Unit32 Assignment2

What’s Best?

In this assignment I will have opportunity to:

·         explain how an organisation can minimise security breaches in networked systems,

·         Suggest how users can be authenticated to gain access to a networked system

·         Compare the security benefits of different cryptography techniques

Task 1 (A)

Policies & Procedures

What is a Security Policy?

In business, a security policy is a document that states in writing how a company plans to protect the company's physical and Data Assets. The policy is usually made and signed by management and then implemented by those who are suitable to do so therefor; the security policy has to be regularly updated as both Employee and Technology change over time.

Education & Training Policy

Training staff is a basic thing that any company should do, it is essential for members of staff who work with the security of a network as technology to always keep improving over time, this is usually called “continuous professional development”. The policy also educates members of staff on what they should and shouldn’t be doing on company computers; such as to not download suspicious files from the internet. The company should also teach staff the basics on how to keep their data safe and how to keep the network safe whilst they are using it.

Access Control Policy

An Access Control Policy can be used to control what users can access, this could include what websites and networks they can have access or software installation and/or external media privileges. The policy can even control just how much resources an employee has access to.

Monitoring Policy

Most of a monitoring policy would concentrate on the network such as: making sure it has good bandwidth, it’s protected against unauthorised access attempts, it monitors network traffic, making sure level of authorisation for each user is correct, monitoring files & emails; although it is mostly concentrated on the network the monitoring policy also manages the system, identifies areas needed of improvement lastly it identifies and prevents crime.

Backup and Recovery Policy

The backup and recovery policy should be set in place so that the correct steps are taken when doing a data recovery from data loss.

Every Organisation should have a backup data policy to insure the recovery of useable data in case of loss. Causes of loss of data/ access of data can be something as sudden as a blackout or an earth quake, because of this it is better to have a disaster recovery plan to back-up your data in separate areas or use Cloud.

Due to the improvement in technology over time it is possible to make real-time updates, this means when a user saves a file it is saved throughout all backups.

User Responsibilities

Policy Password

All Employees need to have a strong password which is made out of numbers and letters and also regularly updated in order to protect their account; but it is not enough to just have the password, the employees need to make sure it is kept secret on a need to know bases.

Software Installation

Though Employees shouldn’t be able to install software into the server anyway; if they are able to, they must download them from trust worthy sources and not pirated copies because those pirated copies are bound to have unwanted malware hidden inside.

Physical Security

In business, a company plans to protect the company's physical and Data Assets and in order to do so they would need to have a good level of security. Each employee should be logged upon entry of the building through the usage of key-cards & CCTV. The Server room and any other room of which not anybody can enter need to be the most secure within the company; therefor the door needs to be under lock and key but with the addition of using the key cards or password/pin for access as well. For a more advance security the company could also try Biometric scans but as they are very expensive and hard to maintain it is more common to just have keys and key-cards or password/pin for security.

 User ID/ Password

Username/Password or Pin numbers are usually unique and secure for the users’ account security; having this is a cheap and easy security system that is not easy to overcome; however there are ways to steal a username and password from a user such as key-loggers (both Hardware & Software); Depending on the level of authority the stolen account holds the thief can do a varied amount of damage, to make sure this doesn’t happen the password should be made of letters, numbers and symbols for maximum security.

Biometrics Authentication

Biometrics is something that is quite new and is something that is specific to the user, not something as basic as race; it is the users’ fingerprint scan, Retina Scan, Iris Scan, palm scan, voice recognition etc. something that is physically unique to everyone, this method is the highest level of authentication as it is extremely difficult to replicate a users’ biometrics. The major downside to the biometric scan is its cost.

There are times when the biometric rejects the Authorised individual this is called a type1 error which isn’t so bad as it can be edited without much loss, but when an unauthorised individual who should be rejected is allowed access it is called a type2 error and of course this is the worst and most dangerous therefor the most important to solve and further avoid.

Scenarios

Security for an office room should be a keycard since lots of people would be going in and out of it throughout the day but they want the door to stay shut, a keycard with electric locked door would be quick and simple since only the employees would have the keycard to enter the room. For the computers just a username and password(Employee can make one or be given one) would be fine since they are obviously have to be a member of staff to enter the room.

Security for a server room should be a two factor authentication of both a key/ keycard and pin number to open the door because having two factors is better than having one as the security would then be more complex and harder to break into; though it also means that all network administrators require both factors so if they lose or forget either of them they cannot enter the room. For the computer security, username and password should be fine but having multiple if you want extra security is also good but to make sure the network is safe the network administrator should have IPS, IDS, Firewalls, anti-virus and maybe have a proxy server to act as a honeypot.

