• Assessment item 2

Security assignment

Value: 25%

Due date: 14-May-2012

Return date: 04-Jun-2012

Submission method options

Alternative submission method

Task

Length:

The maximum number of words set for this assignment is 350/answer. However, it is expected that answers to the assignment questions be succinct (i.e. precise and concise) with all sources of information fully referenced.

Instructions

Answer the following questions:

1. List the three fundamental security properties and for each give an example of a failure.

2. If the useful life of DES was about 20 years (1977-1999), how long do you predict the useful life of AES to be? Justify your answer.

3. Security decision making should be based on rational thinking and sound judgement. In this context critique five security design principles with suitable examples.

4. The HTTP protocol is by definition stateless, meaning that it has no mechanism for “remembering” data from one interaction to the next. (a) Suggest a means by which you can preserve state between two HTTP calls. For example, you may send the user a page of books and prices matching a user’s query, and you want to avoid having to look up the price of each book again once the user chooses one to purchase. (b) Suggest a means by which you can preserve some notion of state between two web accesses many days apart. For example, the user may prefer prices quoted in euros instead of dollars, and you want to present prices in the preferred currency next time without asking the user.

5. Why is a firewall a good place to implement a VPN? Why not implement it at the actual server(s) being accessed?

Rationale

This assignment is designed to test your knowledge and understanding of some of the key concepts and issues related to information security as covered in the Security Module of this subject.

It provides an opportunity for you to:

• demonstrate factual knowledge, understanding and the application of ICT security principles and techniques;
• demonstrate analytical skills related to ICT security issues;
• demonstrate problem solving skills;
• demonstrate ability to apply knowledge and understanding of ICT security principles and techniques to unfamiliar problems.

Marking criteria

All questions are of equal value.
Marks will be awarded based on:
• the degree to which you demonstrate your understanding of facts, principles and concepts; (Value: 70%)
• clarity of explanations; (Value: 10%)
• grammar and referencing. (Value: 20%)

Note:

-No marks will be awarded for a wrong answer.

-All sources of information must be fully referenced.

SOLUTION

Question 1:

There are three fundamental principles of security as listed below

Confidentiality:  Confidentiality is the property which related to data and documents of organization. It states that data that is confidential must be protected from unauthenticated access. Data must be secured such that it must not be stolen by any attack/ person. The property is important for assets can be implemented through cryptographic keys and passwords.

Integrity:  Integrity is the property which assures that important data and documents will not be modified by any attack/ unauthorised access. This security property is important for root secretes on which overall security of the system is based.

ARM (2009) states “This property is essential for some of the on-device root secrets on which the rest of the system security is based, and for the security software once it is running.”

Authenticity:  Authenticity is the property that prohibits any unauthorised access to important assets. The organization under this property is divided into various authentication levels where different access rights are provided at each level.  It can be possible that any attacker can change authenticity rights and access assets and cause security issues.

Example of failure

The properties mentioned above are very important for protection of assets. There are various conditions when these properties fail as listed below

Confidentiality: Failure of confidentiality is seen in many cases such as hacking, phishing where illegitimate users tries to steal confidential information of client of an ecommerce business for gain of money by stealing information such as banking details of customers, or email id’s for spreading spam etc. Eavesdropping is one of most common example where software uses software and listens to all traffic that passes on network whether externally or internally.

Integrity:  Integrity can be comprised by intercepting messages and altering the content of messages in middle of communication path. Lack holing and rerouting are typical examples.

Authenticity: Authenticity fails when a user with low level rights is able to peek into the system and login as administrator and use all resources.  The admin access can be taken by stealing passwords, using key loggers etc.

Question 2

AES is advanced encryption standard. This standard is successor of DES.  AES supposed to be provided as a FIPS which is acronym for National Institute do Standard and Technology which is branch of National institute of Standards and Technology and responsible for replacing DES. AES initiative was announced in the year 1997, and in the month of September, candidates for AES were invited from public for prosing suitable block ciphers.  There were number of variants of already available algorithms such as CAST, RC5 etc were proposed as AES is required to support 128 bit block of plain text.

As per one of cryptographic principles proposed by Auguste Kerkckhofffs in the year 1883, cryptographic system’s security is based on level of secrecy of the secret key used by that system.  Therefore, the strength of any cryptographic algorithm is counted as level of difficulty that is faced for finding key to break that algorithm so that message can be decrypted.  Following the principle, it can be described that DES used 168 bits of key but it was able to provide strength equivalent to 112 bits. The reason behind this was structure of the algorithm.  Today technology has advanced a lot and therefore, structure that DES follows is not suitable to provide security so in order to achieve desired security , it is required that AES keys must be minimum 128 bits in length and maximum desired length must be 256 bits.

Martin (2006) states “DES uses 168 bits of key, but only provides the equivalent of about 112 bits of strength due to the structure of the algorithm. AES keys need to be at least 128 bits long and can be as long as 256 bits. Exactly how strong are such keys?”

Since it is nearly impossible to judge how long an algorithm will be used so there are number of assumption in case of AES. Some believe that AES will last only for five years but after observing Rijndael cipher, I can say that it will last for 20-30 years because the cipher uses variable rounds depending upon bit length. Rounds are nine in number at 128 bit length and it is thirteen for bit length 256.

