Reference no: EM132468809

Overview

The objective of this assignment is for students to get familiar with the concepts in the Public-Key encryption and Public-Key Infrastructure (PKI), and Network Forensics.

This lab assignment covers the following learning outcome:
LO1: Identify and assess tools and techniques for cyber defence, network evidence acquisition and evidence handling.
LO2: Conduct network packet and network forensics analysis.
LO3: Critically discuss and evaluate evidence collection.
LO4: Research and report on security attacks, cyber defence techniques and tools.

Assignment description

Part A: Public-Key Infrastructure (PKI)

Consider the case where you are operating a Web server for e-commerce services. You need to secure the communication between the Web server and the clients, and you are considering using digital certificates to do so. You have been asked by the CEO to write a report to present the technology that is going to be utilized and potential implementation options.

You need to write a report (approx. 1500 words, not counting references section). Your report should have the following structure:

1. Introduction
a. Briefly discuss the objectives of the report.
b. Introduce the topic of cryptography in general and discuss why it is important.
c. Briefly discuss how asymmetric cryptography works. What are the benefits of asymmetric cryptography over symmetric?

2. Replay and pre-play attacks against PKI
a. Briefly discuss how dedicated replay and pre-play attacks work against PKI and controls against them.

3. Obtaining a digital certificate
Consider the case where you would like to obtain a digital certificate for your corporate Web server.
a. Discuss the two methods you can obtain a digital certificate.
b. What are the advantages and disadvantages of each method?

4. Digital signatures
a. Explain what a digital signature is and how it works.
b. Why are digital signatures useful?
c. Provide an example with appropriate screenshots to educate your organization's users on the importance of using digital signatures (Tip: Consider the Crypto - Public Key Infrastructure lab).

5. Conclusions
Conclude the report. Comment on the level of reassurance people tend to place on security technologies in terms of addressing security threats, whether you identify any potential risks and what are your recommendations to address them.

Part B: Network Forensics

Based on your report in Part A, the CEO of your organization was convinced to use digital certificates to secure the communication between the corporate Web server and the clients. However, due to clients' data compromisation that occurred, the IT team is proceeding with an investigation to identify how the data leak was caused and what systems were potentially compromised. As part of the auditing strategy, the organization is maintaining .pcap files of recent network activity so they can audit the network traffic at any given time, if required.

You are leading the investigation and you are provided with a .pcap file to analyse the network activity for malicious activities and report your findings to the IT administrator (approx. 1000 words, not counting references section). Your report should have the following structure:

1. Introduction
a. Introduce the topic of network forensics in general and discuss why it is important.
b. Briefly discuss the objectives of the report.

2. Tools and techniques used in the forensics investigation
Provide information about the tool(s)/technique(s) that were used to perform the network forensics investigation.

3. Network forensics analysis

a. Present the network forensics analysis results, briefly discussing any potential issues you may have identified.

b. Show evidence by providing screenshots and relevant description and analysis.

c. Provide recommendations.

4. Conclusions
Conclude the report, summarizing your main observations from the practical part and recommendations.

Attachment:- Public-Key Infrastructure.rar