Assessment 2: Security Fundamentals - Information Security

This report explores the fundamentals of information security, focusing on the security of Automated Teller Machines (ATMs). It examines the concepts of confidentiality, integrity, and availability in the context of ATM PIN entry, analyzes the maximum number of PIN attempts a thief might make, and discusses the reluctance of users to adopt biometric authentication. The report also delves into the concepts of false positives and false negatives in biometric authentication, providing examples of scenarios where false negatives are more critical. Finally, it demonstrates the conversion of plaintext to ciphertext and vice versa using a transposition cipher and Vigenere cipher techniques.

Sunil Varma Numpally 11604854
ITC595
Information Security
Assessment 2
Security Fundamentals
Student Name: Sunil Varma Nampally
Student ID: 11604854
1

Sunil Varma Numpally 11604854
Contents
Introduction:....................................................................................................................................3
Question1:........................................................................................................................................3
Question2:........................................................................................................................................4
Question3:........................................................................................................................................4
Question4:........................................................................................................................................5
Question5:........................................................................................................................................6
Conclusion:......................................................................................................................................9
Reference:......................................................................................................................................10
2

Sunil Varma Numpally 11604854
Introduction:
The aim of the report is information security and it will include the security fundamentals in this
part. This assignment will contain the answers to some questions regarding the security of ATM
(automated teller machine). In the first part, it will include the example of integrity and
confidentiality of user requirement. In the next one, general introduction about the ATM pin. The
biometric authentication will explain in next part with the positive and negative requirement. The
encryption method will also a part of the report in the last section. The complete assignment
depends on the ATM security and its specification.
Question 1:
Defines the confidentiality, availability, integrity requirement across the ATMs, at the time
the user enters PIN, also explain the degree of importance
ATM is a device of electronic banking or telecommunication which allows customers to perform
financial or banking transaction any time and in any ATM, without going to bank branch The
transaction performs like, transfer, cash withdrawal, obtain information of account and deposits
funds. ATM works on three major components which are, Confidentiality, integrity and
availability. These are the CIA triad. These terms are related to information security. Here is the
explanation of each term with an example.
Confidentiality: the process which protects the system from unauthorized access. Only
authorized people can access the information which is allowed by the organization. A file is able
to access by some people of an organization and other people are blocked to access it because of
security controls of confidentiality issues.
In the example of confidentiality, it is applied to some conditions like proprietary information of
an organization or some other confidential documents related to personal information of peoples.
The authorized people have complete control over it and monitor properly.
Integrity: this term is related to the accuracy and consistency of the information which can be
changed only by the authorized access. In some cases, the information needs to change due to
errors or unauthorized access but the integrity maintains only in the case when the information
remains unchanged till the storage. Changes in the information can affect the integrity and
information security which is monitor and control by authorized access.
Financial information is the best example of integrity because it relates to information value,
accuracy and consistency. In the case of withdrawing money from ATM, uncheck the receipt
after withdraw is the case of integrity, not confidentiality. Information security of banking
system used mostly the term integrity.
Availability: the term availability is the situation in which an information is a check for its
proper need. The information should be available at right place and right time by the authorized
user. Availability checks the all components of the information and the working of the system. If
some information has a problem, in that case, it is impossible to access the information. To
protect the system components and make information available.
3

