New York Institute of Technology, WestburyCSCI 330 1) The Windows NT logger allows the system administrator to define events to be entered into the security log

Subject:Computer SciencePrice:4.87 Bought7

Share With

New York Institute of Technology, WestburyCSCI 330

1) The Windows NT logger allows the system administrator to define events to be entered into the security log. In the example, the system administrator configured the logger to record process execution and termination. What other events might the system administrator wish to record?

2) Fisch, White, and Pooch [319] define four levels of log sanitization.

1. 1. Simple sanitization, in which all information except the commands issued by an intruder are deleted
   2. Information-tracking sanitization, in which sensitive information is entered into a symbol table as it is encountered, a unique identifier is assigned, and whenever that information is encountered it is replaced with the associated identifier
   3. Format sanitization, in which compressed or encoded data is transformed into its original form, the original form is sanitized using information-tracking sanitization, and the resulting data is returned to its transformed format
   4. Comprehensive sanitization, in which all data is analyzed and sanitized as in information- tracking and format sanitization.

Discuss the level of anonymity of each level of sanitization. Which level could be automated, and to what degree would human oversight be required?

ANS:

2) Fisch, White, and Pooch [319] define four levels of log sanitization.

1. 1. Simple sanitization, in which all information except the commands issued by an intruder are deleted
   2. Information-tracking sanitization, in which sensitive information is entered into a symbol table as it is encountered, a unique identifier is assigned, and whenever that information is encountered it is replaced with the associated identifier
   3. Format sanitization, in which compressed or encoded data is transformed into its original form, the original form is sanitized using information-tracking sanitization, and the resulting data is returned to its transformed format
   4. Comprehensive sanitization, in which all data is analyzed and sanitized as in information- tracking and format sanitization.

Discuss the level of anonymity of each level of sanitization. Which level could be automated, and to what degree would human oversight be required?