Backup of FinalExam-EssayQ-Mon
- 1. Eunice Park This is my final exam submission Professor Park. I thoroughly enjoyed your class with your charismatic spirit and enthusiasmin this course. This information was animated to me in a way that I was able to understand according to the sincerity of your time taken to include the class in discussion and lecture. I can tell you took your time to search and find videos, which made the class entertaining. These factors concerning your teachingstyle are the likely precursor to me deciding to specialize in info sec. I wanted to thank you for allowing me the opportunity to be in your class itwas such a wonderful and upliftingexperience! I wish the best for you thank you for the memories G e o r g i a S t a t e S p r i n g 2 0 1 4 Fares Sharif Final Exam
- 2. CIS 4680 Final Exam 2 Final Exam Questions Name: ______Fares Sharif____________ Date: ______5/2/2104____________ 1. (Case) Internet Shopping House (ISH) (an imaginary company) is a small online business that has around 100 employees. It handles thousands of online transactions in a day by buying and selling sports goods from buyers and sellers. The company aims at protecting its ‘web server’ from insider and outsider attacks. Now you need to design network security architecture. Write a unified essay in which you perform the following tasks. (1) Design the secure network architecture (e.g., location of web server, type of firewall, and other types of network security devices) (You can draw the network architecture and describe it). Support your position by providing reasons or evidences. (2) Identify appropriate ‘cryptographic tools’ and ‘protocols’ that can assure secure business transactions with your business partners and support your position with reasons or evidences (25 points). Using security programs can create architecture for this network. These are used. The selection in particular for this will be for the goal of future success for this small company. The architecture has to be thought out in a very supplementary manner to the organizations goals initially speaking. So whether so the primary goal of this architecture is going to be a firewall. We know that the company for example is a small company relatively speaking. Therefore I suggest a small modem made for such a case. Something such as a SonicWall TZ 200.This firewall starts at somewhere around three hundred dollars. It supplements the company perfectly and gives it exactly what it needs to flourish and develop. The location of the web server depends entirely on the company’s manager. Depending on that entirety is the amount of discretion and free will the manager might be. ?
- 3. CIS 4680 Final Exam 3 Managers can choose for their clients to be allowed a certain exponentially effective cryptographic number combination that is strong. Thus, avoiding the problem that many software development studies and developers face when they use numbers that either aren’t random enough or aren’t strong enough to secure their network. So that things such as command injection hacks do not occur. This company is dealing with online transactions, therefore use of this hardware with the proper installation should take care of the initial wireless tracking of online customers by having filtering for false keys so that hackers do not access random bank accounts and attempt to purchase information which can lose the company money and the cardholder loss of faith in their bank account and online shopping in general. Cryptography has been defined as the process of making and using codes to secure the transmission of information. Cryptographic tools are the tools we will use to secure effective and safe Internet business transactions. The cryptographic tools potential areas of use can include both the ability to conceal the contents of sensitive messages, as well as the verification of message contents and identities of their senders. Tools we should incorporate through the use of this firewall include the integrated system of software, encryption methodologies, protocols, legal agreements, and third party services enabling users to communicate securely: The securing of the web transactions for this small company should be done through the SET or secure electronic transactions developed by MasterCard and Visa. Company further can then allow DES encryption of credit card
- 4. CIS 4680 Final Exam 4 information to protect transfers against the fraudulent transfers for their sporting goods. The security of sporting goods sales can be done on the Internet traffic and as well as the credit card swipe system in retail stores. If a customer decides they want to make up and create an account due to frequent purchase, they should be careful however of cookie storage of such credit card information to further protect from fraudulent charges. Wi-Fi network can require a WPA and WPA2 protected password account to have the protocol of the company be protected by requiring a complex password by the manager and employees which expires every 120 days or so. Implementation of the IPSec open-source protocol framework could also additionally add security development within the TCP/IP framework for security development under the protocol of standards. If this however doesn’t suffice and is outdated, the implementation of the PGP hybrid cryptosystem uses a combination of cryptographic algorithms to be used as open source de facto standard for encryption and authentication of e-mail and file storage applications. This is also applicable because this cryptosystem is economically efficient with low cost commercial versions online and available for download or torrent. The six services of PGP solution allow for digital signature authorization, message encryption, compatibility of e-mails and segmentation while finally key management. The overall depending success of the encryption tools and the protocols is dependent on the management structure and code of conduct for the online interaction between employees and clients. This also depends on the acceptance of company policy agreement checkboxes on the websites open server that can agree to the company disregarding liability of fraudulence and hence avoiding loss on the sales done illegally. ISH is a company that buys and sells sports goods to and from other customers. Operating as the middleman, much traffic is going on and many keys are constantly being sent and received. Therefore ideally the firewall and cryptographic tools in addition to protocol should be cohesively efficient without gaps. This requires synchronization of the systems from the manager and communicating these urgencies for security precaution. Finally, an illustration of a packet filtering router will be used to incorporate the first generation firewall from allowing unwanted information inside the company.
- 5. CIS 4680 Final Exam 5 2. (Case) HappyOnlineBookStore, which is a small online business company, sells and buys new/old books. It has two branches across the southern part of Georgia. In its data center, tens of servers support online transactions. Administrators in the data center are monitoring the network activities. Currently, the company makes a great effort to provide customers with fast, convenient, and secure service. Write a unified essay in which you perform the following tasks. (1) Identify proper type(s) of IDPS for the HappyOnlineBookStore case and support your position by providing explanation. (2) Identify appropriate IDPS detection method(s) that can detect DoS and DDos attacks during normal system usages and support your position. (3) Discuss other security tools and scanning/analysis tools that the administrator can use together with the IDPS (25 points). Happy Online Books Store is a small business and has two branches and one data center with tens of servers to support the online transactions. Administrators monitor the data and network activities in that center. The first question I am asked is to identify the proper IDPS detection method for this company and support your position by providing explanation. The first thing is the IDPS is defined as the intrusion detection and prevention systems. These are designed to protect an organizations asset dependent on the people and the controls. Therefore, we are going to establish this IDPS in particular to prevent from intrusion by such means as a virus or a DDoS attack. We know that we have to detect the intrusion as the first step, react to the intrusion as the following step, and finally we have to correct the intrusion as the third step. This will insure that the procedures of all the systems created and operated to detect the intrusions are encompassed by actions and finalize by restoring the operations back to their normal state. The first decision we have to make as the managers of this company is what IDPS detection methods we choose to use and explain the beneficial factors of each. Then through examination I will select the most appropriate choice of the options available for this company. This honeycomb illustration will attempt to bring forth the different security tools and scanning analysis tools that an administrator can use in alliance with the IDPS. Following the illustration is a summarizing conclusive decision as to which method is most appropriate.
- 6. CIS 4680 Final Exam 6 Network- based •focus on network info asses abnormalities Host-Based •benchmark& monitor intruder Signature- based •searches data patters IDPS types
- 7. CIS 4680 Final Exam 7 The question now boils down to which one to decide for this small company. My personal opinion is that they should use a network based IDPS operating system. It seems the only one feasible with the small amounts of supervisors who walk about concerned to see whether or not the service is being conducted in an orthodox manner. The question just boils down to management style. This group wants to conduct a fast and convenient secure service. They would not want to use signature based because it requires continuous updating and would take to long to update every network and computer. They most certainly would not want host based because host based is far too complex and analytical and requires a much higher amount of monitoring than does network based monitoring. Network based seems the most feasible and practical solution in my opinion as concerning the needs of the company and needs of the customers. Indeed it does have drawbacks of its own, yet it still operates in the most formidable manner considering the circumstances that have arisen from a result of the lesser options. NIDPS can use signature matching to detect attacks or attack patterns. They can implement the TCP/IP stack and use the protocol stack verification. This would insure the quick and efficient selling of books from company to customer. Additionally, the in app protocol verification can examine unexpected pattern behavior or improper use. The improper use of patterns can then be identified, assessed, and eventually corrected in a proper and normal matter. This determination whether or not attacks seem to be infiltrating is interpreted by the attack patterns. These attack patterns are measured into known signatures. This can be the company’s defense when dealing with unknown signatures trying to buy books or use fraudulent credit cards. The knowledge base has known signatures to compare the network traffic
- 8. CIS 4680 Final Exam 8 trapped that was seen as a threat. TCP/IP stacks verify these packets and apply the protocol stack for the application verification of that protocol. Notifications of hacked attacks can be sent to the network administrators for further termination of the hacked packets and information. The network can be installed somewhere on the database where it can be safely monitored. This can be installed on either the inside or the outside of the company’s router. They can also use the NIDPS in between the other computers on the network to ensure that all the ten computers they have are not affected. Stateful protocol analysis is similar and is a tool that can be used because it stores and uses the relevant data detected in a session to show the possible intrusions. Comparing predetermined profile definitions of benign activity is similar to the TCP/IP stack verification and is another way that this tool can be successfully used. It can also record the deviations to be sent back to the manager as an alert that someone is trying to hack the system. Honeypots can additionally be used to encourage people who are trying to hack the system to internally damage them by reversing the hack. Diversion and collection about hackers activity and critical systems encourage the hacker to stay long enough until notification is received by the NIDPS system and the problem is resolved that way. These honeypots can all one honey net.
