Page |1
Name:
Student Reference Number:
Module Code: Module Name: Network Security
Coursework Title: Term 1 - Group assignment
Deadline Date: Member of staff responsible for coursework:
Programme: BSc (Hons) Computer Security - Plymouth
Please note that University Academic Regulations are available under Rules and Regulations on
the University website [Link]/studenthandbook.
Group work: please list all names of all participants formally associated with this work and state
whether the work was undertaken alone or as part of a team. Please note you may be required to
identify individual responsibility for component parts.
We confirm that we have read and understood the Plymouth University regulations relating
to Assessment Offences and that we are aware of the possible penalties for any breach of
these regulations. We confirm that this is the independent work of the group.
Signed on behalf of the group:
Individual assignment: I confirm that I have read and understood the Plymouth University
regulations relating to Assessment Offences and that I am aware of the possible penalties
for any breach of these regulations. I confirm that this is my own independent work.
Signed:
Use of translation software: failure to declare that translation software or a similar writing aid has
been used will be treated as an assessment offence.
I *have used/not used translation software.
If used, please state name of software…………………………………………………………………
Overall mark _____% Assessors Initials ______ Date_________
Page |2
Network Security – CNET233SL
Group Name:
Members
Content
1. Overview Page 4
2. Discussion Page 5
• Viruses, worms, and infectious threat Page 5
• Trojans and rootkits: the persuasive threat Page 5
• Spyware and Key loggers: The Financial Threat Page 5
• SQL Injections Page 6
• Cross site scripting (XSS) Page 6
• Denial of Service / Distributed Denial of Service Page 7
• Risk in Cloud Computing Page 7
• Weak Encryption Page 7
Page |3
3. Security related requirements to secure the automated system. Page 8
• Security requirements on an application Page 8
• Security requirements on users Page 8
• Security requirements on infrastructure Page 8
4. Risk prevention methods Page 9
• Prevention from DDoS Page 9
• Data losses - Backup systems Page 10
• Secure data using private cloud storages Page 11
• Monitoring data Page 11
• Firewalls Page 12
• Protection Procedure of hybrid cloud Page 13
• PCI – DSS Page 13
• Public Key Encryption Page 14
Overview
Automated operations are one of the latest business models available in the world. This method is
more efficient, cost-effective and very good in most cases.
But there are also many risks and security related issues in this module. According to this theoretical
case study, we will discuss about potential risks and threats to the proposed automated system.
This will cover studies for both internal operations and the public services, runs through the internet.
Also, we will analyse safety infrastructure by identifying potential threats and providing suitable
mechanisms to prevent from them. As one of the leading groups of companies, it is a must to main
public trust while providing online access to end-customers and all remote employees.
There are three major sectors in XYZ Enterprises:
• Finance (private banks, etc.)
• Manufacturing and selling electrical/electronic items (networking equipment’s)
Page |4
• Serving cloud data-centre facilities
These three sectors will need separate techniques to prevent from cyber-attacks and maintain their
services.
Nothing is 100% secure, but from this case study, we will try to prevent from most online attacks
considering connected threats by providing comprehensive security infrastructure and provide a fully
satisfied customer experience.
Page |5
Discussion
We could identify few types of attacks and potential risks that can be threat to this automated system.
Viruses, worms, and infectious threat
Viruses and worms are known for their behaviour, as well as malware tools designed for destroy
without data from the customer. The epidemic legally infects programs and these program spreads
the abuse of computers, so viruses must be compelled to act Before they simply unfold. In the other
side, the worm spreads, without users’ attention Therefore, each virus would hold individual worms
known as a useful download, which may be a useful download, but harmful code behind the
application.
Trojans and rootkits: the persuasive threat
Trojans and rootkits are bundled together as they both attacks/infects by hiding into a different
application. Trojans blinds with fake application and it will run malicious codes while execution.
Users, therefore, who are considering It is useful to download from the software, and in exchange,
you will find yourself with A malware-infected device. The rootkits can be different. This is a way for
malware to be covered, but it don't contain malware. The virus book invented rootkit methods to
protect malwares from anti-viruses, so that It is difficult to observe and delete by antivirus programs.
Antivirus products are efficient instruments for extracting rootkits are contradictory, and they
accompany them.
Spyware and Key loggers: The Financial Threat
Malware used in malicious attacks due to frauds. Spywares, key loggers, phishing and social
engineering threats are being used to rob money & data from computer users and corporations.
For the primary quarter of 2011, the most recent security reports list Troy Infection among the
highest The list of malware, with 70% of all malicious files detected by computer systems at
several time intervals, Viruses and typical worms followed.
