# data[].attributes.body
QUESTION 1
Briefly explain the following computer crimes.

a) Sniffer – an eavesdropping program that monitors information traveling over network and enables hackers to steal proprietary information such as e-mail, company files, and so on.

b) Phishing – setting up fake Web sites or sending e-mail messages that look like legitimate businesses to ask users for confidential personal data.

c) Pharming – redirects users to a bogus Web page, even when individual types correct Web page address into his or her browser.

d) Spoofing – misrepresenting oneself by using fake e-mail addresses or masquerading as someone else and redirecting Web link to address different from intended one, with site masquerading as intended destination.

QUESTION 2
a) Distinguish the TWO (2) methods for encrypting network traffic on the Web.

-          Secure Sockets Layer (SSL) and successor Transport Layer Security (TLS) enables client & server computers to manage encryption & decryption activities; so they communicate with each other during a secure web session.

-          Secure Hypertext Transfer Protocol (SHTTP) is used for encrypting data flowing over the Internet but it is limited to individual messages, whereas SSL & TLS are designed to establish a secure connection between 2 computers.

b) Briefly explain the following terms.

i. Cyber warfare - State-sponsored activity designed to cripple & defeat another state or nation by penetrating its computers or networks for the purposes of causing damage & disruption.

ii. Computer Forensic - Scientific collection, examination, authentication, preservation, and analysis of data from computer storage media for use as evidence in court of law and it includes recovery of ambient and hidden data.

QUESTION 3
a) Without protection against malware and intruders, connecting to the Internet could be very dangerous. Firewalls, intrusion detection system and antivirus software have become the tools to overcome this problem. Briefly explain these THREE (3) tools.

- Firewall is a combination of hardware and software that prevents unauthorized users from accessing private networks Static packet filtering - examines selected fields in the header of data packet flowing back and forth between the trusted network & Internet, examining individual packets in isolation.

- Intrusion detection system monitors hot spots on corporate networks to detect and deter intruders and examines events as they are happening to discover attacks in progress.

- Antivirus software checks computers for presence of malware and can often eliminate it as well. It requires continual updating.

b) Information systems controls is one of the components of an organizational framework for security and control. Information systems controls consist of two - general and application control. A company must know how and where to deploy security tools and security personnel must know what controls a company must have in place to protect its information system. Contrast between General Controls and Application Controls.

# data[].attributes.body
QUESTION 4
Malicious Software programs are referred to as Malware. Describe FOUR (4) types of malicious software.

-          Spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet (where it is sometimes called a Spybot or tracking software), Spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties.

-          Virus is a program or programming code that replicates by being copied or initiating its copying to another program, computer boot sector or document. Viruses can be transmitted as attachments to an e-mail note or in a downloaded file, or be present on a diskette or CD.

-          Worm is a self-replicating virus that does not alter files but duplicates itself. It is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks.

-          Trojan (Trojan Horse) is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the certain area on your hard disk. A Trojan horse may be widely redistributed as part of a computer virus.

QUESTION 5
a)    Nowadays securing information systems has become an important issue in organization to protect itself against computer crime. Define computer crime and provide an appropriate example.

Computer crime means any violations of criminal law that involves knowledge of computer technology for their perpetration, investigation, or prosecution. Some examples are breaching confidentiality of protected computerized data and accessing a computer system without authority.

b)     Briefly explain THREE (3) reasons why information systems are vulnerable to destruction, error and abuse?

- There are internet vulnerabilities which mean network is open to anyone and size of Internet means abuses can have wide impact.

- There are wireless security challenges whereby eavesdroppers can drive by buildings and try to intercept network traffic and hacker that gains access to SSID, has access to network’s resources.

- There are malicious software such as worms, viruses, Trojan horses and spyware.

c)      Discuss the THREE (3) most important tools and technology for safeguarding information resources.

-          Identity management software which automatically keeps track of all users & privileges authenticates users, protecting identities, and controlling access.

-          Authentication which is a system that checks the identification of an end user who wants to access it. Some types of authentications are token, smart cards, biometric authentication and two-factor authentication.

-          Firewalls which is a combination of hardware and software that prevents unauthorized users from accessing private networks and provides additional security by determining whether packets are part of an on-going dialogue between sender & receiver.

QUESTION 6
a)      Identity management software automates the process of keeping track of all information systems users and their system privileges, assigning each user a unique digital identity for accessing each system. Define authentication.

