📘 Cryptography & Network Security – Descriptive
Exam Answers
Based on William Stallings, 5th Edition
Chapter 1 – Computer and Network Security Concepts
(a) Define Information Security and its goals.
Information Security (InfoSec) refers to the practice of protecting information and information systems
from unauthorized access, disclosure, modification, destruction, or disruption. The primary purpose is to
preserve the confidentiality, integrity, and availability (CIA) of data.
• Confidentiality: Ensures that information is only accessible to those who are authorized. Example:
encrypting sensitive files.
• Integrity: Protects information from being altered or tampered with by unauthorized entities.
Example: checksums, hash functions.
• Availability: Ensures that authorized users have timely and reliable access to data and systems
when needed. Example: preventing Denial-of-Service (DoS) attacks.
Conclusion: The CIA triad forms the foundation of all information security models, ensuring complete
protection of data.
(b) Explain types of security attacks.
Security attacks are broadly classified into two categories:
1. Passive Attacks:
2. Goal: To obtain information without altering system resources.
3. Examples: Eavesdropping on communications, traffic analysis.
4. Impact: Breach of confidentiality.
5. Active Attacks:
6. Goal: To modify system resources or operations.
7. Types:
◦ Masquerade Attack: Attacker pretends to be an authorized entity.
◦ Replay Attack: Attacker retransmits valid data to gain unauthorized access.
◦ Modification of Messages: Altering legitimate messages.
◦ Denial of Service (DoS): Overloading resources to make them unavailable.
8. Impact: Compromise of integrity, availability, or authentication.
1
Conclusion: Passive attacks are difficult to detect, while active attacks can often be detected but are harder
to prevent.
(c) What are OSI/X.800 Security Services?
According to ITU-T Recommendation X.800, security services provide protection against security threats.
The major services include:
1. Authentication: Assures that communication entities are who they claim to be.
2. Access Control: Prevents unauthorized use of resources.
3. Data Confidentiality: Protects data from unauthorized disclosure.
4. Data Integrity: Ensures that data is not altered during transmission.
5. Non-Repudiation: Protects against denial of actions by a sender or receiver.
6. Availability Service: Ensures reliable and timely access to resources.
Conclusion: These services are mapped to OSI layers to ensure end-to-end security in network
communication.
(d) Explain Security Mechanisms with examples.
Security mechanisms are tools and techniques that implement security services:
1. Encipherment: Converting plaintext into ciphertext using algorithms (e.g., AES, DES).
2. Digital Signature: Ensures authentication, data integrity, and non-repudiation (e.g., RSA signature).
3. Access Control Mechanisms: Enforce rules limiting access (e.g., firewalls).
4. Authentication Exchange: Mechanisms for verifying identities (e.g., Kerberos).
5. Traffic Padding: Adding irrelevant data to prevent traffic analysis.
6. Routing Control: Secure routing of data through trusted paths.
7. Notarization: Use of a trusted third party to assure transactions.
Conclusion: Mechanisms are practical implementations that enforce the high-level security services defined
by X.800.
(e) Differentiate Security Services and Mechanisms.
• Security Services: Abstract functions that ensure protection of data (e.g., confidentiality, integrity,
authentication).
• Security Mechanisms: Concrete implementations/tools to achieve services (e.g., encryption for
confidentiality, hash functions for integrity).
Example: Confidentiality (service) can be implemented using AES encryption (mechanism).
Conclusion: Services define what is needed, mechanisms define how it is achieved.
2
✅ Chapter 1 is now fully descriptive with exam-ready answers (5-mark style).
👉 Shall I continue with Chapter 2 (Classical Encryption Techniques) next?
3