Security
docx
School
Centennial College *
*We aren’t endorsed by this school
Course
704
Subject
Information Systems
Date
Dec 6, 2023
Type
docx
Pages
4
Uploaded by CountApePerson979
Domain 5: Security Operations
1.
Provide high-level explanation for symmetric vs asymmetric encryption. What is hashing?
Ans:
Symmetric Encryption:
This is also known as Private key cryptography or private key-
encryption. In this encryption, the same secret key is used for both encryption and decryption.
As the same key is used for encryption and decryption, this key is shared between both sender
and recipient. Some examples of symmetric or private key encryption are: AES (Advance Encryption Standard): This algorithm uses a Substitution-permutation Network (SPN) structure. This algorithm uses
fixed sizes of key and number of rounds of substitution and permutation. i.e., 10 rounds for 128
bits key ,12 rounds for 192 bits key and 14 rounds for 256-bit keys. DES Encryption:
Acronym is Data Encryption Standard. This uses a small key size i.e., 56-bit key
size which is smaller than AES algorithm. This algorithm consists of total of 16 rounds where in
each rounds the right half of the data undergoes series of operation including permutation
followed by substitution through a S-Box and key mixing with a subkey derived from a main key.
At last, the result obtained is combined with the left half of the data. This process for each round
is repeated creating a complex interaction of permutation and substitution until 16 round and
the result then obtained is a cipher text. Due to the small key size, this encryption is vulnerable
to Brute Force attack and more insecure than other algorithms that use a larger key-size.
Double DES:
This algorithm is a more advanced version of the DES algorithm using two
successive DES encryption using different key pairs. The basic working mechanism of this
algorithm is to encrypt the cipher text obtained from DES algorithm with different keys.
Technically,
Ciphertext = DES key2
(DES key1
(Plaintext)).
Asymmetric Key algorithm:
This is also known as the public key Encryption or Public Key Cryptography.
The basic idea behind this algorithm is to use two different keys for encryption and decryption. Let us say
we want to transmit the data from sender to recipient. Let’s say the Sender is Alice and Receiver is Bob.
Each of these must key pairs one is public key, and another is private key. Let’s say Alice wants to send a
message to a bob, so he encrypts the message with his private key using some asymmetric encryption
algorithm and on the sender side bob uses his public key to decrypt the message. Similarly, when Bob
wants to send a message to an Alice, he will encrypt the message using his private key and uses some
asymmetric encryption and on the receiver side (Alice) uses his public key to decrypt the message. Here
Public keys are known to each other, but private keys are secret. This idea of encryption ensures
Authentication and non-repudiation. Some of the Asymmetric encryption algorithms are RSA (Rivest-
Shamir algorithm, DSA (Digital Signature Algorithm), Elgamal curve cryptography (ECC), Diffie -Hellman
(DH).
Hashing:
The input text is passed through some hashing algorithm to get a message digest or hash.
This hash value is a unique representation of the input data that even a small change in the input
generates a significant difference in the output. Hash functions or hash algorithms are generally used
to ensure that data remains unaltered throughout the transmission. There are different types of
hashing algorithms. Some of them are: MD2, MD5, SHA -1, SHA-2, SHA -512 and so on.
2.
What are the phases of data lifecycle management?
Ans: the phases of data life cycle management follow 6 stages:
create
: This is the initial phase of the data life cycle which involves the creation of the data either
by any applications or by users as well as obtained from any external sources such as social
media, satellite, consumer transactions. Store
: Once data is created it must be stored securely for it will be accessible in future near
future. Some of the concerns that should be in mind while storing data may include the place to
store data. Performance cost and data regulatory compliance Use:
Once the data is stored it may be used to generate useful information. Main aim of the data
storage is to find some association along with the data that may help to deduce some reasoning
to solve some problem or to promote innovation.
