Reference no: EM132525872

MN502 Security in Networked Systems - Melbourne Institute of Technology

Purpose

LO1. Explain the major methodologies for secure networks and what threats they address;
LO2. Identify and report network threats, select and implement appropriate countermeasures for network security.

Assignment Description

Blue Ridge Consulting Services (BRCS) provides security consulting and services to over 1000 clients across a wide range of enterprises in Australia. A new initiative at BRCS is for its two offices in Sydney and Melbourne to provide internships to groups of students who are pursuing their postgraduate studies in reputed institutes in Sydney and Melbourne in the Networking and Cyber Security domains.

Student groups are required to demonstrate outstanding writing and presentation skills about thier theoretical as well as practical knowledge related to information security. Further, groups must demonstrate excellent teamwork and collaboration skills.

To evaluate suitable candidates/groups for this prestigious internship program, BRCS has advised student groups from multiple institutes to prepare a detailed report and a video demonstration of two penetration tools. Detailed description of these two parts is given in following sections.

Section I: Report (2500-3000 Words)
The report must include following sections:

A. Preventing Vishing Attacks (700 Words)
Vishing, or voice phishing, continues to increase as an attack against users. What would you do to help prevent users from becoming victims? First, access the online SoundCloud repository by NumberCop that contains five different recordings for vishing attacks. After listening to several of the recordings, based on your analysis address following:

1. What attackers typically ask and how they craft their attacks?
2. What messages do the attacker commonly use?
3. How do they trick users into entering the information?
4. Write your recommendations that would help users resist these attacks.

B. Block Cipher Modes of Operations (700 Words)
A block cipher manipulates an entire block of plaintext at one time. Block cipher mode of operation specifies how block ciphers should handle these blocks. Most common modes are Electronic Code Book (ECB), Cipher Block Chaining (CBC), Counter (CTR), and Galois/Counter (GCM). Research block cipher modes of operation. Based on your research and analysis

1. Explain the working mechanism of ECB. How ECB can be compromised.
2. Discuss in detail two modes of operation (CBC, CRT, and GCM). With the help of diagrams, explain how these modes convert plaintext into ciphertext.
3. Which mode would you recommend for encryption? Justify your recommendation.

C. Terminal Access Control Access Control Systems (700 Words)
A user accessing a computer system must present credentials or identification when logging in to the system. Different services can be used to provide identity and access services. Terminal Access Control Access Control Systems+ (TACACS+) is one such important service.

1. With the help of a diagram, discuss how does TACACS+ work?
2. In what settings it is most likely to be found? How widespread is its usage?
3. What are its advantages and disadvantages?
4. When would you recommend using TACACS+ over Kerberos? Justify your recommendation by comparing different features supported by both services.

D. Cyber Physical System: Smart Grid (700 Words)
Smart Grid is one of the Cyber Physical System technologies, which develops and implements measurement science underpinning modernisation of the Nation's electrical power system (electric grid) in order to improve system efficiency, reliability and sustainability, by incorporating distributed intelligence, bi-directional communications and power flows, and additional advancements. Based on your research

1. Discuss smart Grid network architecture (System Component and Network Components), Recent developments in Smart Grid networks.
2. Analyse the importance of cybersecurity in Smart Grid networks
3. Analyse critically, two current or possible future security issues in Smart Grid networks.
4. Propose a possible solution for one of the threats identified

E. References
Must consider at least 10 current references from journal/conference papers and books. Must follow IEEE style.

Section II: Video Demonstration (5-7 Minutes)
A Penetration testing, also called pen testing or ethical hacking, is a mechanism of testing a computer system, network or web application to determine security vulnerabilities that an attacker could exploit. Burp Suite and OWASP Zed Attack Proxy (ZAP) are two penetration testing tools for web applications having similar features.

As a team of four, create a 5-7 minutes video demo using Zoom application (along with presenters' video) addressing following tasks.

1. Analyse and compare features of these tools.
2. Download and install each selected tool on your personal /lab computer using Virtual machine (Kali Linux /Windows) in Virtual Box. Perform and explain penetration testing against two vulnerable web applications.
3. Which tool among these two would you recommend? Justify your recommendation.

Note: NEED TO USE 2 PENETRAION TOOLS

Attachment:- Security in Networked Systems.rar