Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Pelham Engineering and its overseas subsidiary exchange confidential design files by email. Management wants any recipient to verify both that the file came from the named sender and that it was not altered in transit, and the sender to be unable to deny sending it. Which approach best achieves all three aims?

Digital signatures using the sender's private key, verified by the public key, best meet all three aims. They prove who sent the file, show it was unaltered, and prevent the sender denying it. Shared keys, passwords or VPNs give confidentiality but not non-repudiation.

  1. ADigital signatures created with the sender's private key and verified with the sender's public keyCorrect
  2. BEncrypting the file with a single shared symmetric key known to both offices
  3. CProtecting the email attachment with a password sent in a separate email
  4. DSending the file through a virtual private network only

Explanation

A digital signature uses a hash signed with the sender's private key, giving authenticity, integrity and non-repudiation. A shared symmetric key gives confidentiality but either party could have created the file, so it cannot prove origin uniquely. Passwords and a VPN protect transit or access, not proof of origin.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions