FACULTY OF NATURAL SCIENCE, INFORMATION AND COMMUNICATION

TECHNOLOGY

DEPARTMENT: COMPUTER SCIENCE

COURSE TITLE: SYSTEM ANALYSIS & DESIGN

COURSE CODE: CSC 312

COURSE INSTRUCTOR: GEORGE LAWRENCE

NATURE OF WORK: Group work (no.19)

NAME OF STUDENT STUDENT ID

ALVIN HENRY T/DEG/2022/0265

MICHEAL ENOCK BENEDICT T/DEG/2022/0183

ANGELINA SAMWEL T/DEG/2022/1295

EDWARD EMMANUEL T/DEG/2022/1398

Question 1
a. What is Spoofing?
Spoofing is a type of cyberattack in which an attacker disguises
themselves as a legitimate or trusted source to deceive systems,
applications, or users. It involves falsifying data to gain unauthorized
access, manipulate communication , or steal information.

b. Types of Spoofing

I. IP Spoofing
 Security Breach Description
The attacker sends IP packets with a forged source IP address,
making it appear as though the packet is from a trusted host.
This is used in Dos attacks, man-in-the-middle attacks, and to
bypass IP-based authentication.

 OSI Model Layer:

IP Spoofing is a Network Layer Attack conducted in the
layer3(Network Layer)

 How the Attack Works:

The attacker Identifies the IP address of a trusted system using
tools to modify the source address in the packet header to make
the receiving computer system think the packet is from a trusted
source. When the target system receives and trusts the packet,
Attacker may inject malicious content or establish unauthorized
sessions.
  Countermeasures:
By using Ingress Filtering you can configure routers and firewalls
to reject packets that appear to originate from inside your
network but are actually coming from outside.

We can also use Egress Filtering by blocking outgoing packets for

inconsistencies, such as conflicting source address information,
and block suspicious traffic.

Implement robust authentication methods for remote access,

such as multi-factor authentication(MFA).

Use Antivirus software to scan and remove malicious code. Also

employ firewalls to monitor and block suspicious network traffic.

II. Email Spoofing

 Security breach Description:
Attacker sends emails that appear to originate from a trusted
source by forging sender fields in the email header. Used in
phishing and spam campaigns.
  OSI Model Layer:
Email Spoofing is an application layer attack conducted in
Layer7(Application Layer).

 How the Attack Works:

Attacker manipulate email headers to make a message appear as
if it originated from a different sender, misleading recipients into
trusting the email’s authenticity and potentially revealing
sensitive information
 Countermeasures:
Implement Email Authentication Protocols such as Sender Policy
Framework(SPF), DKIM, and DMARC. These protocols verify the
sender’s identity and help spoofed emails from reaching your
inbox.

Utilize Email Filtering and Spam detection tools to block or flag

potentially harmful emails.

Analyze and block IP Packets with conflicting source information

to prevent IP Spoofing.

Teach users to recognize suspicious emails, avoid clicking on links

and opening attachments, and look for red flags like urgent
requests for information on poor grammar and spelling in
suspicious emails.

III. Web Spoofing

 Security Breach Description:
 A fake or cloned website is created that looks identical to a
legitimate one. Victims enter credentials or sensitive data, which
is then captured by the attacker.

 OSI Model Layer:

Web Spoofing is an Application Layer Attack conducted in
Layer7(Application Layer)

 How the Attack works:

The Attacker creates a fake website(often via typosquatting or
email links).
The User/ Victim visits the fake site, thinking it’s legitimate.
The Attacker waits for the victim to input credentials or sensitive
information in order to collect the data or inject malware.

 Countermeasures:
Use Hyper-Text Transfer Protocol Security(HTTPS) and check for
SSL certificates before proceeding.

Control Web Spoofing by employing browser –based anti-

phishing warnings.

Train or Teach users to verify Unified resource Locators(URLs)

and avoid suspicious links.
Question 2
a. Routing(RIP) Attack

 Security Breach
The attacker sends false routing updates to manipulate the
network’s Routing Information Protocol (RIP) table, diverting or
blackholing traffic.

 OSI Layer:
This is a Routing Manipulation attack conducted in
layer3(Network Layer).

 How it Works:
Attackers craft fake RIP response messages containing malicious
routing information such as routes to nonexistent or attacker
controlled destinations.
These messages are sent to routers within the target network,
often targeting specific routers or using a multicast address.
Routers assuming the authenticity of the message, update their
routing tables with the malicious entries. When a packet arrives
at a router with the malicious routing table. It’s forwarded to the
attacker’s specified next hop. Effectively redirecting traffic.
  Countermeasures:
To counter Routing Information Protocol(RIP) attacks, implement
security measures like RIPv2 with MD5 authentication which
verifies the integrity of RIP packets and prevents unauthorized
routers from sending false updates. This requires configuring
password on the RIP interfaces.

b. ICMP Attack
 Security Breach:
ICMP Attacks exploits ICMP for reconnaissance (ping sweeps) or
disruption (ICMP flood)

 OSI Layer:
ICMP Attack is a denial of service/ reconnaissance attack
conducted in Layer 3 (Network Layer)

 How it works:
This is a common distributed denial-of-service (DDos) attack
where the attacker tries to overwhelm a server or network
device with Internet Control Message Protocol (ICMP) pings, or
echo request packets leaving network resources exhausted or
systems crash.

 Countermeasures:
 To counter ICMP attacks, organizations should implement a
layered approach, including monitoring for high traffic volumes
on the network which can indicate an ongoing attack.

Use Rate limiting to Control ICMP packet processing by allowing

network administrators to restrict the number of ICMP packets
processed per second, preventing overloading the network.

Configuring Firewalls to restrict ICMP traffic from untrusted or

malicious IP addresses. Firewalls can be set to limit the number
of ICMP packets allowed to pass through.

c. Ping Flood (ICMP Flood)

 Security Breach:
Ping Flood overwhelms a system with ICMP Echo Requests to
exhaust resources.
  OSI Layer:
Ping flood is a denial-of-service attack conducted in Layer 3
(Network Layer).

 How it Works:
In a Ping flood attack, the attacker uses multiple compromised
systems to send a huge volume of ICMP echo requests to the
target. These echo request packets are sent to the broadcast IP
address [Link], which allows them to be delivered to
all connected devices.
The target spends resources replying whereby the system
becomes unresponsive.

 Countermeasures:
Ping flood attack can be mitigated by setting rate limits for
processing incoming ICMP messages or limiting the allowed size
of the ping requests.
Intrusion detection systems (IDS) can monitor network traffic
and identify potential attacks in real time.

d. Packet Sniffing

 Security Breach:
 Packet Sniffing Captures unencrypted data travelling across the
network.

 OSI Layer:
This is an Eavesdropping attack conducted in Layer 2 (Data link
Layer).
 How it Works:
Packet sniffing involves intercepting and analyzing data packets
as they travel across a network.
Packet sniffers use Sniffer software such as “Wireshark” to
capture data. Once captured, packets can be filtered and
analyzed based on various criteria like protocols,
source/destination addresses, and ports.

 Countermeasures:
To counter packet sniffing which involves eavesdropping on
network traffic, implement strong security measures like
encryption such as HTTPS which ensures all websites you visit
are encrypted.
For email and other secure connections, use protocols like
SSL/TLS which provide encryption.
Secure network protocols by being cautious about connecting to
public Wi-Fi networks, as they often lack strong security
measures and are vulnerable to sniffing.
e. Denial of Service in Transport Layer
 Security Breach:
Overloads services by exploiting TCP or UDP protocols.

 OSI Layer:
This is a Dos attack conducted in Layer 4 (Transport Layer)

 How it Works:
Attacker floods server with connection requests (TCP) or Junk
data (UDP).
The Server resources get exhausted.
 Countermeasures:
To counter Dos attacks at the transport layer(TCP/UDP).
You can implement techniques like rate limiting which
involves setting limits on the number of requests or
connections a server can handle within a specific
timeframe, preventing attackers from overwhelming
the system with excessive traffic.

Implement Bandwidth Limitation to help restrict the amount

of traffic a server or network can receive, making it harder for
attackers to flood the system.

Content delivery Networks (CDNs) is another technique that

distributes content across multiple servers geographically,
reducing the load on any single server and making it harder for
attackers to target a specific server.
f. Session Hijacking
 Security Breach:
In Session Hijacking the Attacker takes over a legitimate user’s
session.

 OSI Layer:
Session Hijacking is a man-in-the-middle attack conducted in
Layer 4 and 7 (Transport and Application Layers).

 How it Works:
Session Hijacking involves an attacker using captured, brute
forced or reverse-engineered session IDs to seize control of a
legitimate user’s session while that session is still in progress.

 Countermeasures:
To counter session hijacking, implement strong authentication
methods like Two-Factor Authentication(2FA) which adds an
extra layer of security beyond usernames and passwords, making
it significantly harder for attackers to access accounts even if
they steal a session.

Securely manage session identifiers by using strong, random and

unpredictable session identifiers (like session tokens) and ensure
they are securely stored and transmitted.

Enforce secure protocols like HTTPS by encrypting all web traffic

with TLS/SSL to protect data from interception. Also with the use
of VPNs, protect network traffic on unsecured networks like
public Wi-Fi
g. TCP Connection Spoofing
 Security Breach:
Attacker fakes a TCP session with a trusted system.

 OSI Layer:
This is an injection attack conducted in Layer 4 (Transport Layer).

 How it Works:
Attacker can intercept or modify the SYN, SYN-ACK, or ACK
packets to trick the client or the server into believing that they
are communicating with a legitimate party, while in fact they are
sending data to the attacker.

 Countermeasures:
To counter TCP Connection Spoofing, employ strong
authentication methods which verify identities rigorously, going
beyond IP addresses alone.

Implement encryption protocols like SSL/TLS or IPSec to protect

data in transit.

Leverage packet filtering with deep packet inspection by

analyzing packets for anomalies and conflicting source
information.
h. Distributed Denial-of-Service (DDoS)
 Security Breach:
Coordinated attack from many systems (botnets) to flood and
crash a target.

 OSI Layer:
This is a Network-wide DoS Attack conducted in Layer 3 and 7
(Network and Application Layers) depending on vector.

 How it Works:
A DDoS attack works by overwhelming a target, like a website,
with a flood of malicious traffic from multiple sources, causing it
to become unavailable to legitimate users.

Attackers achieve this by using a botnet, a network of

compromised devices, to send requests or packets to the target,
consuming its resources and bandwidth.

 Countermeasures:
Counteracting DDoS attacks involves combining preventative
measures and reactive mitigation strategies such as hardening
the network perimeter security by regular update and patch
network systems, implement firewalls, and enhance network
redundancy to distribute resources and avoid single points of
failure.

Educate employees about DDoS attack signs, response measures,

and the importance of good cyber hygiene practices, such as
changing passwords and avoiding phishing attacks.
i. TCP SYN Flooding
 Security Breach:
Exploits the TCP 3-way handshake by sending many SYN requests
and not responding to SYN-ACK.

 OSI Layer:
This is a Dos Attack conducted in Layer 4 (Transport Layer)

 How it Works:
A TCP SYN flood exploits the TCP handshake by sending a
massive number of SYN (Synchronize) requests without
completing the handshake thus never sending the final ACK
(Acknowledgement). This overwhelming flood of SYN requests
binds server resources, preventing legitimate connections from
being established.

 Countermeasures:
 Several strategies can be employed such as using tools like SYN
cookies or SYN caches whereby SYN cookies send back a SYN-
ACK response without allocating any resources for the
connection.

SYN caches store smaller amounts of information about

incoming SYN requests in a cache, conserving server resources
and preventing resource exhaustion.

Limit the number of half-open connections by setting a threshold

for the number of incomplete connections allowed, preventing
the server from being flooded with half-open TCP connections.

QUESTION 3

a. Types of Vulnerabilities in the Transport Layer

The Transport Layer (Layer 4 of the OSI model) is responsible for end-to-end
communication, error handling, and reliable data transmission. Common
vulnerabilities include:

1. TCP SYN Flooding

Exploits the TCP handshake by sending numerous SYN requests and not
completing the connection.

2. TCP Session Hijacking

An attacker takes control of an ongoing TCP session by predicting the
sequence number and injecting data.

3. TCP Connection Spoofing

Involves faking a TCP connection by predicting sequence numbers and
pretending to be a trusted source.

4. UDP Flooding
Because UDP is connectionless and doesn’t require a handshake, it can be
exploited to flood systems with data.

5. Port Scanning
Attackers probe systems for open ports, revealing active services that might
be exploitable.
6. Reset (RST) Attacks
Attacker sends spoofed RST packets to terminate active TCP connections.

7. Man-in-the-Middle (MitM)
Without encryption, attackers can intercept and alter TCP packets in transit.

QUESTION 4

Denial of Service (DoS) Attack – Overview

A Denial of Service (DoS) attack is an attempt to make a machine, network,

or service unavailable by overwhelming it with a flood of illegitimate traffic
or exploiting system vulnerabilities. The goal is to exhaust system resources
(CPU, memory, bandwidth), crash services, or make them unreachable.

