What’s Best?
In this
assignment I will have
opportunity to:
·
explain how an organisation can minimise security
breaches in networked systems,
·
Suggest how users can be authenticated to gain
access to a networked system
·
Compare the security benefits of different
cryptography techniques
Task 1 (A)
Policies & Procedures
What is a Security Policy?
In business, a security policy is a document that states in writing how a company
plans to protect the company's physical and Data Assets. The policy is usually
made and signed by management and then implemented by those who are suitable to
do so therefor; the security policy has to be regularly updated as both
Employee and Technology change over time.
Education
& Training
Policy
Training staff is a basic thing that any company
should do, it is essential for members of staff who work with the security of a
network as technology to always keep improving over time, this is usually
called “continuous professional development”. The policy also educates members
of staff on what they should and shouldn’t be doing on company computers; such
as to not download suspicious files from the internet. The company should also
teach staff the basics on how to keep their data safe and how to keep the
network safe whilst they are using it.
Access Control Policy
An Access Control Policy can be used to control
what users can access, this could include what websites and networks they can
have access or software installation and/or external media privileges. The
policy can even control just how much resources an employee has access to.
Monitoring Policy
Most of a
monitoring policy would concentrate on the network such as: making sure it has
good bandwidth, it’s protected against unauthorised access attempts, it
monitors network traffic, making sure level of authorisation for each user is
correct, monitoring files & emails; although it is mostly concentrated on
the network the monitoring policy also manages the system, identifies areas
needed of improvement lastly it identifies and prevents crime.
Backup
and Recovery
Policy
The
backup and recovery policy should be set in place so that the correct steps are
taken when doing a data recovery from data loss.
Every Organisation should have a backup data policy to insure the
recovery of useable data in case of loss. Causes of loss of data/ access of
data can be something as sudden as a blackout or an earth quake, because of
this it is better to have a disaster recovery plan to back-up your data in
separate areas or use Cloud.
Due to the improvement in technology over time it is possible to
make real-time updates, this means when a user saves a file it is saved
throughout all backups.
User Responsibilities
Policy Password
All
Employees need to have a strong password which is made out of numbers and
letters and also regularly updated in order to protect their account; but it is
not enough to just have the password, the employees need to make sure it is
kept secret on a need to know bases.
Software
Installation
Though
Employees shouldn’t be able to install software into the server anyway; if they
are able to, they must download them from trust worthy sources and not pirated
copies because those pirated copies are bound to have unwanted malware hidden
inside.
Physical Security
In
business, a company plans to protect the company's physical and Data Assets and
in order to do so they would need to have a good level of security. Each
employee should be logged upon entry of the building through the usage of
key-cards & CCTV. The Server room and any other room of which not anybody
can enter need to be the most secure within the company; therefor the door
needs to be under lock and key but with the addition of using the key cards or
password/pin for access as well. For a more advance security the company could
also try Biometric scans but as they are very expensive and hard to maintain it
is more common to just have keys and key-cards or password/pin for security.
User ID/ Password
Username/Password or Pin numbers are usually unique and secure for
the users’ account security; having this is a cheap and easy security system
that is not easy to overcome; however there are ways to steal a username and
password from a user such as key-loggers (both Hardware & Software);
Depending on the level of authority the stolen account holds the thief can do a
varied amount of damage, to make sure this doesn’t happen the password should
be made of letters, numbers and symbols for maximum security.
Biometrics
Authentication
Biometrics
is something that is quite new and is something that is
specific to the user, not something as basic as race; it is the users’
fingerprint scan, Retina Scan, Iris Scan, palm scan, voice recognition etc.
something that is physically unique to everyone, this method is the highest
level of authentication as it is extremely difficult to replicate a users’
biometrics. The major downside to the biometric scan is its cost.
There are times when the biometric rejects the Authorised individual
this is called a type1 error which isn’t so bad as it can be edited without
much loss, but when an unauthorised individual who should be rejected is
allowed access it is called a type2 error and of course this is the worst and
most dangerous therefor the most important to solve and further avoid.
Scenarios
Security for an office room should be a keycard since lots of people
would be going in and out of it throughout the day but they want the door to
stay shut, a keycard with electric locked door would be quick and simple since
only the employees would have the keycard to enter the room. For the computers
just a username and password(Employee can make one or be given one) would be
fine since they are obviously have to be a member of staff to enter the room.
Security for a server room should be a two factor authentication of
both a key/ keycard and pin number to open the door because having two factors is better than having one as the
security would then be more complex and harder to break into; though it also
means that all network administrators require both factors so if they lose or
forget either of them they cannot enter the room. For the
computer security, username and password should be fine but having multiple if
you want extra security is also good but to make sure the network is safe the
network administrator should have IPS, IDS, Firewalls, anti-virus and maybe
have a proxy server to act as a honeypot.
