Reference no: EM133543140
Assignment:
Topsecret is a cloud company with a mission to provide safe cloud storage. Topsecret provides a SAAS service which companies can buy different subscriptions in order to store documents in a secure environment. Picture 1 provides a snapshot of the architecture of Topsecret. Server S1 accepts remote connections from companies to access their files through firewall FW1. Picture 2 provides a sample of logs from S1 showing access to sensitive files.
With the help of the firewall FW2, we, as cyber security specialists, used a packet sniffer to capture some packets. Picture 3 shows high level description of these packets (traffic from Topsecret to outside). We have realized something suspicious happened. Someone was able to access a high confidential (ts1) file without proper authorization. The bad actor has tried hard to hide the digital fingerprint. As an information security specialist, you need to help Topsecret to understand the situation and find a solution. Topsecret.com corresponding IP address is 162.252.3.66.
Please answer the following questions based on the info provided:
1) Is it possible to identify whether the bad actor was an insider or outsider? Explain in details.
2) Is it possible to identify the IP address of the bad actor who has succeed to access the file "ts1"? explain in details.
3) Is it possible to identify the mechanism used by the bad actor to gain access to "ts1"? explain in details.
4) Which countermeasure could be applied here to prevent the same situation in the future. This countermeasure must be suitable to Topsecret normal activities (propose only the most important countermeasure). Justify your answer in details.
5) What is the most important security principle that you can propose to topsecret to increase the confidentiality of stored files? justify your answer in details.