PREFACE: This week\'s discussion topic focuses on PHYSICAL SECURITY and SECURITY

Question

PREFACE:
This week's discussion topic focuses on PHYSICAL SECURITY and SECURITY TOOLS.

ASSIGNMENT:
Carefully review and consider the posts made to date (if any). Calling upon information presented in the textbook chapters corresponding to this assignment and other resources you are able to discover to support your response, post by the submission deadline your response to the following
statement:

-------------------------------------------------------
Many have argued that security is about staying at least one step ahead of the bad guys. They say that no lock can be designed that cannot be broken and the best we can hope for is to design new security measures that will take the bad guys time to learn how to break or bypass. This lag time is where much of our security derives.
-------------------------------------------------------

1). Indicate whether or not you agree with this perspective.
2). Identify and describe three examples of security measures thathave been designed and have since been broken or bypassed.

Explanation / Answer

1)
Yes,security now a day's is being worse day by day
>Cyber attacks on Iran are far more than in other countries. Every day, more than 10,000 cyber attacks occur but most of them are neutralized.
>The problems are challenging, but national cyber experts are geared up to build a strong computer defense mechanism.
>Mainly prementive measures are being taken to reduce these faults.

2)
Example 1:
Actual Process:

Chip and PIN transactions have three main stages
>Card authentication: card proves it is real through providing a digital signature that the terminal can verify
>Cardholder verification: card and terminal check that legitimate cardholder is present (normally by card verifying the PIN)
>Transaction authorisation: terminal checks with bank that previous steps have been followed and the transaction should proceed

Bypassing:

>Criminals have successfully bypassed Chip & PIN
>Obtain static data as a result of flawed tamper resistance in Chip & PIN terminals then Bypass card authentication through exploiting backwards compatibility mode
>Steal cards then Bypass cardholder verification by exploiting Chip and PIN protocol flaws(here the data is lost and stolen)
>Sensitive data is sent unencrypted between the card and the terminal

Example 2:

Paypal
>Paypal promotes itself as a more secure payment method by removing the need to enter credit-card details online. In reality, Paypal account credentials can be compromised just as easily as credit-card details, and it still has the vulnerability of credit-card payments (unless you disable that feature).

>Paypal payments with stolen credit-card details

>Paypal allows people without an account to pay directly with a credit-card (unless you specifically disable that option). This means that stolen credit-card details can be used – the same as with every credit-card payment option (which will be covered in more detail in the next section).
>Fortunately (or not), Paypal has its own fraud detection mechanism that it uses on credit-card payments. This means that credit-card payments on Paypal are less likely to be stolen, but on the other hand Paypal often rejects legit payments that fail their somewhat strict detection system.

Example 3:
Chip N Pin
>Chip & PIN PEDs were insecure because the designers of hardware tamper resistance failed to take into account options chosen by UK banks
>A concise security architecture document would have helped prevent this flaw, and constrained system development
>CAP was insecure because it failed to consider the human as part of the security protocol
>Alternative technologies perform better, due to better usability testing prior to deployment
>QoS failed to protect Tor because the abstraction chosen for modelling the system did not match reality
>As systems become more complex finding appropriate abstractions will be increasingly difficult

Related Questions

Navigate

• Browse (All)
• Browse P
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.