1. Responded to message below. Should be at least 250 words. Responses should be informative and contribute to advancing knowledge of the topic. Include at least 2 APA-cited references.
Frank, Greitzer & Holimer (2011) makes powerful augments about the difficulties surrounding the trail before the fact. I agree with them. It really is difficult to determine if threats are bogus and if they should be taken seriously. However, once a threat is made it must be taken seriously and that it is highly possible for the individual to carry out their plan. It is also difficult to know the individual's state of mind or if the individual has psychological issues. Frank, Greitzer & Holimer (2011) states, "there are several factors that should taken into consideration regarding picking up the trail before the fact, (a) the lack of sufficient real-world data that has "ground truth" adequate scientific verification and validate of proposed solutions; (b) the difficulty in distinguishing between malicious insider behavior and what can be described as normal or legitimate behavior (c) the potential quantity of data, and the resultant number of "associations" or relationships that may emerge produce enormous scalability challenges; and (d) despite ample evidence suggesting that in a preponderance of cases, the perpetrator exhibited observable ‘concerning behaviors'. All threats should be taken into account and noted as warning signals and reported to the proper authorities.
Sometimes the most damage is done by individuals who had a personal insight into the company or one who became disgruntled. They know the outs an ins of the organization and how to cause the most damage. I also agree that the methods and skills of the perpetrators have changed in recent years. With all of the new technology, the generations have become wiser and smarter. Therefore, all threats should be observed.
2. Responded to message below. Should be at least 250 words. Responses should be informative and contribute to advancing knowledge of the topic. Include at least 2 APA-cited references.
What Frank, Greitzer & Hohimer (2011) argue about difficulties of picking up the trail before the fact, in order to provide time to intervene and prevent an insider cyber attack?
I agree with Greitzer and Hohimer that insider threat is a serious concern for cyber security that has to be addressed successfully.
Unfortunately this is much easier said than done. The nature of insider threat makes it very difficult to detect and as Grietzer and Hohimer (2011) point out, there is a lack of real world data, it is difficult to differentiate between normal and abnormal behavior, there would be scalability challenges in data collected and no one has really decided to tackle this issue with technology yet (p.27). This means that devising a way to identify an insider threat prior to that insider launching an attack is a task that will not be easy to complete. That doesn't mean that this is not a goal that we should be working towards, quite the opposite actually. This is something that should be given attention and professionals should be working on methods that can help catch insider threats before the damage is done.
Do you agree with them? Why? Why not?
I do agree with Greitzer and Hohimer that insider threat is a big problem. I also agree that there is a lack of data that can be used to help identify patterns and help develop methods and technology that can catch insider threat early. I have to admit that much of what they discussed in the article was a bit over my head. I don't fully understand how the technology they discussed would work and I also can't say that I believe that a technological solution would the perfect solution for this issue. Humans can be very unpredictable. This means that any technology developed to be an early identifier of insider threat will not work every time. I do think that more often than not there will be indicators prior to an insider attack occurring but there is always that chance that someone just snaps. With that being said I do think that there should still be research and work done to mitigate the risk of insider attacks.
Assignment: Chapter 2 & Chapter 3
Question1:
(Problem 1): If a program has 471 bytes and will be loaded into page frames of 100 bytes each, and the instruction to be used is at byte 132, answer the following questions:
a. How many pages are needed to store the entire job?
b. Compute the page number and the exact displacement for each of the byte addresses where the data is stored. (note: page numbering starts at zero).
a) 471/100 + 1=5
b) To store page number: 3 bits
To store offset:7 bits
(Problem-2): Given that main memory is composed of only three page frames for public use and that a seven-page program (with Pages a, b, c, d, e, f, g) that requests pages in the following order:
a, c, a, b, a, d, a, c, b, d, e, f
(a). Using the FIFO page removal algorithm, indicate the movement of the pages into and out of the available page frames (called a page trace analysis). Indicate each page fault with an asterisk (*). Then compute the failure and success ratios.
(b). Increase the size of memory so it contains four page frames for public use. Using the same page requests as above and FIFO, do another page trace analysis and compute the failure and success ratios.