Share:
Another stage of the data life cycle is the sharing of data to multiple users’ organization as
well as across different topography. Some of the considerations like access controls, /encryption
algorithm as well secure transmission medium are to be noted to transfer data to intended
recipient with no violation of confidentiality. integrity and availability. Archive:
This phase includes storing data which is not used actively but may be useful in some
cases. Data archiving reduces data storage costs and increases active data streamlining
efficiency.
Destroy:
Once data is of no use and doesn’t have any information that an organization needs, it
needs to be disposed of. We must be very careful while disposing of data because it is no longer
in use but may have some valuable information by which malicious intruders can harm an
organization.
3.
What steps would you follow for system hardening?
Ans: The steps to be followed for system hardening are as follows:
Identification:
This is the initial stage of the system hardening where a security professional
identifies all the configuration and documents all the configuration items like software,
hardware, and any other critical components within the system. Baseline:
Next steps include maintaining a baseline while building the secure system. This
baseline may include user account policies i.e., enforcing strong password policies and access
controls policies. similarly, other baseline policies may include access controls, firewall
configuration, logging and auditing, encryption algorithms, OS update policies and so on Change Control:
This stage consists of bringing changes to the pre-existing system for its better
security. This stage includes various aspects like requesting the change. evaluating the impact of
the changes made, documentation of all evaluation, justification, and clarification that the
change is inevitable as well as approval of the change control. This also includes a roll back policy
to reboot the system to legacy mode in case of any change failure occurs within a system.
Verification and audits: This is the final stage of the system hardening where each and all
baseline policies change controls policies are justified and they are audited, to insure all the
security hardening policies are effectively implemented without any violation of the data
protection policy act meeting all required legal compliance. 4.
Provide a summary of Acceptable Use policy (AUP), Bring your own device (BYOD) policy,
change management policy.
Ans: Accept Use of Policy
: This is a rule and regulation that governs the proper use of IT
resources of an organization. This defines acceptable and prohibited activities and define
consequence for any violation if the organizations accept and use policy of its infrastructure and
resources are being violated. This might include prohibiting the employee from using their
resources for personal use. For example: an employee is allowed to send and receive emails
related to organizational purpose from the it premises of an organization while on the other
hand they are prohibited to use email of an organization for personal purpose like products
promotion or selling personal items. This ensures that the company’s email system remains
within the organizational personnel, reducing the risk of external unauthorized access or
inappropriate usage. Bring Your Own Device Policy:
This policy is another data security ensuring policy that almost all
organizations need to adapt. This policy defines that the personal device that an employee use
to access the organizational documents as well as used to accomplish the organizational task
must be registered with in the organizational device acceptance policy such as the device must
have a screen lock such as pin password or biometrics authentication and so on. For example, an
employee who brings his/her personal device to a workplace to perform organizational task may
misplaced or lost device and his/her device is secure by screen locks or requires biometric
authentication to access the device, this will help to reduce the access of the device. This simple
measure helps to mitigate the data security risks associated to the organization even if a
personal device is compromised.
5.
What benefits (provide a list) would you receive from Security Awareness training?
Ans:
Security Awareness training provides profound benefits to people. Some of them can be
listed as following: Endpoint Security:
Security Awareness training helps to aware employees about importance of
keeping their devices secure through regular software updates, anti-virus protection as well as
the use of firewalls. Phishing Prevention
: This helps employees to defend against Phishing attacks as security
awareness training helps individuals to recognize the phishing malicious emails and malicious
hyperlinks and social engineering making less vulnerable to such attacks. Password Management
: This also helps individuals to know more about password policies and
standards to be followed while setting passwords to their account. Furthermore, this also helps
them to know how to create strong passwords, avoiding sharing passwords and regular
updating.
Continual Improvement
: As security awareness is an ongoing process this helps employees to
understand evolving cyber-attacks and ways to prevent as well as mitigate those attacks in their
everyday life.
Protect against insider Threats
: As security awareness program is a designed to make employee
more conscious about the potential threat and risk in their workplace environment, they
become less susceptible to such threats posed by their contractors, colleague, and other
individuals.
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help