Category: Network/Transport/Application Layer Attacks

OSI Layer: Typically affects Layer 3 (Network) and Layer 4 (Transport); some
extend to Layer 7 (Application).

Types: Protocol-based, volume-based, and application-layer DoS attacks.

Types of DoS Attacks:

a. Ping of Death

Description:
Sends ICMP packets larger than 65,535 bytes (normal max). These are
fragmented and reassembled by the target, which causes buffer overflow or
crashes.

Category: Protocol Exploit

OSI Layer: Layer 3 – Network Layer

Countermeasures:

Modern OS patches (Windows/Linux now drop oversized ICMP).

Network firewalls block abnormal ICMP traffic.

b. SSPing

Description:
Variant of Ping of Death specifically affecting older versions of Microsoft
Windows. It crashes the system with malformed ICMP packets.

Category: Protocol Exploit

OSI Layer: Layer 3 – Network Layer

Countermeasures:

Patch and update Windows systems.

Disable ICMP or filter with firewalls.

c. Land Attack

Description:
Sends spoofed TCP packets where the source and destination IP and port are
the same. This confuses the system, causing it to crash or become unstable.

Category: Malformed Packet / DoS

OSI Layer: Layer 4 – Transport Layer

Countermeasures:

Apply OS-level patches.

Configure routers/firewalls to detect and drop identical source/destination
packets.

d. Smurf Attack

Description:
Attacker sends ICMP Echo Requests to a network’s broadcast address,
spoofing the victim’s IP. All devices reply to the victim, flooding it.

Category: Amplification Attack

OSI Layer: Layer 3 – Network Layer

Countermeasures:

Disable directed broadcast on routers.

Use ingress filtering to block spoofed packets.

e. SYN Flood

Description:
Exploits TCP’s three-way handshake by sending numerous SYN packets and
never completing the connection (no ACK), leading to exhaustion of server
resources.

Category: Transport DoS

OSI Layer: Layer 4 – Transport Layer

Countermeasures:

SYN cookies.

Firewall rate-limiting.

Shorter timeouts for half-open connections.

f. Microsoft Incomplete TCP/IP Packet Vulnerability

Description:
Exploits how Windows handles fragmented IP packets. Malformed or
incomplete packets can cause memory issues or crashes.

Category: Protocol Exploit

OSI Layer: Layer 3/4 – Network/Transport Layer

Countermeasures:

Apply Microsoft security updates.

Deep packet inspection on firewalls or IDS.

Each of these attacks aims to consume resources, crash services, or exploit
protocol flaws, and mitigation often requires firewalls, updated systems,
rate-limiting, and network hygiene.

QUESTION 5
Password Attacks
Password attacks are methods used by attackers to gain unauthorized access
to systems or user accounts by cracking or stealing passwords. These attacks
exploit weak passwords, user behavior, or system vulnerabilities.

a. Dictionary Attack

Description:
Tries a predefined list of common or likely passwords (e.g., "123456",
"password", "letmein").

How it Works:

1. Attacker obtains a list of usernames or login interfaces.

2. A tool is used to test passwords from a "dictionary" file.

3. If the password is weak or commonly used, access is gained.

Category: Brute-force variant

OSI Layer: Layer 7 – Application Layer

Countermeasures:

Enforce strong password policies.

Implement account lockout mechanisms.

Use CAPTCHA to prevent automated tools.

b. Brute Force Attack

Description:
Attempts every possible password combination until the correct one is
found.

How it Works:

1. Attacker sets a character set (letters, numbers, symbols).

2. Automatically tests every permutation.

3. Cracks the password if processing power and time allow.

Category: Exhaustive Search

OSI Layer: Layer 7 – Application Layer

Countermeasures:

Multi-Factor Authentication (MFA).

Rate-limiting and login attempt monitoring.

Use of complex passwords.

c. Hybrid Attack

Description:
Combines dictionary and brute force by modifying dictionary words (e.g.,
“password1!”, “admin123”).

How it Works:

1. Uses a base word list.

2. Appends or substitutes characters (e.g., “e” → “3”, “i” → “1”).

3. Increases the probability of cracking passwords based on human

tendencies.

Category: Intelligent brute-force

OSI Layer: Layer 7 – Application Layer

Countermeasures:

Encourage the use of password generators.

Prevent common substitutions using password blacklists.

d. Social Engineering
Description:

Tricks people into revealing their passwords or other sensitive information.

How it Works:

1. Attacker impersonates a trusted individual or entity.

2. May use phishing emails, calls, or in-person requests.

3. Victim willingly gives up their credentials.

Category: Human-based attack

OSI Layer: Outside OSI (Human Layer)

Countermeasures:

User awareness and training.