For the website to be used by external users it needs to be created so that external users cannot see what they are not supposed to see; for example customer bank details. To stop this from occurring, all external users should have to create an account using a form and then sign in to it to access main website.

Risk Assessment & Penetration Testing

Risk Assessment

Risk Assessment involves a thorough look at where and how badly the network can be damaged such as the physical or digital areas, this process is used to create new ways to further improve the network or at least soften the amount of damage.

Penetration Testing

Network Penetration Testing is a controlled attack on a network system with the intention of finding security weaknesses, this should be used to help detect any faults or vulnerability in the physical access points of the network. Of course before this is run there should be backups and restore points to prevent accidental data loss, or the penetration test should be run on a proxy network.

Cryptographic Systems

Encryption

This is a security method to keep unwanted eyes off your messages or files, by simply scrambling the contents until it is no longer readable to anybody who doesn’t have the encryption key to unscramble it; the scrambled file or message is known as a cipher text. This method of security is useful when sending information not everybody is allowed to see, such as customer private information (address, phone number, credit card details).

Block & Stream Cipher

Block Ciphers are a type of symmetric-key encryption algorithm that will scramble a block of plain text data into a block of cipher text data, the encrypted text will be the same length as the block text data. The encryption is done by using the user-provided key to scramble the block size of 64bits, but it is said that in the coming years; as processors are becoming more sophisticated the block size will increase to a large 128bits.

Stream Ciphers are the same as the block Ciphers because it is also a type of symmetric encryption algorithm, but Stream Ciphers are designed to be much faster by working on smaller units of plaintext instead of large blocks of data. Unlike the block cipher, the stream ciphers encryption on each of the smaller plaintext units will vary during the encryption process; making the decryption longer to break for both those who should and shouldn’t read the plaintext.

Symmetric Key Algorithms is the encryption key which can be made of numbers, words or just a string of letters/symbols; the key will then be used to encrypted the plaintext in a if you don’t have the key as well, you can’t read it way.

Public & Private Key Cryptography

The problem with the secret keys would be exchanging them over the internet or large network without them falling into the wrong hands the answer would be; asymmetric encryption which is two related keys, a pair if you want to think of it that way. The public key is made freely over the internet so anybody can send you an encrypted message using it; the second is to be used as a private key and kept secret so that any message that is encrypted using the public key can only be decrypted using the matching private key and the opposite also works as well.

There is nothing to worry about security as long as the private key isn’t stolen or lost but the problem is as it is asymmetric encryption therefor it would be slower than symmetric and requires far more processing power to both encrypt and decrypt the content.

DES & 3DES

DES is the United States standard encryption algorithm for encrypting and decrypting unclassified data. DES is a block cipher with a size of 64bits which uses a symmetric key in order to convert cipher text back into plain text of the same size, although eight bits are used for error detection meaning the effectiveness of the DES is actually 58bits which is considered weak due to the advances in computer processing power.

Triple DES or 3DES involves repeating the DES algorithm three times in a row on the plaintext using two or three different keys to produce the cipher text, which means if you do not have all the keys used to encrypt the plaintext you cannot fully decrypt it. Although the 3DES needs more resources and is slower than the DES it is still a lot more secure.

AES

Advanced Encryption Standard otherwise known as AES is the specification called for a symmetric algorithm using a block encryption of 128bits in size. The AES was supposed to offer security at a sufficient level to protect data for the next twenty to thirty years, it was easy to implement and offer good defences against various attack techniques.

AES has been adopted by the U.S. government and is now used worldwide. It is far more advanced than the Data Encryption Standard, but it does need more resources and is slower than the DES.

Hashing

A one-way hash is a variable-length string and a message to produce a fixed-length value called a hash value. On how to use it you would need to calculate a hash value for the message you wish to send and append it to the message itself, this way when you send it the receiver can do the same hash function to see if the hash value has changed because somebody had altered the message during transmission either intentionally or unintentionally.

Since the one-way function takes place without the use of any keys therefor if you were to calculate a digest to a message and send it, the interceptor can take the message edit it then recalculate the digest; send it to the original supposed receiver and because of this the receiver wouldn’t know it as altered.

Digital Signature

Digital Signature is hash values that have been encrypted with the sender’s private key. The act of signing it means encrypting the message’s hash value with the private key to prevent interceptors who do not hold the public key from editing the message or hash value.

By digital signing you are keeping the message integrity and are showing that the document is valid and are free from forgery and false information; though this is true and a digital signature does satisfy some legal requirements for any formal aspects of executing the document, the digital signature is an expensive investment.