- 9. CIS 4680 Final Exam 9 3. (Case) On June 12, 2013, fire damaged the Atlanta factory in HighTechAuto Manufacturing Company that produces auto parts for GM (General Motors). The Atlanta factory lost raw materials and finished goods. Also the fire damaged most of auto part manufacturing machines. Write a unified essay in which you perform the following tasks. (1) Identify proper contingency plan(s) to assure recovering the main factory and continuous business availability in a secondary site and support your position. (2) Discuss the steps to recover this situation from the fire in detail (25 points). Contingency plans is defined as the entire planning conducted by the organization to prepare for, react to, and recover from events that threaten the security of information and information assets in the organization. It also encompasses the subsequent restoration of modes deemed as normal and regular to the mode of daily business operations. If this was my company and I was the manager, I would have presumed to have already had IRP planning ready and available. IRP is considered the incident response planning. It is the planning process associated with identify the classified problem, and then the ability to recover and respond to a particular situation which in this case, has to do with a manufacturing company and equipment. Heavy machinery that could have been inside the buildings when they burnt down may still be salvageable depending on the severity of the fire and the burns inflicted on such heavy machinery. Depending on the context, this fire could be seen as well as DRP and BCP. The terms DRP term the disaster recovery plan. The term is also closely linked and often defined to a further sense as BCP. Which we will cover as one of the questions follow this one. As BCP is primarily associated with DRP simultaneously and is applicable to the damage being major or long term. The simple restoration of information with information resources is also important in the contingency plan. Depending on which extent the fire reached and how bad it really made life for some people is the reasoning for the status of the situation escalating. The plans to recover the machinery in my eyes would be done by the insurance company sending over contractors to salvage the machinery they could and to use the property to either sell or rebuild my business. For the time being however and the building is destroyed. Any natural resources left or items that could be salvaged should be exported to the nearest manufacturer. Or the purchase of a new facility is also an option as well. However this is an ineffective way of managing resources and should be avoided. The first thing the company should do or the manager should do is to hire a professional to see whether the property is or is not applicable to be built over again for further use in the future.
- 10. CIS 4680 Final Exam 10 The contingency plans for DRP are used to save the business information that is stored that can be recovered from the disaster. Unaffected computers and software that was saved and emailed could be considered DRP. The first phase for this development of the CP process can be identified as the business impact analysis or the BIA. It is an investigation and assessment of the impact that various attacks can have on the organization and takes up where the risk assessment process leaves off. We assume that the controls have been bypassed, failed, or ineffective in stopping the attack. The attack was therefore unsuccessful. We take the following steps for the stages of the rebuilding of this company: 1. Threat attack identification 2. Business Unit analysis 3. Attack success scenarios 4. Potential damage assessment 5. Subordinate plan classification The first step would be to have the threat attack identification and prioritization to continue the business availability of this company. The system has to be updated with the threat list already existing. The attack profile has to be added and to be documented in order for the business to eventually be ready again. The attack profile consists of detailed descriptions of activities that occur during the attack. The fire must be developed and be documented to show that a story was developed for every serious threat that the organization faces. The attack profile should be serious and determine the damage that could result to a business unit if the attack was successful. The second big task when assessing the BIA is the analysis and prioritization of the company and its business functions within the organization. This company was a manufacturer of auto parts for General Motors. Therefore the most vital parts of the operations that make the most profit have to be saved and assessed to see which of these are the most essential to keeping the organization afloat. Efforts in function analysis focus on the result of the prioritized list of the various functions an organization prefers. Following this is the attack success scenario development. This is when the BIA team creates a series of scenarios depicting and predicting the boards reaction and consequence. Then the potential damage assessment is talking about how the cost of the best, worst, and most likely of the cases will be. This will end the attack scenario case. The potential damage has been assessed and each evaluated. Finally the subordinate ending plan is classified to and from board members to take effective action during an attack.
