Question:

(a) What do you meant by the term diffusion and confusion? Explain how diffusion and confusion can be implemented.

(b) Distinguish between authorisation and authentication.

(c) The Access Control Matrix is not implemented in practice. Why? How is it implemented.

(d) Explain the principle of complete mediation and principle of least privilege.

(e) What do you meant by the term "Timely revocation of trust"? Give example of a where it might be used.

(f) People normally tend to write their password down. Explain a mechanism that will be used to prevent people snooping around to get the written password.

(g) Password transmitted on the network will be captured and re-used by an attacker. Describe how the server can detect that a password has been captured and is being used by an attacker and not by the legitimate user.

(h) Give reasons why biometrics is not as popular as password based systems.