Computer Systems Security: Winter 2018 Assignment 3

This assignment is not yet finalized.

1. [2] How can you check the integrity and authenticity of a downloaded ISO image of a Linux distribution? Explain what you must assume for both integrity and authenticity to be assured.
2. [2] Describe an attack (and associated context) that could be detected using an anomaly-based intrusion detection system but would normally be missed by both specification and signature-based intrusion detection systems.
3. [2] How are intrusion detection system similar to anti-malware systems? How can they be different?
4. [1] What is one significant reason that most currently used intrusion detection systems use signatures rather than other approaches?
5. [2] Why are insider attacks potentially more damaging than outsider attacks? Explain using a simple example.