Verification of unusual requests.

Simulated phishing tests.

e. Shoulder Surfing
Description:

Physically observes someone typing their password (directly or through

surveillance).

How it Works:

1. Attacker stands near or uses a camera to record.

2. Watches keyboard or screen to deduce the password.

Category: Physical Attack

OSI Layer: Outside OSI (Physical Interaction)

Countermeasures:

Use privacy screens.

Educate users on situational awareness.

Biometric authentication (e.g., fingerprint, face ID).

f. Dumpster Diving

Description:

Searches physical trash for paper notes, discarded devices, or printouts that
contain passwords or sensitive data.

How it Works:

1. Attacker checks trash bins or recycling near offices.

2. Collects written credentials or login info from documents.

Category: Physical / Social Engineering

OSI Layer: Outside OSI (Physical)

Countermeasures:

Shred documents before disposal.

Enforce clean desk and secure disposal policies.

Use locked shredding bins.

Password attacks can be prevented by combining technical measures (MFA,
account lockouts) with user education and physical security practices.

QUESTION 6

Common Web Application Attacks

These attacks target the Application Layer (Layer 7) of the OSI model,
exploiting flaws in web forms, URLs, scripts, and backend logic to
compromise security. They can lead to data theft, unauthorized access, or
server compromise.

a. Cross-Site Scripting (XSS)

Description:
XSS allows attackers to inject malicious JavaScript into websites, which is
then executed in the browsers of users visiting the affected pages.

Category: Code Injection / Client-Side Exploit

OSI Layer: Layer 7 – Application Layer

How It Works:

1. Attacker injects malicious script (e.g., <script>alert('XSS')</script>) into an

input field or URL.

2. Web app reflects or stores this input without sanitization.

3. When another user visits the page, the script runs in their browser.

Requirements:

Vulnerable input field (search bar, comment box).

Lack of input/output encoding.

Countermeasures:

Sanitize and encode user input/output.

Implement Content Security Policy (CSP).

Use frameworks that auto-sanitize (e.g., React, Angular).

b. SQL Injection (SQLi)

Description:
SQL injection exploits web apps by inserting malicious SQL queries into input
fields to manipulate the underlying database.

Category: Server-side Injection

OSI Layer: Layer 7 – Application Layer

How It Works:

1. Attacker types SQL code into a form input (e.g., ' OR 1=1 --).

2. The application concatenates this into a backend query.

3. Results in data exposure, unauthorized access, or data deletion.

Requirements:

Vulnerable database query using unsanitized input.

Poor coding practices (e.g., dynamic SQL).

Countermeasures:

Use parameterized queries / prepared statements.

Validate and sanitize input.

Apply least privilege to database accounts.

c. XML Injection

Description:
Manipulates XML data sent to the server to access unauthorized information
or disrupt application logic.

Category: Input Injection / Data Manipulation

OSI Layer: Layer 7 – Application Layer

How It Works:

1. Attacker injects malicious XML tags or attributes.

2. XML parser misinterprets or processes the input incorrectly.

3. This can result in privilege escalation, data corruption, or information

disclosure.
Requirements:

Application must parse and process XML from user input.

Poor input validation.

Countermeasures:

Use safe XML parsers.

Validate XML structure and schema.

Disable XML external entities (XXE) and DTD processing.

d. Command Injection / Directory Traversal

Description:
Executes unauthorized system-level commands or accesses restricted
directories/files on the server.

Category: OS Command Injection

OSI Layer: Layer 7 – Application Layer

How It Works:
Command Injection:
1. Attacker submits input like ; rm -rf / into a form or URL.

2. Web app includes that input in a system call (e.g., shell command).

3. Server executes malicious command.

Directory Traversal:

1. Input like ../../etc/passwd allows navigation outside the permitted

directory.

2. Sensitive system files are accessed or exposed.

Requirements:

Web app includes user input in file or system command paths.

Lack of input validation or path filtering.

Countermeasures:

Sanitize and whitelist input.

Use secure APIs that avoid shell execution (e.g., exec() alternatives).

Enforce least privilege for file and command execution.

Diagram to Include in Word/PPT:

Arrows showing input flow → vulnerable field → server execution → attack

impact.

General Prevention Tips for Web App Attacks:

Regular code reviews and penetration testing.

Input validation and output encoding.

Use of secure development frameworks.

Web Application Firewalls (WAFs).

