Briefly explain the following computer crimes.

a)      Sniffer

Sniffing is a process of monitoring and capturing all data packets passing through given network. Sniffers are used by network/system administrator to monitor and troubleshoot network traffic. Attackers use sniffers to capture data packets containing sensitive information such as password, account information etc. Sniffers can be hardware or software installed in the system. By placing a packet sniffer on a network in promiscuous mode, a malicious intruder can capture and analyze all of the network traffic.

b)      Phishing

Phishers attempt to steal your personal information. They send out e-mails that appear to come from legitimate websites such as eBay, PayPal, or other banking institutions. The e-mails state that your information needs to be updated or validated and ask that you enter your username and password, after clicking a link included in the e-mail. Some e-mails will ask that you enter even more information, such as your full name, address, phone number, social security number, and credit card number. However, even if you visit the false website and just enter your username and password, the phisher may be able to gain access to more information by just logging in to account.

Phishing is a con game that scammers use to collect personal information from unsuspecting users. The false e-mails often look surprisingly legitimate, and even the Web pages where you are asked to enter your information may look real. However, the URL in the address field can tell you if the page you have been directed to is valid or not. For example, if you are visiting an Web page on eBay, the last part of the domain name should end with "ebay.com." Therefore, "http://www.ebay.com" and "http://cgi3.ebay.com" are valid Web addresses, but "http://www.ebay.validate-info.com" and "http://ebay.login123.com" are false addresses, which may be used by phishers. If URL contains an IP address, such as 12.30.229.107, instead of a domain name, you can almost be sure someone is trying to phish for your personal information.

c)       Pharming

Pharming is yet another way hackers attempt to manipulate users on the Internet. While phishing attempts to capture personal information by getting users to visit a fake website, pharming redirects users to false websites without them even knowing it.

While a typical website uses a domain name for its address, its actual location is determined by an IP address. When a user types a domain name into his or her Web browser's address field and hits enter, the domain name is translated into an IP address via a DNS server. The Web browser then connects to the server at this IP address and loads the Web page data. After a user visits a certain website, the DNS entry for that site is often stored on the user's computer in a DNS cache. This way, the computer does not have to keep accessing a DNS server whenever the user visits the website.

One way that pharming takes place is via an e-mail virus that "poisons" a user's local DNS cache. It does this by modifying the DNS entries, or host files. For example, instead of having the IP address 17.254.3.183 direct to www.apple.com, it may direct to another website determined by the hacker. Pharmers can also poison entire DNS servers, which means any user that uses the affected DNS server will be redirected to the wrong website. Fortunately, most DNS servers have security features to protect them against such attacks. Still, they are not necessarily immune, since hackers continue to find ways to gain access to them.

d)      Spoofing

The word "spoof" means to hoax, trick, or deceive. Therefore, in the IT world, spoofing refers tricking or deceiving computer systems or other computer users. This is typically done by hiding one's identity or faking the identity of another user on the Internet.

Spoofing can take place on the Internet in several different ways. One common method is through e-mail. E-mail spoofing involves sending messages from a bogus e-mail address or faking the e-mail address of another user. Fortunately, most e-mail servers have security features that prevent unauthorized users from sending messages. However, spammers often send spam messages from their own SMTP, which allows them to use fake e-mail addresses. Therefore, it is possible to receive e-mail from an address that is not the actual address of the person sending the message.

Another way spoofing takes place on the Internet is via IP spoofing. This involves masking the IP address of a certain computer system. By hiding or faking a computer's IP address, it is difficult for other systems to determine where the computer is transmitting data from. Because IP spoofing makes it difficult to track the source of a transmission, it is often used in denial-of-service attacks that overload a server. This may cause the server to either crash or become unresponsive to legitimate requests. Fortunately, software security systems have been developed that can identify denial-of-service attacks and block their transmissions.

Finally, spoofing can be done by simply faking an identity, such as an online username. For example, when posting on an Web discussion board, a user may pretend he is the representative for a certain company, when he actually has no association with the organization. In online chat rooms, users may fake their age, gender, and location.


Question 2 

a)      Distinguish the TWO (2) methods for encrypting network traffic on the Web

SSL and its successor Transport Layer Security (TLS) enable client and server computers to establish a secure connection session and manage encryption and decryption activities. 