Authentication is the technique by which a system checks the identification of a end User who wants to access it. Since entrance or access control is normally based on the identification of the user who demands access to a resource. Authentication is essential to effective security. Four types of authentication technologies are:

-          Password Based Technologies which is the most common form of authentication. Password may be of any form (String of alphabets, numbers and special characters). This password is necessarily to be known by the entity or the thing or a person that is being authenticated.

-          E-Token Based Technologies which is a small device that develop/generates a new odd/random value every time it is used. This random value becomes the basis for authentication (an alternative to a password). It can be implemented on a USB key fob or on a smart card. Data is protected on the device itself.

-          Biometric Based Technologies which is an authentication mention to the realization/recognition/identification of humans by their personality/characteristics such as Face, fingerprint, human voice, Retina, Iris pattern of the eye, vein pattern etc. It's used in computer science as a form of realization/recognition and access control.

-          Two Factor Authentication also known as multi-step verification, which adds another layer of security, supplementing the username and password model with a code that only a specific user has access to (typically sent to something they have immediately to hand).

QUESTION 7
a)      Describe ransomware.

Ransomware is proliferating on both desktop & mobile devices that try to extort money from users by taking control of their computers or displaying annoying pop-up messages such as CryptoLocker that encrypts an infected computer files, forcing users to pay hundreds of dollars to regain access.

b)     State how do we prevent and protect our computer from ransomware.

-          Install an up-to-date anti-malware or anti-virus tool like Malwarebytes or McAfee Anti-Malware which is an important part of computer’s security system.

-          Scan attachments. Most malware tools give the ability to scan any emails or attachments before opening them. Emails and email attachments should be scanned before for malware before it is opened especially if they’re coming from an unknown sender.

-          Ask before open. If there’s uncertainty about an email attachment or link in an email, send a quick note to the person who sent it and ask them if it is legitimate. If the person doesn’t respond or gives a cryptic answer, do not open it.

c)      Discuss the effects of computer crime to an organization.

-          Reputational damage

Trust is an essential element of customer relationship. Computer crime can damage business' reputation and erode the trust that customers have for the organization. This could potentially lead to loss of customer, loss of sales and reduction in profits

The effect of reputational damage can even impact on suppliers, or affect relationships with partners, investors and other third parties vested in the business.

-          Legal consequences of computer crime

Data protection and privacy laws require organizations to manage the security of all personal data they hold whether on the staff or their customers. If this data is accidentally or deliberately compromised, and they have failed to deploy appropriate security measures, they may face fines and regulatory sanctions.

# data[].attributes.body
1.      Security isn’t simply a technology issue, it’s a business issue. Discuss.

Security is no longer just a technology issue, it is also a business issue as well because majority of the companies out there today rely on computer systems to keep their employees information secure as well as their customers’ information, sales transactions, and the details on their vendors, their success is dependent on the secureness of this information. For a non-technologies business especially, they need to understand enough about security that they can take ownership of security approval processes. Ultimately it is because the business themselves that will bear the consequences of a poorly secured system. It is difficult to say that a case of internal fraud or financial misstatement is a purely IT issue. However, such incidents are preventable through a well-defined security structures allocated to the appropriate business users. Since the business bears the risk it is logical that they should be fully engaged in the design of the solutions to prevent the occurrence of such risks. Without adequate understanding and design of the computer security structures, users are not able to use the functions that they require in order to run the business processes. If incorrectly designed, the same security structures will allow users access data and functions that they should not be using including system administration functions, access to sensitive personal data or commercially sensitive data such as sales figures.

For example, Zappos.com joining the ranks of Sony, Gawker, rootkit.com and many others have lost account passwords and other data to hackers which included names, e-mail addresses, billing and shipping addresses, phone numbers, and the last four digits of credit card numbers along with cryptographically scrambled passwords, but not the actual passwords. This has cost them their business reputation, branding and also customer’s trust. There will always be a possibility of a breach in security for every company. It could be due to a cyber-attack, human error, or even social engineering. But, if risk management of security is a common goal amongst every employee not just the IT department, it can help manage and minimise security risks in the long run. Therefore, both the business and technical departments must take responsibility for collaborating to address this issue. IT security is a priority that should simply be regarded as good business practice.

