a)      Sniffer

- A program or device that captures vital information from the network traffic specific to a particular network.

- Sniffing is a data interception technology.

- For examples, the objectives of sniffing to steal passwords from email, web or telnet.

b) Phishing

- Phishing is the attempt to obtain sensitive information such as usernames, passwords and credit card details.

- Often for malicious reasons by masquerading as a trustworthy entity in an electronic communication.

- For examples, some phishing emails also contain malicious or unwanted software that can track your activities or slow your computer.

c) Pharming

- Pharming is similar to phishing but instead of deceiving people as phishing does, a pharming attack deceives people’s computer.

- This is where that when you type in a completely genuine URL.

- For examples, the online banking website. Your computer is tricked into displaying a fake website which is often a very accurate copy.

d) Spoofing

- Spoofing is the act of using one machine in the network communication to impersonate another.

- This is where that spoofing is a tampering activity because the hacker convinces a host computer that the hacker is another, trusted host computer and therefore should receive information.

- For examples, the objectives is to provide false information about principal’s identity to obtain unauthorized access to systems and their services.

QUESTION 2

1.       Secure Sockets Layer (SSL)

-          SSL and its successor Transport Layer Security (TLS) enable client and the server computers to establish a secure connection session and to manage encryption and decryption activities.

 

2.       Secure Hypertext Transfer Protocol (S-HTTP) 

-          Another protocol used for encrypting data flowing over the Internet but it is limited to individual messages.

i. Cyber warfare

-  Cyberwarfare is internet-based conflict involving politically motivated attacks on information systems.

- This is where that cyberwarfare attacks can disable official websites and networks, disrupt or disable essential services, steal or alter classified data and any cripple financial systems.

ii. Computer Forensic

-          Computer forensics is therefore described as those activities associated with the identification and preservation of computer or electronic evidence in support of some official or legal action.

-          For examples, to recover thousands of deleted emails or performing investigation after multiple users had taken over the system.

QUESTION 3

a) Without protection against malware and intruders, connecting to the Internet could be very dangerous. Firewalls, intrusion detection system and antivirus software have become the tools to overcome this problem. Briefly explain these THREE (3) tools.

i) Firewalls
Firewall is a combination of hardware and software that prevents unauthorized users from accessing private networks. The technologies include static packet filtering, stateful inspection, network address translation (NAT) and application proxy filtering. A firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. They establish a barrier between secured and controlled internal networks that can be trusted and untrusted outside networks, such as the Internet.

ii) Intrusion detection system
Intrusion detection system is a monitor’s hot spot on corporate networks to detect and deter intruders. This examines event as they are happening to discover attacks in progress. An intrusion detection system (IDS) is a system that monitors network traffic for suspicious activity and issues alerts when such activity is discovered. While anomalydetection and reporting is the primary function, some intrusion detection systems are capable of taking actions when malicious acitivity or anomalous traffic is detected, including blocking traffic sent from suspicious IP addresses.

iii) Antivirus software
Antivirus software is responsible to checks computers for presence of malware and can often eliminate it as well and it requires continual updating. Antivirus software is a type of utility used for scanning and removing viruses from your computer. While many types of antivirus (or "anti-virus") programs exist, their primary purpose is to protect computers from viruses and remove any viruses that are found. Most antivirus programs include both automatic and manual scanning capabilities.

 General controls is govern design, security and use of computer programs and security of data files in general throughout organization’s information technology infrastructure. This type of controls can apply to all computerized applicationsThe general controls consists of many types which are software, hardware, computer operations, data security, implementation and administrative controls. On the whole, general controls apply to all computerized applications and consist of a combination of hardware, software, and manual procedures that create an overall control environment. General controls include software controls, physical hardware controls, computer operations controls, data security controls, controls over implementation of system processes, and administrative controls.

ii) Application Controls
Application controls is a specific controls unique to each computerized application, such as payroll or order processing. This include both automated and manual procedures and this type of control ensure that only authorized data are completely and accurately processed by that application. It is includes input controls, processing controls and output controls. Input controls check data for accuracy and completeness when they enter the system. There are specific input controls for input authorization, data conversion, data editing, and error handling while processing controls establish that data are complete and accurate during updating and last, output controls ensure that the results of computer processing are accurate, complete, and properly distributed.

1)      Virus 

-          Malware that, when executed, tries to replicate itself into other executable code. When it succeeds the code is said to be infected. When the infected code is executed, the virus also executes.

2)      Worm

-          A computer program that can run independently and can propagate a complete working version of itself onto other hosts on a network.

3)      Trojan horse

-          A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorization of a system entity that invokes the Trojan horse program.

4)      Logic bomb

-          A program inserted into software by an intruder. A logic bomb lies dormant until a predefined condition is met the program then triggers an unauthorized act.

 

-          Computer crime encompasses any criminal act dealing with cyber and networks called hacking. 

-          The computer crime may however be target for unlawful acts in the following cases such as unauthorized access to computer.

-          The computer crime may be used as a tool in the following kinds of activities such as financial crimes, sale of illegal articles, pornography, online gambling, intellectual property crime, e-mail spoofing, forgery, cyber defamation and cyber stalking.

1)      -Corporate systems using the Internet are especially vulnerable because the Internet is designed to be an open system and makes internal corporate systems more vulnerable to actions from outsiders. 

-Hackers can unleash denial of service (DoS) attacks or penetrate corporate networks to cause serious system disruptions.

2)      - Wi-Fi networks can easily be penetrated by intruders using sniffer programs to obtain an address to access the resources of the network.