User session security and authentication controls.

QUESTION 7

Security Models: Bell-LaPadula (BLP), Biba, and Clark-Wilson

Security models define rules and logic used to enforce data confidentiality,
integrity, and access control in secure systems. These models are crucial in
military, government, and commercial systems that require formal security
assurance.

a. Overview of the Bell-LaPadula (BLP) Model

Primary Focus:
Confidentiality – prevents unauthorized access to information.

Designed For:
U.S. Department of Defense to protect classified information.

Structure:
Subjects (users/processes) and Objects (files/databases) are assigned
security levels such as Top Secret > Secret > Confidential > Unclassified.

Enforced Rules:

Prevent data leaks from high to low security levels.

b. Details of the Bell-LaPadula Model

Key Properties:

1. Simple Security Property (No Read Up – “ss-property”)

A subject at a lower security level cannot read data from a higher level.
(E.g., an Unclassified user cannot read Secret documents.)

2. Star Property (No Write Down – “*-property”)

A subject at a higher level cannot write to a lower level.
(Prevents accidental leaks from Top Secret to Confidential.)

3. Strong Star Property

A subject can read/write only at its exact security level.

Example Scenario:
A user with "Secret" clearance can read "Secret" and "Unclassified"
documents (no read up), but cannot write to "Unclassified" (no write down).
c. Analysis of the Bell-LaPadula Model

Strengths:

Strong protection of classified data.

Enforces strict confidentiality.

Ideal for military/government systems.

Weaknesses:

Does not protect data integrity.

Too rigid for dynamic or commercial environments.

Doesn't prevent insider threats who already have access.

d. More on Multi-Level Security (MLS)

MLS Systems:
Systems that handle multiple levels of classified data, ensuring users only
access what they are authorized for.

Purpose:
Enforce separation of duties and need-to-know access, often using models
like BLP.
Example:
A military server may store files at Confidential, Secret, and Top Secret levels
and ensure users only access their clearance level.

e. TCSEC and Common Criteria

1. TCSEC (Trusted Computer System Evaluation Criteria) – Orange Book

U.S. DoD standard.

Rates systems from D (Minimal Protection) to A1 (Verified Design).

Emphasizes access control, audit, and mandatory policies.

2. Common Criteria (ISO/IEC 15408)

International standard for IT security evaluation.

Uses EAL levels (1–7): Evaluation Assurance Level.

More flexible and adaptable than TCSEC.

f. Biba Integrity Model

Primary Focus:
Integrity – ensures data is not improperly modified.
Key Properties:

1. Simple Integrity Property (No Read Down)

Subjects can't read data at a lower integrity level.

2. Star Integrity Property (No Write Up)

Subjects can't write to higher integrity levels.

Goal:
Prevent low-trust users from contaminating high-trust data.

Example Use:
Banking and financial systems where accuracy of data is more critical than
secrecy.

g. Clark-Wilson Model and Chinese Wall Policy

Clark-Wilson Model

Focus: Commercial Integrity

Principles:

1. Well-formed Transactions – All access must be through controlled

programs.

2. Separation of Duties (SoD) – No single user can authorize and execute

critical tasks alone.

3. Access Triple – Users access data through programs, not directly.

Use Case:
Enforces data accuracy in banking, auditing, and inventory systems.

Chinese Wall Policy

Focus: Conflict of Interest Prevention

Purpose: Prevents a user (e.g., financial analyst) from accessing confidential

information about competing firms.

Mechanism:
If a user accesses Company A’s data, they are automatically denied access to
competitors (e.g., Company B) to maintain ethical boundaries.

Used In:
Investment banking, legal and consulting sectors.
These models are chosen based on whether the organization prioritizes
confidentiality (BLP), integrity (Biba, Clark-Wilson), or ethical barriers
(Chinese Wall).

b. Comparison: TCP SYN Spoofing vs. TCP Session Hijacking vs. TCP
Connection Spoofing

Prevention Techniques (for all three attacks):

1. SYN Cookies
Store partial connection state in the SYN-ACK, reducing memory use.

2. Transport Layer Encryption (TLS/SSL)

Prevents hijacking and eavesdropping by encrypting session traffic.

3. Randomized Sequence Numbers

Makes it harder for attackers to predict TCP states.

4. Session Token Security

Rotate tokens frequently and regenerate on login.

5. Firewalls and IDS/IPS

Detect and mitigate spoofed packets and connection anomalies

6. Connection Limits and Timeouts

Prevent systems from holding too many half-open connections.