Airport security is very involved these days. (Note: If you have never been in an airport, feel free to either work on this problem with a friend who has or pick a form of transportation other than air travel. In either case, please say explicitly that you’ve done this.)
a. Describe each point in the process of getting from the entrance of the airport to your seat on the plane in which you are identified, authenticated, or authorized. For each, answer:
i. Which of identification, authentication, and authorization is involved?
ii. How is each of these performed?
b. Pick one of your answers for (a), and answer these follow-up questions about it:
1. What are the security goals at this point in the process? That is, what threats is the system designed to mitigate at this point?
2. How difficult would it be for an attacker to subvert the identification, authentication, or authorization involved?
3. Describe one technique by which an attacker might subvert these. What sort of attacker would be able to pull this off? What sort of attacker would be unable to pull this off?
4. Describe one bad thing an attacker could do if they could successfully subvert the identification, authentication, or authorization involved.
5. Given your answer to (4), do you think that the success of any of the security goals you identified in (1) rely on identification, authentication, or authorization working properly? That is, if they were defeated, would any of the security goals you identified by compromised?
2. A website requires users to provide a password to access a secure area of the site. If a user forgets their password, they can reset it by correctly answering a password reset question.
a. Is this more or less secure than a website that only requires the password (and does not allow resetting via a security question)? Why?
b. Is this more or less secure than a website that requires both a password and a security question to log in every time? Why?
