Computer Security and Cyber Law (old course)

A trusted system is a system that is relied upon to enforce a given security policy. If it fails, the security policy is broken. It is built so that users, data and processes can depend on it to protect information.

Security protects a system and its data from deliberate threats such as hackers, malware and unauthorised access. Safety protects people and the environment from accidental harm caused by system failures or hazards.

Threats enabled by e-mail:

• Spam (unsolicited bulk mail)
• Phishing and spear phishing
• Viruses, worms and malware sent as attachments
• Spoofing (forged sender addresses)
• Hoaxes and chain letters
• Eavesdropping and loss of confidentiality
• Social engineering and fraud
• Harassment and cyberbullying

A passive attack only monitors or listens to transmissions (for example eavesdropping and traffic analysis) without altering data, so it is hard to detect and is prevented by encryption. An active attack modifies, forges, replays or destroys data or disrupts service (for example masquerading, replay, modification and denial of service). It is easier to detect but harder to prevent.

Plagiarism is the act of using another person's words, ideas or work and presenting them as one's own without giving proper credit to the source.

SSL (Secure Sockets Layer) is the older protocol, now deprecated because of vulnerabilities. TLS (Transport Layer Security) is its standardised, more secure successor. TLS uses stronger algorithms, HMAC for message authentication, an improved key derivation and more alert messages, and the two do not interoperate directly.

A virtual machine is a software emulation of a physical computer that runs its own operating system and applications in isolation, on top of a host machine's hardware using a hypervisor.

Using the Caesar cipher with the usual shift of 3, each letter is replaced by the letter three places later: $C = (P + 3) \bmod 26$.

Ciphertext: WXHADP

Inference control is the set of measures that prevent users from deducing confidential or sensitive information by combining the responses to several permitted queries on a database, such as statistical queries.

Cyberbullying is the use of the internet, mobile phones or social media to harass, threaten, embarrass or intimidate another person repeatedly.

To allow only specified computers to access the Internet, use MAC address (or IP address) filtering on the router:

1. Find the MAC address of each permitted computer (for example with ipconfig /all).
2. Open the router's admin page in a browser (for example 192.168.1.1) and log in with the administrator password.
3. Go to the wireless or security settings, then MAC Filtering / Access Control.
4. Enable filtering and choose the mode "Allow only listed devices" (whitelist).
5. Add the MAC addresses of the permitted computers.
6. Save and apply the settings, then reboot the router if needed.
7. Test: a listed computer connects, and an unlisted computer is refused.

For stronger protection, also change the default admin password, enable WPA2/WPA3 encryption and assign fixed IPs via DHCP reservation. Because MAC addresses can be spoofed, this is not a complete defence on its own.

IDS (Intrusion Detection System) is a hardware or software system that monitors network or host activity for malicious behaviour or policy violations and raises alerts. It detects by signatures (known attack patterns) or by anomalies (deviation from normal behaviour).

Distributed Intrusion Detection System (DIDS) combines several IDSs (host-based and network-based) placed at different points across a large network, which report to a central analysis point.

• Agents/sensors on hosts and network segments collect audit data and local alerts.
• They send this data in a common format to a central manager.
• The central manager correlates the events from all sources and detects coordinated attacks that a single IDS would miss, for example the same attacker probing many hosts.
• It gives a network-wide view and a single place for management and response.

Using the Caesar cipher with a shift of 3: $C = (P + 3) \bmod 26$ (spaces kept).

Ciphertext: Khoor Zruog iurp Vhfxulwb

Decryption subtracts 3 from each letter.

A firewall is a hardware or software security system placed between a trusted internal network and an untrusted external network (the Internet) that monitors and filters incoming and outgoing traffic according to security rules.

Types:

1. Packet-filtering firewall: checks the source and destination IP, port and protocol of each packet.
2. Stateful inspection firewall: tracks the state of connections and allows only packets that belong to a valid session.
3. Application-level gateway (proxy firewall): works at the application layer and relays requests on behalf of clients.
4. Circuit-level gateway: validates TCP sessions (handshakes) before allowing data.
5. Next-generation firewall: adds deep packet inspection, intrusion prevention and application awareness.

How it protects the network:

• All traffic passes through the single checkpoint and is allowed or blocked by rules.
• Blocks unauthorised access and unneeded ports and services.
• Hides internal addresses (NAT) from outsiders.
• Logs traffic for auditing and detects suspicious activity.
• Can block malicious content and known bad sites.

(a) Virus

A computer virus is a malicious program that attaches itself to a legitimate file or program and spreads when the infected file is run or shared. It replicates by copying itself into other files and can corrupt or delete data, slow down the system or steal information. Types include file infectors, boot-sector, macro and polymorphic viruses. Protection: up-to-date antivirus software, regular patches, avoiding unknown attachments and downloads, and backups.

(b) Web of trust

The web of trust is a decentralised trust model used in PGP/GPG in which there is no central certificate authority. Users sign each other's public keys to vouch that a key belongs to its owner. A key is trusted if it is signed by people you trust, directly or through a chain of such signatures. It is flexible and avoids a single point of failure, but is harder to manage and depends on users making good decisions.

The SSL handshake protocol runs before any application data is sent. It lets the client and server authenticate each other, agree on the cipher suite and generate shared secret keys. It has four phases:

Phase 1: Establish security capabilities.

• The client sends client_hello with its version, a random number, session ID and the list of supported cipher suites and compression methods.
• The server replies with server_hello, choosing the version, its own random number and the cipher suite.

Phase 2: Server authentication and key exchange.

• The server sends its certificate (X.509) and, if needed, a server_key_exchange message.
• It may request the client's certificate (certificate_request).
• It ends with server_hello_done.

Phase 3: Client authentication and key exchange.

• The client verifies the server certificate, and sends its own certificate if requested.
• It sends client_key_exchange, containing a pre-master secret encrypted with the server's public key.
• Both sides compute the master secret from the pre-master secret and the two random numbers, and derive the session keys and MAC secrets from it.

Phase 4: Finish.

• Each side sends change_cipher_spec to switch to the newly agreed cipher.
• Each sends an encrypted finished message, which verifies the whole handshake.

After this the Record Protocol protects application data with the negotiated keys.

No, it is generally not ethical to use the Internet in the classroom during class for purposes unrelated to the lesson.

Reasons:

• It distracts the user and others and reduces learning.
• It is disrespectful to the teacher and to classmates who are trying to learn, and it wastes the institution's paid time and bandwidth.
• It may lead to access to inappropriate content, cheating in tests, or cyberbullying.
• Teachers who browse during class neglect their duty and set a poor example.

Internet use is acceptable and ethical when it is part of the lesson and supervised.

How to stop it:

1. Create an acceptable use policy and explain the penalties for breaking it.
2. Use a firewall or web filter to block social media, games and inappropriate sites during class hours.
3. Configure the Wi-Fi/router so that access is available only to authorised devices or at set times.
4. Use classroom management software to monitor screens.
5. Teachers should supervise actively, arrange seating so screens are visible and ask for devices to be put away.
6. Train students and teachers in digital ethics and professional responsibility.