3)      - Computer viruses and worms can spread rampantly from system to system, clogging computer memory or destroying programs and data. 

-Software presents problems because software bugs may be impossible to eliminate and because software vulnerabilities can be exploited by hackers and malicious software.

1)      Firewall – Prevents the accesses of private networks or systems when connected to the internet from the unauthorized users,

2)      Intrusion detecting systems – Monitors the private networks and provides access to the corporate systems.

3)      Antivirus and Antispyware software – One checks the system from infections like virus worms and deletes the malicious software’s. While other will fights with the intrusive and harmful spyware programs.

 

- Authentication is the process of verifying the identity of a person or digital entity.

-  It is a fundamental component of information security that essentially validates that entities are who or what they claim to be.

- In a simple word, the process of verifying who you are to log on something devices or systems.

1)      Username/Password

-           Most commonly used electrical authentication method across the globe. It does not require any physical device and has a very low implementation cost.

-          It is reasonably good for low assurance applications

2)      One-time Password Device 

-           These generate a new password at fixed intervals of time, using which it is possible to access restricted data. 

-          They provide true dual-factor authentication which makes the password difficult to steal or share.

3)      Biometric Authentication 

-          This uses a part of the body, like a retinal scan or fingerprint, to authenticate the user.

-          This is completely unique to each user and nearly impossible to steal. 

-          These devices are usually expensive and highly invasive, besides increasing the complexity of administration

4)      Smart Card

-          A wallet-sized card that has a computer embedded in it for purposes such as identification, authentication, data storage and application processing.

-           They are often used to enhance security by making cards difficult to copy or manipulate.

- A ransomware is a type of malware that locks your files, data or the PC itself and extorts money from you in order to provide access. 

-This is a new way for malware writers to ‘collect funds’ for their illegitimate activities on the web.

-Ransomware may also be referred to as a crypto-virus, crypto-Trojan or crypto-worm.

- Use a safe and password-protected internet connection.

- Avoid browsing websites that are often the breeding grounds for malware such as illegal download sites, adult sites and gambling sites.

- Install, use, and regularly update an antivirus solution

1) 

- A company suffers losses due to computer crime when a hacker steals confidential information and future plans of the company.

- The hacker simply sells the information to a competitor company and they use the information to get benefits.

2) 
It is not just affect the organization itself. it is affect trust of people. whenever the people knows that the organization has lost their system it will lead to dissatisfaction  by the people as an user or customer. because its all about data and system.

Absolutely, cyberwarfare is a big problem. This is because cyberwarfare is more complex than conventional warfare. Although many potential targets are military a country’s power grids, financial systems, and a communication network can also be crippled. Non-state actors such as terrorist ore criminal groups can mount attacks, and it is often difficult to tell who is responsible. Nations must constantly to be on the alert for new malware and other technologies that could be used against them, and some of these technologies develop by skilled hacker groups are openly for sale to interested governments. It involved big asset of nation state especially on their military and financial matter which must  be uphold from external intervention to ensure peace and harmony.

 

There have been several attempts to take effective measures against cyber attacks but none have been successful on international base. For example, in 2011 the Shanghai Cooperation Organization proposed to the UN the “International code of conduct for information security” which did not pass because it enabled to much internet censorship according to many western countries. Another measure taken by the US and Russia is the establishment of a cyberwar-hotline which should be used in ciris situation to prevent an accidential cyberwar. This might not prevent any cyber attacks but it is certainly an important step because as mentioned, cyber attacks can be commited through other computers which could lead to tensions between to countries caused by someone else. In order to effectively prepare for a possible cyberwar the USA has launched a simulation called Cyber ShockWave in 2010 which simulate the situation as realistic as possible. The results were shocking and showed that the USA isn’t prepared for such attacks, especially not if they would be attacked by surprise. Similar simulations have been conducted before by the USA. They have proved very efficient as it showed in which aspects the USA was unprepared and in which aspects they were.


CASE STUDY (VIDEO)

1.  Security isn’t simply a technology issue, it’s a business issue. Discuss.

It’s a business issue because most of the organization are depending on their technology and system to sustain their business. Any risk towards their security will give huge impact in their business as well as profit. The more problem related to their security such as leak of employees and consumer personal details will jeopardize their organization. This is because people will lose trust to keep their information with them as all the personal data is very crucial to be well protected to ensure there is no abuse of information. If the technology or system made unable to protect people security it shows that the organization had failed to protect their consumer right at first place. 

 

2. Who poses the biggest security threat: insiders or outsiders?

The biggest security threat comes from the insiders. This is because the insider is the employees that directly involved with any transaction related. They are the one who control all the processes and there might be higher chances for them to easily breach the security. There is no doubt that employee itself can sabotage the organization if they feel dissatisfied with their organization. 

 

3.  Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats?

-The major security threats to e-commerce are malicious code threats. These code threats typically involve viruses, worms, Trojan horses.Viruses are normally external threats and can corrupt the files on the website if they find their way in the internal network. They can be very dangerous as they destroy the computer systems completely and can damage the normal working of the computer. 

Worms are places itself directly through the internet. It can infect millions of computers in a matter of just few hours. A Trojan horse is a programming code which can perform destructive functions. They normally attack your computer when you download something. 

-way to minimize this threat is look closely at the URL from any email for special characters, numbers. If your financial institution, or a site that you have an account with, sends you a ‘password reset’ email, log in to the bank directly instead of clicking on the link in the email.