For the website to be used by external users it needs to be created
so that external users cannot see what they are not supposed to see; for
example customer bank details. To stop this from occurring, all external users
should have to create an account using a form and then sign in to it to access
main website.
Risk Assessment
& Penetration Testing
Risk Assessment
Risk
Assessment involves a thorough look at where and how badly the network can be
damaged such as the physical or digital areas, this process is used to create
new ways to further improve the network or at least soften the amount of
damage.
Penetration
Testing
Network Penetration Testing is a
controlled attack on a network system with the intention of finding security
weaknesses,
this should be used to help detect any faults or vulnerability in the physical
access points of the network. Of course before this is run there should be
backups and restore points to prevent accidental data loss, or the penetration
test should be run on a proxy network.
Cryptographic Systems
Encryption
This is a
security method to keep unwanted eyes off your messages or files, by simply
scrambling the contents until it is no longer readable to anybody who doesn’t
have the encryption key to unscramble it; the scrambled file or message is
known as a cipher text. This method of security is useful when sending
information not everybody is allowed to see, such as customer private information
(address, phone number, credit card details).
Block
& Stream Cipher
Block
Ciphers are a type of symmetric-key encryption algorithm that will scramble a
block of plain text data into a block of cipher text data, the encrypted text
will be the same length as the block text data. The encryption is done by using
the user-provided key to scramble the block size of 64bits, but it is said that
in the coming years; as processors are becoming more sophisticated the block
size will increase to a large 128bits.
Stream
Ciphers are the same as the block Ciphers because it is also a type of
symmetric encryption algorithm, but Stream Ciphers are designed to be much
faster by working on smaller units of plaintext instead of large blocks of
data. Unlike the block cipher, the stream ciphers encryption on each of the
smaller plaintext units will vary during the encryption process; making the
decryption longer to break for both those who should and shouldn’t read the
plaintext.
Symmetric
Key Algorithms is the encryption key which can be made of numbers, words or
just a string of letters/symbols; the key will then be used to encrypted the
plaintext in a if you don’t have the key as well, you can’t read it way.
Public
& Private
Key Cryptography
The
problem with the secret keys would be exchanging them over the internet or
large network without them falling into the wrong hands the answer would be;
asymmetric encryption which is two related keys, a pair if you want to think of
it that way. The public key is made freely over the internet so anybody can
send you an encrypted message using it; the second is to be used as a private
key and kept secret so that any message that is encrypted using the public key
can only be decrypted using the matching private key and the opposite also
works as well.
There is
nothing to worry about security as long as the private key isn’t stolen or lost
but the problem is as it is asymmetric encryption therefor it would be slower
than symmetric and requires far more processing power to both encrypt and
decrypt the content.
DES &
3DES
DES is
the United States standard encryption algorithm for encrypting and decrypting
unclassified data. DES is a block cipher with a size of 64bits which uses a
symmetric key in order to convert cipher text back into plain text of the same
size, although eight bits are used for error detection meaning the
effectiveness of the DES is actually 58bits which is considered weak due to the
advances in computer processing power.
Triple
DES or 3DES involves repeating the DES algorithm three times in a row on the
plaintext using two or three different keys to produce the cipher text, which
means if you do not have all the keys used to encrypt the plaintext you cannot
fully decrypt it. Although the 3DES needs more resources and is slower than the
DES it is still a lot more secure.
AES
Advanced
Encryption Standard otherwise known as AES is the specification called for a
symmetric algorithm using a block encryption of 128bits in size. The AES was supposed
to offer security at a sufficient level to protect data for the next twenty to
thirty years, it was easy to implement and offer good defences against various
attack techniques.
AES has been adopted by the U.S. government and is now used worldwide. It is
far more advanced than the Data Encryption Standard, but it does need more
resources and is slower than the DES.
Hashing
A one-way hash is a variable-length string and a message to produce
a fixed-length value called a hash value. On how to use it you would need to
calculate a hash value for the message you wish to send and append it to the
message itself, this way when you send it the receiver can do the same hash
function to see if the hash value has changed because somebody had altered the
message during transmission either intentionally or unintentionally.
Since the one-way function takes place without the use of any keys
therefor if you were to calculate a digest to a message and send it, the
interceptor can take the message edit it then recalculate the digest; send it
to the original supposed receiver and because of this the receiver wouldn’t
know it as altered.
Digital
Signature
Digital Signature is hash values that have been encrypted with the
sender’s private key. The act of signing it means encrypting the message’s hash
value with the private key to prevent interceptors who do not hold the public
key from editing the message or hash value.
By digital signing you are keeping the message integrity and are
showing that the document is valid and are free from forgery and false information;
though this is true and a digital signature does satisfy some legal
requirements for any formal aspects of executing the document, the digital
signature is an expensive investment.