Given that main memory is composed of three page frames for public use and that a seven-page program (with pages a, b, c, d, e, f, g) requests pages in the following order: a, b, a, c, d, a, e, f, g, c, b, g
a.
|
page request
|
a
|
b
|
a
|
c
|
d
|
a
|
e
|
f
|
g
|
c
|
b
|
g
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page fault
|
*
|
*
|
|
*
|
*
|
*
|
*
|
*
|
*
|
*
|
*
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 1
|
a
|
a
|
a
|
a
|
d
|
d
|
d
|
f
|
f
|
f
|
b
|
b
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 2
|
|
b
|
b
|
b
|
b
|
a
|
a
|
a
|
g
|
g
|
g
|
g
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 3
|
|
|
|
c
|
c
|
c
|
e
|
e
|
e
|
c
|
c
|
c
|
|
Total faults: 10
|
|
Failure: 10/12
|
|
|
83.33e %
|
Total faultless: 2 Success: 2/12 16.66e%
b.
|
page request
|
a
|
b
|
a
|
c
|
d
|
a
|
e
|
f
|
g
|
c
|
b
|
g
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page fault
|
*
|
*
|
|
*
|
*
|
|
*
|
*
|
*
|
*
|
*
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 1
|
a
|
a
|
a
|
a
|
a
|
a
|
e
|
e
|
e
|
e
|
b
|
b
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 2
|
|
b
|
b
|
b
|
b
|
b
|
b
|
f
|
f
|
f
|
f
|
f
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 3
|
|
|
|
c
|
c
|
c
|
c
|
c
|
g
|
g
|
g
|
g
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
page 4
|
|
|
|
|
d
|
d
|
d
|
d
|
d
|
c
|
c
|
c
|
|
Total faults: 9
|
|
Failure: 9/12
|
|
|
75 %
|
Total faultless: 3 Success: 3/12 25%
Question2:
(Problem 1): Given the following information:
|
Job List Job Number
|
Memory Requested
|
Memory Block List: Memory Block
|
Memory Block Size
|
|
Job A
|
57K
|
Block i
|
9ooK (low-order memory)
|
|
Job B
|
920K
|
Block 2
|
910K
|
|
Job C
|
5oK
|
Block 3
|
2ooK
|
|
Job D
|
701K
|
Block 4
|
3ooK (high-order memory)
|
a. Use the best-fit algorithm to indicate which memory blocks are allocated to each of the three arriving jobs.
b. Use the first-fit algorithm to indicate which memory blocks are allocated to each of the three arriving jobs.
a) For the best fit algorithm, allocates the smallest free partition which meets the requirement without wasting much memory. SoJob A needs 57k so it can fit in any block of the four. but it takes Block 3 so that much memory is not wasted.
Job B needs 920k it cannot fit in both Block 2 and block 1, but it has to use two blocks to fit. Even so much memory is wasted so it fits in Block 2 and takes remaining from other block.
Job C also fits in block 3
Job D can fit in Block 1 and 2 but it fits in block 1 as block 2 is used.
b) For the first fit algorithm, means pick the first block that meets the requirement.
For Job A, it takes first block 1
Job B it takes block 2 but does not fit so it has to wait for Job A
Job C it takes block 3 as per the requirement.
Job D it takes Block 4 but does not fit so it has to wait for other blocks as Job A or Job C to finish which has free space and then fits.
(Problem-2): Next-fit is an allocation algorithm that starts by using the first-fit algorithm but keeps track of the partition that was last allocated. Instead of restarting the search with Block 1, it starts searching from the most recently allocated block when a new job arrives. Using the following information:
|
Job List:
Job Number
|
Memory Requested
|
Memory Block List: Memory Block
|
Memory Block Size
|
|
lob A
Job B
|
590K
|
Block I
|
iooK (low-order memory)
|
|
5oK
|
Block 2
|
gooK
|
|
Job C
|
275K
|
Block 3
|
280K
|
|
Job D
|
46oK
|
Block 4
|
600K (high-order memory)
|
Indicate which memory blocks are allocated to each of the three arriving jobs, and explain in your own words what advantages the next-fit algorithm could offer.
For Job A it takes for the block 1 and uses it 100k in it and then takes for block 2 for remaining to fit in it.The unused memory in block 2 would be 410k.
For job B it takes for the block 2 and use 50k so remains 360k
For job C it takes block 2 and uses 275k and the remaining memory of the block 2 is 85k
For job D,it takes block 2 which has 85k and uses it and then moves to block 3 uses it and for remaining 95k it moves to block 4 and uses 95k thus leaving 500k remaining unused in block 4.
The advantage of next fit is such that, when a new job is called it searches from the remaining block of memory so that much space is saved rather than wasting some amount of space in each block. Thus speed also is improved in next fit since if memory is released that is earlier in the heap for an application, it will check for that block first and fits there.