Information Security

The primary goal of computer security is to protect information and systems by ensuring confidentiality, integrity and availability (the CIA triad) of data and resources against unauthorised access, modification or disruption.

An attack surface is the sum of all points (entry points, interfaces, ports, services, user inputs, devices and users) in a system where an unauthorised person can try to enter data into or extract data from the system. A smaller attack surface means lower risk.

Prime numbers are the basis of many public-key algorithms. For example, RSA multiplies two large primes to form the modulus $n = pq$; multiplying is easy but factorising $n$ back into $p$ and $q$ is computationally infeasible for large values. Primes are also used in Diffie-Hellman and ElGamal (modulus $p$ and primitive roots) and in finite-field arithmetic.

Symmetric cryptography uses the same single secret key for encryption and decryption (e.g. AES, DES); it is fast but requires safe key distribution. Asymmetric cryptography uses a pair of keys, a public key to encrypt and a private key to decrypt (e.g. RSA); it is slower but solves key distribution and supports digital signatures.

The primary purpose of a digital signature is to provide authentication, integrity and non-repudiation: it proves who sent a message or document and that it was not altered, so the signer cannot later deny it. It is created with the sender's private key and verified with the public key.

Two-factor authentication (2FA) requires two different kinds of proof of identity (for example a password plus a one-time code sent to a phone). Its purpose is to add a second layer of security so that an account stays protected even if the password is stolen or guessed.

An Intrusion Prevention System (IPS) is a network security device or software that monitors network traffic for malicious activity or policy violations and automatically takes action to stop it, such as blocking the traffic, dropping packets or resetting the connection, in addition to detecting and logging it.

A backdoor is a hidden method of bypassing normal authentication or security controls to gain access to a system, application or network. It may be built in by developers or installed by an attacker or malware (e.g. a remote access trojan) to allow later unauthorised access.

The primary purpose of a firewall is to control and filter incoming and outgoing network traffic according to security rules, acting as a barrier between a trusted internal network and untrusted networks such as the Internet, so that unauthorised access is blocked.

A security audit is essential because it systematically examines systems, policies and controls to find vulnerabilities and weaknesses before attackers exploit them, checks compliance with laws and standards, verifies that security controls work, and helps improve protection of data and reduce risk.

• Asset: anything of value to an organisation that must be protected, such as data, hardware, software, networks, and people. Example: a customer database.
• Threat: a potential danger or event that could exploit a vulnerability and harm an asset. It may or may not happen. Example: a hacker, malware, a power failure or a natural disaster.
• Attack: an actual deliberate attempt to exploit a vulnerability to damage, steal or gain unauthorised access to an asset. Example: a phishing campaign, SQL injection or a DoS attack.

In short, an asset is what is protected, a threat is what could cause harm, and an attack is the threat being carried out.

Substitution cipher: each plaintext letter (or group) is replaced by another letter, number or symbol, while the position of letters stays the same. Example (Caesar cipher, shift 3): HELLO becomes KHOOR.

Transposition cipher: the letters of the plaintext are kept the same but their positions are rearranged according to a rule. Example (rail fence with 2 rails): HELLO WORLD, written as zig-zag rows HLOOL and ELWRD, gives HLOOLELWRD.

Modern ciphers such as DES and AES combine both.

How it works

1. Enrolment: a sensor captures a physical or behavioural trait (fingerprint, face, iris, voice) and converts it into a digital template stored in a database.
2. Authentication: when the user tries to log in, the trait is scanned again, features are extracted, and the new sample is compared with the stored template.
3. Decision: if the match score is above a threshold, access is granted; otherwise it is denied.

Advantages over passwords, PINs and tokens

• Cannot be forgotten, lost or easily shared.
• Hard to steal or guess, since it is unique to each person.
• Convenient and fast (no need to remember or type anything).
• Provides stronger proof of identity and non-repudiation.

A number $g$ is a primitive root of a prime $p = 7$ if its powers modulo 7 generate all the numbers 1 to 6, i.e. the order of $g$ is $p - 1 = 6$.

$3^1 \bmod 7 = 3$ $3^2 = 9 \bmod 7 = 2$ $3^3 = 27 \bmod 7 = 6$ $3^4 = 81 \bmod 7 = 4$ $3^5 = 243 \bmod 7 = 5$ $3^6 = 729 \bmod 7 = 1$

The results 3, 2, 6, 4, 5, 1 are all distinct and cover every value from 1 to 6, and the first power giving 1 is $3^6$. Hence the order of 3 is 6, so 3 is a primitive root of 7.

A security audit trail is a chronological, tamper-resistant record of security-relevant events in a system, such as logins, failed logins, file access, privilege changes, configuration changes and transactions. Each entry normally records who did what, on which object, when, and with what result.

Role in tracking and analysing activity:

• Accountability: links every action to a user ID, so users cannot deny what they did (non-repudiation).
• Detection: reviewing logs reveals unusual patterns such as repeated failed logins or access at odd hours, which may indicate an intrusion.
• Reconstruction: after an incident, the trail shows how the attacker entered and what was changed or stolen.
• Evidence and compliance: supports forensic investigation, legal proceedings and regulatory audits.
• Deterrence: users who know their actions are logged are less likely to misuse the system.

Audit logs must be protected from modification and reviewed regularly, ideally with automated tools.

IT security management is the process of planning, implementing, monitoring and improving the controls that protect an organization's information assets. It covers security policies, risk assessment, selection of controls, staff training, incident response and regular review.

Role in the organization:

• Identifies assets, threats and vulnerabilities through risk analysis and ranks risks.
• Defines policies, standards and responsibilities so that everyone knows what is expected.
• Implements technical and administrative controls such as firewalls, access control, encryption, backups and awareness training.
• Monitors, audits and responds to incidents, then updates controls.