Another protocol used for encrypting data flowing over the Internet, but it is limited to individual messages. 

b)      Briefly explain the following terms.

 

Cyber warfare is computer- or network-based conflict involving politically motivated attacks by a nation-state on another nation-state. In these types of attacks, nation-state actors attempt to disrupt the activities of organizations or nation-states, especially for strategic or military purposes and cyber espionage. Although cyber warfare generally refers to cyber-attacks perpetrated by one nation-state on another, it can also describe attacks by terrorist groups or hacker groups aimed at furthering the goals of particular nations. It can be difficult to definitively attribute cyber-attacks to a nation-state when those attacks are carried out by advanced persistent threat (APT) actors, but such attacks can often be linked to specific nations. Cyber warfare can take many forms, including: 

 

Computer forensics is the application of investigation and analysis techniques to gather and preserve evidence from a particular computing device in a way that is suitable for presentation in a court of law. The goal of computer forensics is to perform a structured investigation while maintaining a documented chain of evidence to find out exactly what happened on a computing device and who was responsible for it. Forensic investigators typically follow a standard set of procedures: After physically isolating the device in question to make sure it cannot be accidentally contaminated, investigators make a digital copy of the device's storage media. Once the original media has been copied, it is locked in a safe or other secure facility to maintain its pristine condition. All investigation is done on the digital copy. Investigators use a variety of techniques and proprietary software forensic applications to examine the copy, searching hidden folders and unallocated disk space for copies of deleted, encrypted, or damaged files. Any evidence found on the digital copy is carefully documented in a "finding report" and verified with the original in preparation for legal proceedings that involve discovery, depositions, or actual litigation.

a)      Without protection against malware and intruders, connecting to the Internet could be very dangerous. Firewalls, intrusion detection system and antivirus software have become the tools to overcome this problem. Briefly explain these THREE (3) tools.

A firewall is software used to maintain the security of a private network. Firewalls block unauthorized access to or from private networks and are often employed to prevent unauthorized Web users or illicit software from gaining access to private networks connected to the Internet. A firewall may be implemented using hardware, software, or a combination of both. A firewall is recognized as the first line of defense in securing sensitive information. For better safety, the data can be encrypted. Firewalls generally use two or more of the following methods:

 

 

An intrusion detection system (IDS) is a system that monitors network traffic for suspicious activity and issues alerts when such activity is discovered. While anomaly detection and reporting is the primary function, some intrusion detection systems are capable of taking actions when malicious activity or anomalous traffic is detected, including blocking traffic sent from suspicious IP addresses. Although intrusion detection systems monitor networks for potentially malicious activity, they are also prone to false alarms (false positives). Consequently, organizations need to fine-tune their IDS products when they first install them. That means properly configuring their intrusion detection systems to recognize what normal traffic on their network looks like compared to potentially malicious activity. Intrusion detection systems come in different flavors and detect suspicious activities using different methods, including the following:

 

 

b)      Information systems controls are the one of the components of an organizational framework for security and control. Information systems controls consist of two – general and application control. A company must know how and where to deploy security tools and security personnel must know what controls a company must have in place to protect its information system. Contrast between General Controls and Application Controls. 

 

General controls are those that control the design, security, and use of computer programs and the security of data files in general throughout the organization. On the whole, general controls apply to all computerized applications and consist of a combination of system software and manual procedures that create an overall control environment

Application controls are specific controls within each separate computer application, such as payroll or order processing. They include both automated and manual procedures that ensure that only authorized data are completely and accurately processed by that application. The controls for each application should take account of the whole sequence of processing, manual and computer, from the first steps taken to prepare transactions to the production and use of final output. Not all of the application controls discussed here are used in every information system. Some systems require more of these controls than others, depending on the importance of the data and the nature of the application. Application controls focus on the following objectives:

1. Completeness of input and update. All current transactions must reach the computer and be recorded on computer files.

2. Accuracy of input and update. Data must be accurately captured by the computer and correctly recorded on computer files.

3. Validity. Data must be authorized or otherwise checked with regard to the appropriateness of the transaction. (In other words, the transaction must reflect the right event in the external world. The validity of an address change, for example, refers to whether a transaction actually captured the right address for a specific individual.)