In late 2010 and early 2011, the popularity of the pretend antivirus decreased, but the scale of the
transfer scheme for the Trojans was considerably inflated. Velocity of identification of the newest In
1/2 of the 2011 moon, malware inflated 15% compared to half of the 2010 moon. (Bullguard, 2020).
Page |6
SQL Injections
SQL Injection (SQLI) is a form of injection intrusion that allows malicious SQLI to be performed
against the SQL database. The SQL database behind a production is managed by such
assumptions. To circumvent protection mechanisms for the database, intruders may use SQL
Injection bugs (which is known as SQL vulnerabilities). We can go through a web page or web
application verification and authorization to connect contents of the whole SQL database. They can
also use SQL Injection to add, modify and delete the database records by SQL Injection. This will
brake system database, which leads to make issues in the company.
The injection of SQL is a common form of web hacking. Usually, SQL injecting occurs when a
website ask a client for details, such as their username, user_id, and instead of a asked detail, the
user provides a SQL query, id that is going to run on a database. The primary aim is to damage the
website's database.
Prevention: -
• Validate all untrusted data using a white-list process, irrespective of source. (Should validate
inputs from all sources including customers, employees and administrators)
• Limit the potential damage of a successful exploit by minimizing the rights of the database
and application's advantages/privileges.
• Much easier, using an Object Relational Mapping library of data (such as Entity System,
Hibernate, Active Record, depending on your platform).
• Instead of combining a string query, a parameterized query is often used to access the
database (PDO) – This is also a good method to escape from SQLi.
Cross site scripting (XSS)
An attacker can use Cross-Side Scripting to alter the websites that other users see in the Request
to distribute, if it is to collect data including credit cards and passwords, show fake data, hijack user
sessions, redirect users to another website or run malware scripts in the browser of the victim.
cross-site scripting works by exploiting a compromised website to implement malicious JavaScript
directly to consumer. When the malicious code is executed by the attacker inside the user's browser,
their communication will be absolutely compromised.
The attacker can send forms with JavaScript or HTML fragments to be embedded right into the page
of the web and converted by the browser.
Page |7
XSS attacks can be divided as three types.
1. Reflected XSS
2. Sorted XSS
3. DOM-based XSS
Prevention: -
• Filter information on arrival: Based on what is needed, filter as broadly as possible to find true
data at the stage where input from users is collected.
• Content Security Proposal: As a final line of the Content Security Proposal, we will use
Protection to decrease the severity of any vulnerabilities that still occur with Cross-Site
Scripting.
• The required response headers can be used (CORS)
Distributed Denial of Service
An intrusion of Distributed Denial-of-Service (DDoS) is an attack in which multiple cryptographic
intrusions signature systems, such as a database, server or other network service, attack a target
and cause a target to be overloaded. DDoS consumes the target company's resources by
overloading them. The incoming message stream, demands for connections to the target system or
malformed packets cause it to slow down or even completely down, fail and shut down, while
avoiding legitimate customers or assistance from company systems.
Risk in Cloud Computing
It is possible to find cloud storage in every part of the world. There is a tremendous danger and the
chance of unauthorized access to secure data within these cloud computing systems.
Weak Encryption
If the information has not been encrypted inside networks or the encryption has not been obsolete,
the data can be read and accessed by anyone. If the encryption is bypassed by a hacker, hackers
can read all the security details easily, such as details about customers without decrypting anything.
Page |8
Security related requirements to secure the automated system.
In this chapter, we will discuss about how to protect the system from above mentioned risks and
threats.
Security requirements on an application
• Digital certificates and digital signatures obtained from reputable sources which are
authenticated (Ex: HTTPS certificates).
• Using a stable mechanism of encryption for confidential information
• Use correct protocols for Network Security when transferring data
Security requirements on users
• Keep track of documented behaviour of malware. Notify users about possible phishing
methods and social engineering tricks.
• Limiting access to the device by users. Let users to use secure devices and limit outdated
hardware and software versions.
• Maintain user activities and monitor harmful users.
Security requirements on infrastructure.
• Secure internal network by maintaining a good firewall. Outsiders should not be allowed.
• User latest architectures to configure firewalls.
• Asset identification
• Follow correct security policies & procedures.
• Monitor and identify risks.
• Limit access by dividing users into various privilege groups.
• Patch & update companies’ software.
• Avoid using cracks and illegal software tools.
• Carry out cyber security trainings for staff members.
