encryption with a shorter key (e.g., 512bits)?

4.   What is one advantage and one disadvantage, from a security perspective, of removable storage?