Impact on overall security: it gives a consistent, organization-wide approach, reduces the likelihood and cost of breaches, protects confidentiality, integrity and availability, ensures legal compliance and builds customer trust.

Stream cipher vs block cipher

Rail fence encryption (4 rails)

Plaintext without spaces: SECURITYISIMPORTANTFOREVERYONE

Writing letters in a zigzag over 4 rails and reading rail by rail:

• Rail 1: S T P T E
• Rail 2: E I Y M O N F V R E
• Rail 3: C R I I R A O E Y N
• Rail 4: U S T R O

Ciphertext: STPTEEIYMONFVRECRIIRAOEYNUSTRO

X.509 is the ITU-T standard that defines the format of public-key certificates. Public Key Infrastructure (PKI) is the set of people, policies, hardware and software used to create, manage, distribute, store and revoke these certificates.

An X.509 certificate contains: version, serial number, signature algorithm, issuer (CA) name, validity period, subject name, subject's public key, extensions, and the CA's digital signature.

Components of PKI: Certification Authority (CA) which issues and signs certificates, Registration Authority (RA) which verifies identity, certificate repository (directory), and Certificate Revocation Lists (CRL) or OCSP for revoked certificates.

Role in network security:

• Binds a public key to an identity, so a user can trust that a key really belongs to its owner (prevents man-in-the-middle attacks).
• Provides authentication of servers and clients, for example in SSL/TLS and HTTPS.
• Enables digital signatures (integrity and non-repudiation), secure e-mail (S/MIME), VPN/IPsec and code signing.
• Supports key exchange for confidentiality.
• Allows trust chains from a root CA to end certificates and revocation of compromised keys.

The two are complementary, and best security uses both.

A message digest is the fixed-length output of a cryptographic hash function applied to a message of any length. It acts as a fingerprint of the data: a small change in the message changes the digest completely, the process is one-way, and it is computationally infeasible to find two messages with the same digest. It is used for integrity checking, digital signatures and password storage.

MD4 vs MD5 (both by Ron Rivest, 128-bit digest, 512-bit blocks):

RSA process

1. Choose two large primes $p$ and $q$.
2. Compute $n = p\times q$ and $\phi(n) = (p-1)(q-1)$.
3. Choose public exponent $e$ with $1<e<\phi(n)$ and $\gcd(e,\phi(n))=1$.
4. Compute private exponent $d$ such that $e\,d \equiv 1 \pmod{\phi(n)}$.
5. Public key is $(e,n)$; private key is $(d,n)$.
6. Encryption: $C = M^e \bmod n$. Decryption: $M = C^d \bmod n$.

Calculation for $p=11$, $q=17$, $M=12$

$n = 11\times 17 = 187$

$\phi(n) = 10\times 16 = 160$

Choose $e=7$, since $\gcd(7,160)=1$.

Find $d$ with $7d \equiv 1 \pmod{160}$. Since $7\times 23 = 161 = 160+1$, we get $d=23$.

Public key: $(7, 187)$. Private key: $(23, 187)$.

Encryption:

$C = 12^7 \bmod 187$

$12^2 = 144$; $12^4 = 144^2 = 20736 \bmod 187 = 20736 - 110\times187 = 20736-20570 = 166$.

$12^7 = 12^4\cdot 12^2\cdot 12 \equiv 166\times144\times 12$.

$166\times 144 = 23904$, and $23904 \bmod 187 = 23904 - 127\times187 = 23904-23749 = 155$.

$155\times 12 = 1860$, and $1860 \bmod 187 = 1860-9\times187 = 1860-1683 = 177$.

$C = 177$

Decryption check: $177^{23} \bmod 187 = 12$, which recovers $M=12$ (this holds because $ed\equiv1 \pmod{\phi(n)}$).

HMAC (Hash-based Message Authentication Code) is a mechanism that provides message integrity and authenticity using a cryptographic hash function $H$ (such as SHA-256) and a shared secret key $K$:

$\text{HMAC}(K,m) = H\big((K' \oplus opad)\,\|\,H((K' \oplus ipad)\,\|\,m)\big)$

where $K'$ is the key padded to the block size, $ipad$ is the byte 0x36 repeated and $opad$ is 0x5C repeated. Only holders of the shared key can produce or verify the tag, so it is used in IPsec, TLS and API authentication.

Digital Signature Algorithm (DSA)

Design (global parameters): a prime $p$, a prime divisor $q$ of $p-1$, and $g = h^{(p-1)/q} \bmod p$.

Keys: the user picks private key $x$ with $0<x<q$ and computes public key $y = g^x \bmod p$.

Signing a message $M$:

1. Choose a random per-message secret $k$, $0<k<q$.
2. Compute $r = (g^k \bmod p) \bmod q$.
3. Compute $s = k^{-1}\,(H(M) + x r) \bmod q$.
4. The signature is $(r,s)$.

Verification (receiver, using the sender's public key):

1. Compute $w = s^{-1} \bmod q$.
2. $u_1 = H(M)\,w \bmod q$ and $u_2 = r\,w \bmod q$.
3. $v = (g^{u_1} y^{u_2} \bmod p) \bmod q$.
4. The signature is valid if $v = r$.

How it ensures integrity and authenticity

• The hash $H(M)$ is part of the signature, so any change in the message changes $v$ and verification fails (integrity).
• Only the owner of private key $x$ can create a valid $(r,s)$, and anyone can check it with the public key $y$, proving the sender's identity (authenticity) and giving non-repudiation.
• A fresh random $k$ for each message prevents key recovery; reuse of $k$ would expose $x$.