- 11. CIS 4680 Final Exam 11 The incident however in this case could be classified as a disaster. The incident becomes a disaster when the organization is not able to decipher the impact of an incident as it takes place. The level of damage or destruction is so sever that typically it takes an organization a long time to recover. Businesses need a blueprint for desired solution and applications capable of providing needed services are selected. They also need data support structures capable of providing need inputs identified and technologies to implement physical solutions to be determined. Feasibility analysis is to be performed at the end. This company essentially should create a BCP, which stands for a business continuity plan. These plans are strategic and long-term plan that encompasses the continuation of business activities if a catastrophic event occurs. The loos of a database, building, or operation center is what happened in this case. This is the primary reasoning for BCP. The steps listed above when the scope or the scale surpasses the DRP that in this case is true. A re-evaluation of priorities and resources to be used for allocation and further sale should be done by methods such as benchmarking to find out what the organization needs. Transfer and allocation of all remaining intact resources on software or on hardware need to be allocated to an alternate location to be conducted and processed without being lost. The methods could be used as steps to save the company from the fire if there was a proper risk control strategy done through cost benefit analysis and a feasibility study. Followed by a quantitative risk control and residual risk and residual appetite factors were put into location. Leave the resources in an alternate location for long enough so that the company can get back on its feet again and purchase a new property. 4. (Case) Southern American Bank company provides online banking services and has ten branches across the southern part of America. In its data center in Atlanta, thousands of servers support online banking services. Administrators in the data center are monitoring the large network activies.
- 12. CIS 4680 Final Exam 12 In risk management perspective, organizations should evaluate the tradeoffs between perfect security and unlimited accessibility…Organizations should decide the level of risk appetite to accept the tradeoffs (Whitman and Mattord 2011, Chapter 4). Write a unified essay in which you perform the following tasks. (1) Explain what the above statement means. (2) Imagine and describe two specific situations in which the Southern American Bank company may pursue more ‘perfect security’ than ‘unlimited accessibility.’ (3) Discuss what type of risk control strategies might be appropriate in such situations and provide your justification for the selection of risk control strategy (25 points). This statement above is talking about the opportunity cost a company has to decide when it comes to their organizational security management. The analysis is discussing the positive values of a tradeoff by making the assumption that it is an ultimatum. Managers of these systems can either have a system that is labeled as “perfect” or a system that “allows unlimited access”. From deducing the philosophy behind this statement, I will attempt to show the advantages and disadvantages of both having too much and having to little security. The level of risk assessed with bank accounts is a heavy amount. Banks store personal information and keep electronic databases of essential information people wish to retain. Nonetheless, if too much security is added as a precautionary measure, online actions can be hindered. Banks do not want to lose customers based on the online banking bugs that might occur through too many security concerns caused by those people also wanting their money to be safe. The safety of the IP address attempting to log onto an individuals bank account could be them but using an untrusted source such as a strangers cell phone or a friends laptop. The bank wants to keep the customers but also wants their money to be safe. Disabling cookies on stored devices might pose as a threat or maybe an unauthorized key in the likes of some web development systems. Organizations such as this bank have to identify what level of risk they can live with. This quote is also a reference to the terminology called risk appetite. Risk appetite involves the numerical value and organic natural value of risk that a company is will to accept as trade-offs between perfect security and unlimited accessibility. This is a very common risk management discussion point that we discussed in class. Not every organization has collective will to manage every vulnerability through applying controls. Depending on the willingness for the bank to assume the risk, the risk appetite is developed. We can never have truly perfect security, but we can try to and we can limit much of the residual risk but limit the accessibility of the company. Identifying the risk is the formal process of documenting and examining the risk in information systems. Risk controls are the steps in the process of taking carefully calculated decisions to ensure the confidentiality, integrity, and availability of components of an information system. Risk identification is a risk
- 13. CIS 4680 Final Exam 13 management strategy that identifies classification of the organizations assets. The residual risk is the remaining information asset even after the existing control is applied. Risk control can be application of the five strategies used to control risks from vulnerabilities, this includes 1. Defend 2. Transfer 3. Mitigate 4. Accept 5. Terminate Following are two example scenarios to exemplify my reasoning: Logging risk area Infastructure Data integrity is hindered by the useof audittrails to investigateissues. Loss of audittrail & integrity causes confusion and hinders service levels Mitigating controls Sendingbank audit logs to a centralized log server will send alert mail from matches that filter its rulebase. Use tools for HIPAA logging when requirementsaremet Results Windowsserversfor bank auditsdeploy solutionsfor bad auditson syslogbased log client. Server implementation of security savesrisk of bank information
- 14. CIS 4680 Final Exam 14 Personal Device Confidentiality Hacker tries to steal account information stored on the server by administering an attack to withdraw money from a bank account Reactions Host Based IDPS uses benchmark activity on master computer. Host system detects inconsistencies in audit logs and decrypts incoming traffic Results Identify hacker and benchmark key systems by examining records in audit logs. Company can identify and arrest hacker