2.      Who poses the biggest security threat: insiders or outsiders?

While an organization usually faces more external threats, the reality is that organizations need to be just as concerned about the insider threat. An insider attack is one of the biggest threats faced by organizations since these types of hacks can be very difficult for IT teams to identify. This is because an insider – whether he’s an employee or a contractor – is already entrusted with authorized access to at least some systems and applications on a corporate network. It can be very hard for those in IT to decipher whether he’s just performing his regular job tasks, or carrying out something sinister. An angry employee who already has access to company files could be secretly leaking documents to competitors, or he could be sabotaging systems or corrupting data because he is miffed at his employer. The same could be said about former employees, who often retain access to the network even long after leaving the organization.

However, they are most often not deliberately a threat. Outsiders are the ones who have bad intentions, but they don’t have access. Network restrictions are usually strong enough to keep them out. So instead, they focus their efforts on tricking unsuspecting insiders into opening the doors for them. And once inside, they are indistinguishable from the insiders. Employee web browsing is one of the most used pathways to accomplish this. Outsiders set up a website capable of exploiting any computer that browses to it, and then they send emails to the insiders that entice them to click a link to that site. Most employees will not take the bait, but it just takes one person to give in to curiosity and click the link. Malicious outsiders are very good at this. They can craft emails that look like they are from someone within the company and reference projects or people that the recipient knows. It can be very difficult to tell these emails are not legitimate. With a little perseverance, it’s just a matter of time before someone clicks. Because of this, efforts to protect the company from malicious outsiders can only go so far. Companies today must prioritize protecting against threats from their own insiders. One employee clicking the wrong link doesn’t have to put the whole company at risk. Therefore, companies need to take both outsiders and insiders seriously, because they can each have disastrous consequences.

3.      Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats?

E-commerce platform will have certain vulnerabilities that are known to attackers. One of the major security threats would be Malware which is the malicious software that attackers insert into the web files or pages once they have gained access to the site. Malware may be found on an individual’s computer if they have themselves fallen victim to a phishing attack or otherwise been compromised, or it may be inserted directly onto the website after a successful SQL injection or if administrative account access has been granted to a harmful entity. As with software, malware can perform an extremely wide range of activities, from turning the computer into a botnet that can be part of a DDoS attack, to stealing credit card and account information from the website users. One type of malware that targeted Magento sites was able to take credit card information and store it in images so that the attacker could easily access it without flags being raised. Credit card information and personal identifying information are now regularly submitted online or stored in a network  that can be considered as a necessity for any e-commerce platforms. However, it could be vulnerable. Markets on the so-called “dark web” that sell stolen information can wreak havoc by enabling others to charge money to someone’s account or even steal their identity. This can risk the business to face major potential lawsuits by customers and users. There are also bad bots that scrape websites for pricing and inventory information. They then use this information to change pricing on the web site or hold popular inventory in shopping carts, leading to a drop in the business’ sales and revenue.

In order to minimize these threats, we need to update the computer operating systems and patch regularly in order to defend against malware and phishing. This will help prevent vulnerabilities from being exploited and help detect and block threats from entering the system. We also need to use a secure connection for online checkout. It is best to use strong SSL (Secure Sockets Layer) for Web and data protection. SSL certificates are crucial for authenticating the identity of the business and to ensure that the data in transit is encrypted. This ultimately protects the company and customers from getting their personal or financial information stolen. For customer’s data safety, we have to require strong passwords and enable Two-factor Authentication (2FA). Enabling two-factor authentication provides an extra layer of security by requiring two pieces of information for every new login attempt. Instead of only requiring a password, it would, for example, require customers to verify their account via a one-time use authentication code received thru SMS. Most importantly, network’s computers must be equipped with antivirus and anti-malware software.