Page |9
Risk prevention methods
DDOS ATTACK (Distributed Denial of Service)
There can be DDOS attacks from the guest side of this device attacker. The purpose of the DDOS
attack is to disrupt ordinary process and overflow resources. This will be flooding the target server
with continuous junk traffic, such as flagellant requests that overwhelm the target a system that
causes legitimate traffic to be disrupted or denied service.
Many businesses sell their goods over the internet on this web server. In this case, the attacker will
use their computers and software to strike and flood this server. To try to interrupt the service with
fake data traffic and this is not a DDOS ATTACK, this is a DOS attack, which is a denial of service
since a DOS attack is an attack that is coming A network or server will now usually handle an attack
from a single source from one source because it is easier to find (they can track the IP address of
the attacker) the server can simply close the attack from a single source. The relation to where the
attack comes from isn't really a concern. The dilemma is what if an attack comes simultaneously
from several sources, and that is what DDOS is.
P a g e | 10
Prevention: -
It prevents Dos and DDOS attacks we can use services from these third-party vendors:
• RioRey - The DDoS Specialist™
• Cloudflare - The Web Performance & Security Company
• Comodo cWatch
They migrate all insecure traffics into a different location without affecting to the system. However,
developers should protect real server IP addresses from exposing.
Data losses - Backup systems
A very significant part of fault tolerance is storage. If something was going to happen to a company's
Data such as disk failure resulting in data loss will then have a significant effect on how the data is
lost. Business succeeds. That is why it was important to ensure that no data loss would occur if a
disk failed. RAID (Redundant collection of separate arrays) is one of the best approaches to avoid
data loss. Disks.) Data is copied to several disks in a RAID setup so that in the event of a disk failure,
There will be no data lost.
There are 4 different RAID types.
• RAID 0
• RAID 1
• RAID 5
• RAID 10
RAID 0 is not tolerant of fault, RAID 0 should not even be called RAID because not only is it tolerant
of [Link] does not have fault-tolerance, it raises the risk of data loss. Since the data in RAID 0 is
It is not duplicated, but it is scattered or striped over two different [Link] you do not, or if you
try to kill yourself with a hammer, all the knowledge will be lost. So, the only one,This is why you
would like to use RAID 0 for its tempo. Since you have 2 disk controllers when you have them.
Working instead of 1, then it's much faster to access info.
RAID 1
In RAID 1, RAID 1 is fault tolerant. In the configuration of RAID 1, the data is copied on more than
one disk [Link] the same data copy as Disk 1. So, in the case of a single failure of the disk, such
as having Destroyed by a laser beam, so there would be no loss of data since the other disk would
have a Duplicate Duplicate Versions
RAID 2
A minimum of 3 hard drives are necessary. There are two forms.
• Valuable Drivers
• Mistake Repair Drivers
P a g e | 11
It will measure the error correction code, also known as hamming code or hamming code, when
data is written. When it comes to reading from the disk, ECC would have written an error-correcting
driver. The corresponding code must be read and if any change needs to be made, it will do so on
the travel. This offers the advantage of sequential read and write output but it’s very old, outdated
solution.
RAID 5
Possibly the most common configuration that is used because it is simple and can store a large
amount of Data. Data is not duplicated in the RAID 5 setup, but is striped or scattered over several
disks. And there is another very important piece of information in addition to the data, which is
distributed equally.
This knowledge, called parity and parity, is used to rebuild the data in the disks across all disks a
disk failure case.
But RAID 5 is poor since the equivalent of an entire disk is used to store parity limits the amount of
cumulative data that can be processed in this collection. For example, if all 4 of these drives were 1
terabyte each, totalling 4 terabytes, but set up in a RAID 5, 3 terabytes will be the total sum to be
used for data storage, since the equivalent of storing parity, 1 entire disk will be required.
Secure data using private cloud storages:
If you want to store extremely sensitive data files on the cloud, private cloud servers are the best
solution. Private infrastructure has two ways of thinking: Providing private servers or private
networks with company approval or looking for servers, cloud service, dedicated servers. Public
cloud infrastructure-using website configuration practically facing the media. We may use hybrid
infrastructure in this case. Cloud security is essentially performed in three steps, such that the
identification mechanism or threat is identified. The method of identification takes place in three
stages.
Monitoring data
Using algorithms that know the normal behaviour of the system and any deviation from this normal
behaviour. The action of the device causes an alarm and the cloud experts, or the cloud experts
then monitor this alarm by experts on cloud security.
If they realize that there is a threat, then they will understand the next step in gaining exposure.
