Module Code & Module Title

CC5004NI Security in Computing

Assessment Weightage & Type

10% Weekly Assignment

Year and Semester

2022-23 Autumn

Student Name: Rojin Bimb

Group: L2N6
London Met ID: 22015860
College ID: NP01NT4S220059
Assignment Due Date: 1st November 2022
Assignment Submission Date: 4th November 2022

I confirm that I understand my coursework needs to be submitted online via Google Classroom under the
relevant module page before the deadline in order for my assignment to be accepted and marked. I am
fully aware that late submissions will be treated as non-submission and a marks of zero will be awarded.
Security in Computing CC5004NI

Tutorial 02 – Security in Computing “Introduction”

Question number 1
Simply write down the three critical components, which must be there to maintain the
information security of assets in an enterprise.
Answer:
The main components that should be maintained for the accomplishment of
information security of assets in an enterprise are:
 Confidentiality
 Integrity
 Accessibility

ROJIN BIMB 1
Security in Computing CC5004NI

Question number 2
Write short notes on (do provide relevant examples):
 Confidentiality
 Integrity
 Availability
Answer:
Confidentiality
Confidentiality makes sure that only authorized personnel are given access or
permission to modify data.
For example, The two-factor authentication (debit card with the PIN code)
provides confidentiality before authorizing access to sensitive data

Integrity
Integrity helps maintain the trustworthiness of data by having it in the correct state and
immune to any improper modifications.
For example, The ATM and bank software ensure data integrity by maintaining all
transfer and withdrawal records made via the ATM in the user’s bank accounting.

Availability
Availability means that the authorized users should be able to access data whenever
required.
For example, The ATM provides availability as it is for public use and is accessible at
all times.

ROJIN BIMB 2
Security in Computing CC5004NI

Question number 3
Describe the role of access control in securing a confidential data within an
organization.
Answer:
Access control is a method of guaranteeing that users are who they say they are and
that they have the appropriate access to company data.

At a high level, access control is a selective restriction of access to data. It consists

of two main components: authentication and authorization

Access to information and information processing systems is restricted by access

restrictions. When properly implemented, they reduce the possibility that information
may be accessed illegally, without the proper authorization, or in a way that
compromises data security. They should be followed when accessing information in any
format, on any device, everywhere access is necessary to conduct business.

Information silos are frequently created in practice as a result of excessive access

restrictions. While it is evident that a focus on security and privacy is necessary to
safeguard corporate information and fulfill legal duties for data protection, there also
needs to be a balance with accessibility. According to our experience, sharing
information assets fosters innovation and teamwork and helps eDRMS projects
succeed.

ROJIN BIMB 3
Security in Computing CC5004NI

Question number 4
In your own words, describe the following access control mechanisms:
 Identification
 Authentication
 Authorization
 Accountability
Answer:
Identification
Identification refers to who you are, your name, username, ID number etc

Authentication (Prove who you are)

 Something you know, such as a password
 Something you have, such as a token
 Something you are, such as a fingerprint
 Somewhere you are, such as your IP address
 Something you can do, such as a signature
Authorization (What are you allowed to access?)
Different access models can be used, such as DAC, MAC

Accountability (Auditing)
 Being able to trace an action back to an individual.
 Prove what someone did, and when they did it. Known as non-repudiation

Now consider a case that demonstrates each IAAA component. When most of us think
of a typical login page, which is how we access systems, we typically see two fields:
username and password. Your username serves as your unique identifier; without it, the
system cannot provide us access because it would not recognize us. We identify
ourselves to the system by entering a username.

After identifying oneself, we must authenticate and demonstrate our identity. The
password box is here. The system requires you to confirm your username before you

ROJIN BIMB 4
Security in Computing CC5004NI

can access it; additional ways for authentication include fingerprints, pins, and iris
scans.

After successfully logging in, you can view, change, and delete data according to the
permissions granted to you. RBAC and other access control methods can be used in
this situation. You have now been granted user authorization after supplying and
validating your identity.

To guarantee that accountability is taken into consideration, all systems should

implement some sort of logging or auditing. Auditing will be able to demonstrate that we
have only just logged in to the system and will provide activity information on the actions
we have taken while logged in. Making people responsible for their acts and ensuring
non-repudiation are both aided by this.

ROJIN BIMB 5
Security in Computing CC5004NI

Question number 5
Elaborate the two protocols which can be used to implement AAA services within an
enterprise’s computer network infrastructure.
Answer:
The two protocols that can be used to implement AAA services within an enterprises’s
computer network infrastructure are as follows:

Two popular security protocols that are used to give centralized access into networks
are Remote Access Dial In User Service (RADIUS) and Terminal Access Controller
Access-Control System Plus (TACACS+). TACACS+ is most frequently used for
administrator access to network devices like routers and switches, whereas RADIUS
was created to authenticate and log distant network users. For computers that connect
to and use a network service, both protocols enable centralized authentication,
authorization, and accounting (AAA) administration.

ROJIN BIMB 6