Network Security

Assignment#1
Asad Sarwar
BESE-3B
Reg # 00873
Submitted to: Sir Ubaid Ur Rehman
Dated: 23rd Sept, 2015
School of Electrical Engineering and Computer Science NUST

Question# 01: Which of the following activities might be considered a possible source of
threat to a company's network, and why?
a. The daily courier service personnel who drop off and pick up packages.
Ans: Confidentiality: The daily courier service personnel may be a threat to the organizations
network as he has all the packages that are to be communicated with the outside world and these
packages may contain confidential information which he can read and record if he wishes to. So
he is a threat to confidentiality of these packages.
Integrity: He may be a threat to the integrity of these packages as he carries these packages so
he can also change/temper the contents of these packages.
Authenticity: The courier personnel might changes the credentials of the sender and the
receiver so he is also a threat to the authenticity.
Availability: The courier personnel might drop one or more packages intentionally containing
some important information or equipment. So he is also a threat to the availability of these
packages.
b. Former employees who left the company because of downsizing.
Ans: Confidentiality: These employees might be a threat to confidentiality as they might know
some confidential information about the company or some important project and they might
disclose that information to someone else outside the company who can harm the company by
using that information.
Accountability: As these employees are no more a part of the organization so they are no more
accountable to the company officials so they are a threat to the accountability for the
responsibilities they were assigned when part of the organization.
c. An employee traveling on company business to another city.
Ans: Confidentiality: He might be a threat to confidentiality if he may have some documents
containing some confidential information which he is not authorized to read and he might read
these documents.
Integrity: He might be a threat to integrity as he might be carrying some documents which he
may alter/ temper if he wishes to.
d. The building management company where an organization has its offices has decided to
install a fire sprinkler system.
Ans: none
Question# 02: Describe a network security failure you read about recently in the news.
What classes of threats were involved in the attack? Disclosure, deception, disruption,
usurpation?
Ans: Recently, two renowned hackers claimed they have discovered issues in popular iPhone
platform. They said it is possible to exploit the security breach of iPhone just by sending a sms

message which can eventually lead to gain control of the entire phone. After being hacked, this
attack gives hacker full control of the phone to make calls, send messages and use the internet. In
this security failure scenario all the four of the broad classes of the threats are involved. Since the
hacker in this case will gain unauthorized access to the phone it is a threat of disclosure. The
hacker can make calls and send messages to other people from the phone pretending to be
someone else so it is a threat of deception. Similarly as the attacker has the full control over the
phone and he can change/add/delete anything so this is a threat of the disruption. Also as the
attacker has the unauthorized control over the phone so this is a threat of usurpation.
Question# 03: Consider an automated teller machine (ATM) in which users provide a
personal identification number (PIN) and a card for account access. Give examples of
confidentiality, integrity, and availability requirements associated with the system and, in
each case, indicate the degree of importance of the requirement.
Ans: Confidentiality (Very High): The system should be highly confidential as the ATM card
and the PIN number are highly confidential and if someone gets the card and the Pin number he
can do any kind of transaction from that account. For example if a user goes to the ATM and
inserts his card and enters his PIN number and when he has done that the MITM attacker
launches an attack and somehow hacks the ATM. Now the user is waiting for the ATM machine
to ask for further processing but the attacker has the control and he uses the machine on the
users behalf and transfers all the credit from users account to his account. So what happened is
due to the loos of confidentiality the user lost all his credit from his account. So we can conclude
that confidentiality is a requirement for such a system with high degree of importance.
Integrity (Very High): Integrity is also a requirement with high degree of importance. For
example if user inserts a card and enters his PIN number and after that the attacker hacks the
ATM and changes his PIN then he would not be able to access his account. Similarly if the
attacker just launches a replay attack then the users transactions would be replayed hence
resulting in financial loss. So the ATM needs to be secure and integrity is one of the most
important requirements.
Availability (Moderate): Availability is a moderate requirement for such a system as for
example if the server is down and the services are not available then the user might has to wait
for the server to get back to work to make transactions and use its services but there will be no
loss in the form of money so availability is a moderate requirement.
Question# 04: For each of the following assets, assign a low, moderate, or high impact level
for the loss of confidentiality, availability, and integrity, respectively. Justify your answers.
a. Organization managing public information on its Web server.
Ans: Confidentiality (low): The loss of confidentiality will have a low impact on this sort of
asset as this is a web server with lots and lots of public information as for example google. So
there is no question about confidentiality as all the data on this web server (google) is public and
anyone with an internet connection can access that data.
Availability (High): As this web server is a public web server so its availability is very
important. It should be available 24/7 and in case of non-availability it will have a high impact.

Take google for example that is used by millions of users simultaneously around the world. If the
google server goes down for a while it causes a huge impact on its users.
Integrity (High): Loss of integrity has a high impact on the users of such a public web server as
a lot of people rely on this server. As for example millions of users rely on google for almost all
sorts of information. For example a research student relies on google for all his research and
thesis and if the documents or research papers he is consulting for his research are tempered his
whole research will be a loss. So the integrity of data on a public web server is important and its
loss may badly effect a lot of people.
b. Law enforcement organization managing extremely sensitive investigative information.
Ans: Confidentiality (Very High): Confidentiality is a very important factor in such a system as
that data is very confidential for the law enforcing agencies and it should only be available to the
authorized security officers. So the loss of confidentiality is unaffordable and has a very high
impact.
Availability (Moderate): The loss of availability in such a system has a moderate impact
because this information is not accessed by general public all the time rather it is accessed only
by the authorized people just at the time of the need so the loss of integrity has a moderate effect.
Integrity (Very High): The loss of integrity in such a system has a very high impact as the
system contains highly sensitive data so it should be well guarded and well protected and if
integrity is compromised then may be a lot of criminals are proved innocent and may be a lot
innocent are proved as criminals just by changing the information in that system. So the loss of
integrity has a great impact.