What caused that issue or specifically who caused that issue. Then search for resources that give
the attacker the opportunity to look through the details and find or point out that declaration or
recognition of an incident that creates a problem using visibility Stage.
When there is a problem, then go to stage 3, which effectively manages access (it will completely
block the access).
In case monitoring, offer a list of users who have access and pinpoint users who have done that and
who use the management access stage, it can be wiped out of the system.
P a g e | 12
Firewalls
As was suggested by the infrastructure. And the most appropriate firewall architectural style for this
scenario is a firewall that is multi-legged. The industry standard is a multi-legged firewall when two
different firewalls are external and internal networks and networks must be maintained for
commercial purposes. Public data transport would be offered to several companies in the case when
addressed in the case organizations, including the bank and the website for e-commerce. It is a big
safety issue for public web traffic that enters the internal networks of the organization. In order to
mitigate these risks, we can use the multi-legged. The architecture of the firewall will provide a
special segregated safe environment for the company's Internet services by controlling un-
recognized internet traffic.
This shielded region is referred to as the area of demilitarized territory (DMZ). DMZ will be hosting
several internet services, including virtual machines, secret emails, e-commerce, terminal servers,
your computers, etc. Next, all incoming traffic to the firewall must be acknowledged and moved by
the router. And the, the gateway filters and, as needed, transfers traffic to one of the two private
networks. Multiple-legged as the databases can be moved to and from the DMZ, the firewall is a
very flexible system as required. As routes and packets can help protect the DMZ infrastructure, the
firewall can also help as stated in the policy package, it should be prevented.
We used firewalls of the next century along sub-network in this case and cooperate office.
P a g e | 13
What is next-generation firewall?
The third-generation firewall technology includes a next-generation firewall (NGFW) integrating a
traditional firewall with other filtering features for the network interface, such as an using in-line deep
packet inspection (DPI) and an intrusion protection framework firewall System Engine (IPS).
Different forms of next form are used depending on the nature and scale of the company IT
department Next-generation firewall or NGFW generation firewalls allow better control and improved
visibility protecting organizations from possible cyber threats and data in all operational processes
and Robberies. The traditional firewall safeguards the entry and exit points of data. Nonetheless,
there are many Transactions between these two points that are equally susceptible to threats with
NGFW.
NGFW (next generation firewall) often provides a holistic view of the network, including network
traffic analytics, which helps organizations to also have a holistic view of the network, including
network traffic analytics, to set up controls at any point and to have full control over data coming in
and out and on devices that transmit data by avoiding persistent malware attacks, the process runs
smoothly.
Protection Procedure of hybrid cloud
We can use virtualization to provide the cloud system with more protection by buying Cloud and
Data using form 2 hypervisor para-virtualization Para virtualization enables host operating systems
to run multiple guest operating systems When interacting for performance enhancement with the
hypervisor.
The Type 2 Hypervisor operates on an operating system similar to other computer programs. But
on host hardware, type one runs directly (bare metal). We will use the base operating system for
Linux, This provides the computing environment with only the requisite operating system and
hardware.
PCI – DSS
Industry Data Protection Payment Card was designed to promote and optimize data security for
Cardholders and to boost the quality of data security overall. This facilitates the large adoption of
Data security controls that are reliable. This refers to all companies and service providers that
gather, collect, Pass or store data for cardholders. All purchases of the aforementioned data would
also comply with the PCI DSS in order to have a legal role in the event of a data breach and to
comply with the data this requirement would only contribute to the smooth growth of the business
without financial fines or even removal from the card payment accepting service.
P a g e | 14
Public Key Encryption
Public key encryption is known as public key cryptography, a type of cryptographic design that
Encrypt and decrypt data using two keys or a key pair. A mutual key is one of the two keys that
anyone may use a message to encrypt the owner of the key. The encrypted message is received,
and the message is sent a private key is used by the receiver to decrypt it. This is the justification
for the public key to be secured.
This encryption method is considered very safe since it does not require a common secret key.
Between the sender and the beneficiary. Several security systems that all use a common mutual
key Data encryption and decryption rely on both sides to settle on a key ahead of time without other
details. Parties who find out what the secret is. Nonetheless, the notion that it must be shared
amongst the door for third parties to acquire the key is opened by two parties. This kind of system
of encryption Symmetric encryption is known, while asymmetric encryption is called public key
encryption.
P a g e | 15
Bibliography
Bullguard, 2020 - Bullguard. [Online]
Available at: [Link]
security/computerthreats/malware-definition,-[Link]