# data[].attributes.body
1.      Is cyberwarfare a serious problem? Why or why not?

Yes, it is a serious problem. Cyberwarfare is a state-sponsored activity designed to cripple & defeat another state or nation by penetrating its computers or networks for the purposes of causing damage & disruption. It is becoming a major threat to the security and economy of countries as it can cripple country’s power grids, financial systems, and communication network. The person behind this could be anybody including non-state actors such as terrorist criminal groups. The ability to destroy via cyber now also rests in the hands of small groups and individuals which started from terrorist groups to organised crime, and hackers to industrial spies to foreign intelligence services. This cyberwarfare has been occurring between many major countries such as United States and Iran, Israel and Iran, United States and China despite their open diplomatic relationship, and also between North Korea and South Korea. Not to mention this cyberwarfare also indirectly involved many other countries such as Indonesia, India and many more. In US, at least twelve financial institutions were targeted in attacks that slowed their server to crawl and then shut down. The data centers of these organizations had been infected with a long available malware agent name Itsoknoproblembro, which creates botnets of salve servers. The goal of the attacker was to inflict an unprecedented level of strain on as many financial institutions as possible. No account information was stolen and no financial gain sought, leading experts to think it was a state-sponsored attack which actually turns out to be because of Izzad-Din Al-Qassam Cyber Fighters seeking revenge for an anti-Islam video. Although, U.S government officials does believe the perpetrator is actually Iran, retaliating for economic sanctions imposed to halt its nuclear program and for what it believes were U.S cyber-attacks. Another cyberwarfare caused by political tensions involved Saudi Aramco, one of the world’s largest oil companies that were hacked whereby 35,000 computers were partially or totally destroyed. U.S. officials suspect Iran was the culprit in this case as well.

Cyberwarfare is getting out of hand because hostile governments could hide behind rapidly advancing technology to launch attacks undetected and unlike conventional and nuclear arms, there were no agreed international controls on the use of cyber weapons. Hackers have obtained information strategies of major corporations, designs of more than two dozen major U.S weapons systems, and the workings of America’s power grid, possibly laying groundwork for acts of sabotage. North Korea, another budding cyberwarfare adversary, was accused of launching its most damaging attack to date where they perpetrated attacks on both South Korean and American commercial, educational, governmental, military institution. This damaging attack has caused both countries major losses. Many organizations and industries were affected by this cyberwarfare. These shows that cyberwarfare is becoming a very serious problem. Attacks have become more widespread, sophisticated, and potentially devastating. Be it in the form of malwares such as trojan, botnets, spyware, viruses, or even worms. It all acts as a cyber-weapon that possess major risk and threat to any countries or organizations involved globally. Therefore, the severity of this issue should not be taken lightly as most companies rely on the internet for emails and internet, and will soon become dependent on it. Cyber-attacks will grow as technology grows, especially since the cost is relatively low.

2. What solutions are available for this problem? Do you think they will be effective? Why or why not?

Because the whole issue of cyberspace and the problems and damage it can cause is quite new and is still on the rise, many things have not yet been internationally agreed on and many states take different measures. Cyber attacks can be prevented with two different types of measures: The first type intending to prevent states from carrying out cyber attacks and the second type being measures to increase security of the networks which have the highest risk of being attacked. Most states have laws regulating computer crimes done by individuals or non-state actors to hopefully prevent any cyber attacks but other states are not bound to any rules yet. They would only have to be aware of the reaction of the attacked country. Besides definitions of cyber warfare and information warfare and other important terms, an internationally agreed list of computer crimes or rules should therefore be established, maybe in combination with an organization monitoring the cyberspace, with large and serious consequences against states violating these rules. Each state should increase its own security measures against cyber attacks. In order to do this as effectively as possible governments should establish, if not yet done so, an agency whose solely focus is on the cyberspace and cyber attacks. Moreover they should follow the example of the USA and conduct simulations on a regular basis, maybe even in cooperation with other countries, in order to analyse their current security measures. Once they have done that, they will have a bigger insight into the strength of their security measures and should try to strengthen the most vulnerable parts. It is important to notice, that many internet networks are all connected to a big network which is like the gateway to the whole internet. These are in most cases not managed by the governments but by large technological companies or universities. Governments should hence support these companies and organizations financially to protect their network as well as possible. If these gateways are protected well, then a large number of cyber attacks can be stopped and the government, banks, companies and all other entities threatened could handle the few remaining attacks more easily.

However, the strength of a security system is not always the most important part as the potential strength of attacks is steadily growing, sometimes it’s more important to take different measures. Two very controversial ideas are the kill switch and the electrical wall. The kill switch could shut down the internet of certain areas, whether it is only concerning a company, a city or a whole country, in case of serious cyber attacks. The electrical wall intends to inspect every data package coming into the country’s network and compares it to known signatures and in case of a match do not let them through. Both these ideas can be very useful and even save lives, however, if used by the wrong person or government, they can violate basic human rights by censoring certain parts of the internet. Therefore such measures have to be evaluated very carefully and include certain restrictions. In general all states should consider their possibilities with care as the internet is a symbol for freedom and a state interfering with the internet could lead to protest of the civilians. Because the internet connects everyone worldwide, each state is equally affected. Cooperations between countries and international agreements could therefore prove very useful leaving only non-state actors as a possible cyber threat.