Question 3

Designing a security system requires different system security principles as listed below

Defence in path: The principle states that security is employed on the basis of different layers. Defense in path is further categorised as

• Layered protection
• Defense in multiple places
• Diversification defense

Compartmentalization of information:  The principle sates that resources must be located in different security zones depending upon the level of sensitivity level required i.e. threat suspectibility, value of risk tolerance etc. Information hiding is implemented as a part of this principle. Example of this principle is the server’s resposnsible for availing internet services will be registered as public DNS.

Stawoski (2007) states “IT system subjects (e.g., users, administrators) should have minimal privileges necessary for proper functioning within the organization.”

Least privileges: designing security system needs the organization to be divided in different zones as per level of privileges provided to different employees. Job rotation and separation of duties are two examples of this principle. The principle states that redundant configuration must be used for deploying network paths between IT resources and users along with devices, servers and link.

Levin, Irvine, Benzel, Bhaskara, Ngugen, Clark states “the principle of least common mechanism states that, if multiple components in the system require the same function or mechanism, the function or mechanism should be factored into a single mechanism that can be used by all of them”

Prevention of intrusion: Proper devices are required to be installed in network path between resources and sources of threats.  The devices are known intrusion prevention systems. Encrypted sessions such as SSL must be considered while designing these devices. Intrusion prevention devices are not able to detect encrypted sessions, so it is desirable that encrypted packets should be decrypted before they are encountered by IPS devices so that they can be inspected for any risk.  Proper tightness of intrusion protection systems requires proper network control and protection rules. For example, direct access of internet must not be provided to internal networks; this would protect external network from intruder that is trying to attack workstation through phishing attack by sending a Trojan.

Security zones: The principal controls flow of network traffic. Wherever a restriction in flow is required, firewalls, firewall functions, access control list in switches and network are placed.

Question 4:

Session is a method by which arbitrary data can be stored on persistent storage.  State can be preserved on both server and client side. The server is that part of a session which is responsible for handling client request and provides result of the query asked by the client. The client asks a query to the client.  A session between the client and server requires a system to be managed which can be maintained on both sides.  A stet can be saved on server side in case an interaction is broken. An example of this case is a user who starts a session to purchase an item but left the transaction uncompleted and only browses the item. On the client side, saving state information relates to a session’s information which is subjects to non malicious or malicious or loss of information. The procedure is difficult when a client is not operating on a single workstation which means that the workstation is shared or user may have an access from two or more different workstations.

A very common mean for preserving notion of state between two web accesses made after many days is to store the state on the machine used by client. Different proprietary formats or encryption methods can be used for this maintenance of state. Main aim behind this procedure of the limit the amount of changes that can be made by a user accessing the web

Question 5

VPN is an acronym of virtual private network. VPN is a private network that connects remote users and sites together by using a public network. It employs a virtual connection which is routed through internet to remote employee or site from private network of business.  Main aim of employing VPN is to ensure security as any intruder who intercept encrypted data passing through network will not be able to read that data.

Crawford, Tyson states The VPN uses “virtual” connections routed through the Internet from the business’s private network to the remote site or employee.”

VPN allows remote members of a network to communicate in a reliable and secure manner through internet for connecting to private local area network.  A VPN also provide easy scalability so that more users and locations can be accommodated easily.  Also there is no increase in cost with increase in distance so creation of VPN does not depend upon geographic locations.

VPN employs different types of methods for making the network connection and data more secure. Some of popular methods include firewalls, IPSec, AAA Server and encryption.  A firewall protects the private network from internet by acting as a strong barrier.  Firewalls can be settled for restricting the number of open ports, the type of packets which can pass the network and protocols which are allowed.  VPN products can be upgraded for including firewall capabilities and so a firewall can be used to implement a VPN for making the network more secure. A firewall will also help for terminating a VPN Session so it is a good practise to implement a VPN in a firewall.  It must be taken care that while implementing a VPN in firewall, the firewall must allow VPN traffic.

Implementing VPN on actual server being accessed may lead to number of problems as it will lower down the performance and availability. Main reason behind this is lower speed of VPN than traditional connections.  Also there can be mismatch of equipments provided by different vendors and so there can be compatibility issues.

References

ARM (2009), “Fundamental security properties”, viewed on 24^th may 2012 http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.prd29-genc-009492c/ch01s01s01.html

Park (2008), “Threat against integrity”, viewed on 24^th may 2012, http://www.ciscopress.com/articles/article.asp?p=1245881&seqNum=3

Jones (2001), “Who is AES”, referred from http://www.sans.org/reading_room/whitepapers/vpns/whos-aes_732

Martin (2008), “How strong is your Crypto”, viewed on 24^th may 2012, http://www.itsecurity.com/features/security-article-crypto-091306/

Levin, Irvine, Benzel, Bhaskara, Ngugen, Clark, “Design principle and guidelines for security”, referred from ftp://ftp.isi.edu/isi-pubs/tr-648.pdf

Stawoski (2007), “The principles of network security design”, viewed on 24^th may 2012 http://www.brevard.k12.fl.us/infosec/documents/principlesnetworksecuritydesign.pdf

Tyson, “How VPN works”, referred from http://computer.howstuffworks.com/vpn3.htm

LF77

Please  Click on the  below links to Chat Now  or fill the Order Form !