4. Maintenance. Data on computer files must continue to remain correct and current. Application controls can be classified as (1) input controls, (2) processing controls, and (3) output controls.

Question 4

Malicious Software programs are referred to as Malware. Describe FOUR (4) types of malicious software. 

Spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet (where it is sometimes called a Spybot or tracking software), Spyware is programming that is put in someone's computer to secretly gather information about the user and relay it to advertisers or other interested parties. Spyware can get in a computer as a software virus or as the result of installing a new program.

Virus is a program or programming code that replicates by being copied or initiating its copying to another program, computer boot sector or document. Viruses can be transmitted as attachments to an e-mail note or in a downloaded file, or be present on a diskette or CD

A worm is a self-replicating virus that does not alter files but duplicates itself. It is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks.

Trojan horse is a program in which malicious or harmful code is contained inside apparently harmless programming or data in such a way that it can get control and do its chosen form of damage, such as ruining the certain area on your hard disk. A Trojan horse may be widely redistributed as part of a computer virus.

Question 5 

a)      Nowadays, securing information systems has become an important issue in organization to protect itself against computer crime. Define computer crime and provide an appropriate example. 

·         Computer crime is alternatively referred to as cyber-crime, e-crime, electronic crime, or hi-tech crime. Computer crime is an act performed by a knowledgeable computer user, sometimes referred to as a hacker that illegally browses or steals a company's or individuals private information. In some cases, this person or group of individuals may be malicious and destroy or otherwise corrupt the computer or data files.

·         Examples of computer crime include: 

1.       Child pornography - Making or distributing child pornography.

2.       Copyright violation - Stealing or using another person's Copyrighted material without permission.

3.       Cracking - Breaking or deciphering codes that are being used to protect data.

4.       Cyber terrorism - Hacking, threats, and blackmailing towards a business or person.

5.       Cyberbully or Cyberstalking - Harassing or stalking others online.

6.       Cybersquatting - Setting up a domain of another person or company with the sole intentions of selling it to them later at a premium price.

b)  Briefly explain THREE (3) reasons why information systems are vulnerable to destruction, error and abuse? 

·          

c)  Discuss the THREE (3) most important tools and technology for safeguarding information resources. 

Question 6 

a)      Identify management software automates the process of keeping track of all information systems users and their system privileges, assigning each user a unique digital identity for accessing each system. Define authentication. 

 

b)      Identify and briefly describe FOUR (4) authentication technologies.

1.       Password Based Technologies

Passwords are the most common form of authentication. Password may be of any form (String of alphabets, numbers and special characters). This password is necessarily to be known by the entity or the thing or a person that is being authenticated. This authentication process takes places (password) by: 

·         Prompts for user id and password.

·         User enters user id and password.

·         User id and password validation.

·         Authentication result back to the server.

·         Inform user accordingly.

2.       Certificate Based Technologies

It is a digital document which digitally signed by a reliable third party known as the Certificate Authority (CA). Then these Digital Certificates can be reused for user authentication. Certificate based authentication is stable as compared to password based authentication because here end user is supposed to have something (CERTIFICATE) rather than to know something (PASSWORD). Electronic document contains information of “The Entity it belongs to”, “The Entity it was issued by”, “Unique serial number or some other unique identification”, or “Digital fingerprint”. This authentication process takes places (certificate) by:

·         Creation, storage and distribution of DC(Digital Certificate).

·         Login request (user to server).

·         Server creates a random challenge.

·         User signs the random challenge.

·         Server returns an appropriate message back to the user.

3.        E-Token Based Technologies

An E-Token authentication is small devices that develop/generates a new odd/random value every time it is used. This random value becomes the basis for authentication (an alternative to a password). It can be implemented on a USB key fob or on a smart card. Data is protected on the device itself. Many store credentials such as passwords, digital signatures and certificates, and private keys. E-Token has different components or features like Processor, LCD for displaying outputs or random values, Battery, Small keypad for entering information, Real-time clock. This Authentication Process takes places (e-token) by: 

·         Creation of a token.

·         Use of token.

·         Token validation.

·         Server returns an appropriate message back to the user.

