$2.$A security policy is a statement of what is and what is not allowed. A security mechanism is a method, tool, or procedure for enforcing a security policy. For each of the following situations $($a to e$),$ formulate a security policy and identify a mechanism for implementing the policy.

Example situation: Several security breaches occurred when users used passwords that are too short $($normally fewer than $5$ letters$/$digits$)$ or words that are directly from dictionary. Example Policy: Passwords should be greater than $8$ characters long and should not be found in the dictionary.

Example Mechanism: An operating system password program can be created to enforce above password policy by requiring passwords of a minimum length and preventing use of any word from the dictionary.

a$.$ One of the attacking strategies hackers often use is to guess a user's password to break into protected systems $($Don$\text{'}$t repeat example policy above$).$

b$.$ Faculty at SCSU can use Y drive $($CourseFile$)$ for students to submit their programming assignments. Students can drop their assignments in either Assignment DropBox or the student's workfolder in Y drive. Security measure must be put in place to prevent some students from cheating and copying other student's work.

$4$ points

c$.$ Tracy, a university systems analyst, will be able to detect a student using a program to scan her system for vulnerabilities, a prelude to a system attack.

$4$ points

d$.$ IA classes at National Defense University involve projects needing access to privileged information and protected systems. Currently, all students including non$-$IA students share four computer labs $($coded A$,$B$,$C$,$D$)$ on the campus. Concerns about lab availability, confidentiality, and integrity issues have been voiced.

$4$ points

e$.$ Student's complaints about slow Internet access on the campus have been increasing. Due to university budget constraint, adding network bandwidth or upgrading existing

hardware and software are not possible solutions. $($hint: network traffic control$)4$