4.        Biometric Based Technologies:

Biometric authentication refers to the realization/recognition/identification of humans by their personality/characteristics such as Face, fingerprint, human voice, Retina, Iris pattern of the eye, vein pattern etc. It's used in computer science as a form of realization/recognition and access control. It is also used to find/select persons in groups that are under consideration/measurement. This Authentication Process takes places (Biometric) by:

·         Database consist of a sample of users biometric characteristics.

·         During Authentication process, User is compulsory/mandatory to give a new pattern/sample of the users biometric.

·         This pattern is sent to encryption.

·         This patters/sample is decrypted & related/compared.(if pattern matches)

·         User is treated as valid one.

Question 7

a)      Describe ransomware.

 

b)      State how do we prevent and protect our computer from ransomware.

Anti-malware tools like Malware bytes or McAfee Anti-Malware are an important part of your computer’s security system. Make sure that you have one installed and are running the most current version on your computer.

Most malware tools give you the ability to scan any emails or attachments before opening them. Emails and email attachments should be scanned before for malware before you open them – especially if they’re coming from an unknown sender.

If you’re not sure about an email attachment or link in an email, send a quick note to the person who sent it and ask them if it is legitimate. If the person doesn’t respond or gives you a cryptic answer, do not open it.

 

c)       Discuss the effects of the computer crime to an organization.  

·         Damaged reputation: Counterproductive to building a brand

The web is an interesting place: Once information has been put out, it’s likely to live there forever, no matter how hard one tries to erase it. Think about the last email that you sent that contained confidential information. The email probably had an intended recipient. You probably don’t want that information to be seen by anyone except the recipient. Sadly, it could easily be made public if your account is hacked. If you store anything online: pictures, files, documents, you risk that data being exposed to the public should your data center (or cloud) be breached.

·         Damage to intellectual property resulting in the loss of a competitive edge

Without diminishing the effects of the exposure of sensitive customer information, cybercrime and data leaks can also have a negative impact on a company's competitive edge. Consider the effects of having intellectual property like business ideas, marketing campaigns or business expansion plans stolen or exposed. This breach might render any of these ideas useless or ineffective and result in serious damage towards business growth and revenue gains, especially if they land up in the hands of one’s competitors.

 

1.  Security isn’t simply a technology issue, it’s a business issue. Discuss.

Employees use of unauthorized personal mobile devices can be a threat because it is an unknown object on the IT network. For example, if a user was to save business data onto an unauthorized device and then it was infected by malware, the data could end up in the wrong hands.

2.  Who poses the biggest security threat: insiders or outsiders?

3.  Suppose your business had an e-commerce Web site where it sold goods and accepted credit card payments. Discuss the major security threats to this Web site and their potential impact. What can be done to minimize these threats?
 

1. Is cyber-warfare a serious problem? Why or why not?

Cyber-warfare is a set of challenges for security experts, not only in detecting and preventing intrusions but also in tracking down perpetrators and bringing them to justice. The most prominent threats so far include, successful attacks on the FAA airline system, including one in 2006 that partially shut down air traffic data systems in Alaska. Intruders successfully penetrated the Pentagon’s $300 billion Joint Strike Fighter project and stole several terabytes of data related to design and electronics systems. Cyber spies infiltrated the U.S. electrical grid in April 2009 and left behind software programs whose purpose is unclear. In Iraq, insurgents intercepted Predator drone feeds using software downloaded from the Internet. An act of cyber-war against a critical resource such as the electric grid, financial system, or communication systems would likely be devastating.

 

2. What solutions have been proposed? Do you think they will be effective? Why or why not?

 Congress is considering legislation that would require all critical infrastructure companies to meet newer, tougher cyber security standards. As cyber warfare technologies develop and become more advanced, the standards imposed by this legislation will likely be insufficient to defend against attacks.

Furthemore, Secretary of Defense Gates ordered the creation of Cyber com, the first headquarters designed to coordinate government cyber security efforts. It was activated in May 2010. It will coordinate the operation and protection of military and Pentagon computer networks. It will coordinate efforts to restrict access to government computers and protect systems that run the stock exchanges, clear global banking transactions, and manage the air traffic control system. Its ultimate goal will be to prevent catastrophic cyber attacks against the U.S. Some insiders suggest that it might not be able to effectively organize the governmental agencies without direct access to the President, which it currently lacks.