Sunil Varma Numpally 11604854
The press release is the best example of the term availability which is related to public
consumption. For this term, the information should be available to the public with no
requirement of confidentiality and less require of priority (Chia, T. 2010).
Question 2:
Calculate the maximum number of PINs that the thief may have to enter before correctly
discovering the customer’s PIN
The ATM pin would be 4 digit pin so there is two case to generate the correct pin by the thief.
Case A: user does not 0 from the keyboard of the ATM. Because 0 is not able to press an ATM
pin and all four digit pic with zero is not valid for the ATM pin. Now a total number of digits is
four which entered as a pic and we have five numbers which remain to enter the places. So the
total possibilities for the combination are
 The first place has the number to fill are 5
 Second place 5
 Third place 5
 Fourth place 5
Total: 5*5*5*5 = 625
Case B: the total number of chance to enter the pin is reduced by one because of not use the
zero. In this case, the total number of the combination is reduced by one, that is
5*5*5*5-1= 624
This is the theoretical calculation, but in reality, no one can enter the wrong password more than
three times. In any case, user do this then his ATM will block and he is not able to use the ATM.
Question 3:
List of the three reasons, why the people show reluctance is to use the bio matrices as an
authentication and also provides the counter for all objectives.
Biometric authentication is the simple process to verify the identity of the user by physical
characteristics of the human body. These characteristics are unique to every human being and
complete by some characteristics like face recognition, voice, the image of fingerprints and scan
by the retina. It is the measurement of the human body.
There are three types of the scanner for a scan the fingerprints, optical, capacitive and ultrasound.
The fingers prints represent the mathematical terms and dost not store on the server by the apple
and Google.
The eye scanner is another type of biometric authentication which is done by iris scanner. O two
people have the same fingerprints and retinal pattern.
Another way for authentication is speaker recognition which phrases the voice. Some other
authentication methods are facial recognition with hand and finger geometry and vein geometry
(DASCALESCU, A. 2018).
some people do not use the biometric due to many reasons, I discuss three of them which are,
Cost factor, accuracy and points of failure.
4

Sunil Varma Numpally 11604854
The cost factor: This is the major factor for the people, that’s why they reluctant to use
biometrics authentications. There are many ways which are cheaper than biometrics to identify
the user. The complete system has much cost to install for a small organization or for private use.
Some user has complained to get blistered in fingers and that day they can’t access their system
or do any work. So this is the major reason for people too reluctant for the biometrics.
Privacy & Accuracy: user first choice is privacy before using any new technology. If the
technology fails to keep its privacy then user never use it again. Same as biometrics has privacy
issues. People don’t want to give out their personal information to anyone. They don’t want to
enrol in a biometric machine. A static image of any user can unlock the face recognition
technique.
Points of failure: a biometric authentication used to control the access of employees and
registered people or visitors of an organization. The system also has false negatives so some
employee can easily deny the access to biometric authentication so organization require a human
override. Anyone who has the knowledge of technology can fail the system with a copy of eye
retina and fingerprints (Techwalla, 2018).
Question 4:
In biometrics authentication, false positive and false negative rates can be tuned according
to the requirement, and they are often complementary i.e. raising one lowers the other,
describe two circumstances where false negative is significantly more serious than false
positive.
As I discussed earlier various biometric verification methods like face recognition, fingerprints
and retina authentication. There are two different level of accuracy in biometrics,
 False positive or false acceptance
 False negative or false rejection
These two false methods have a sample of biometrics. The first one, false positive, accept this
false sample as a match. So it also calls false accept. For an example, user A has a cellphone with
fingerprint scanner lock. B steals the cell phone and tries to unlock it and B successfully unlock
it. This process returns a positive match but as from the side of A, it is completely false.
The other one biometrics match with a valid sample but system rejects it as a false rejection.
Now take the example from above, A register the fingerprints on a cell phone for the
authentication. Next day A tries to unlock the cell phone with the fingerprints but cellphone
occurs a message with an error of rejection. Cellphone returns a message with a negative match
of the fingerprint of A. it happens because, the fingerprint which registers last day by A, is not
same as the fingerprint which A use to unlock today.
These both look same for some people but there is nothing same between both. False positive is
same as false acceptance and false negative is same as false rejection (Gibson, D. 2010).
There is a various circumstance in normal life where a user faces these two conditions. I’ll
discuss two circumstances here:
5

Sunil Varma Numpally 11604854
The banking system required the biometric authentication for each employee and system because
it is the matter of privacy and accuracy and related to the people of a nation. Anyone can hack
the banking system if proper security and authentication are not installed. The employee A of
bank register his fingerprints in the bank system or scanner to the login. In case the other
employee or anyone wants to login to the account of A then it occurs an error to incorrect login.
This is happening because of false negative or false rejection in the system. If false negative does
not show error then many on account of customers can be a hack and transfer thousands of funds
from their account and hacked the complete banking system. In this case, the authentication
process of false negative or false rejection saves the banking system.
The other circumstance can happen in the security of the nation. A nation has the most powerful
cybersecurity of his country or of the world but then there is no requirement of cybersecurity for
failing the authentication of biometrics. By just a normal change in fingerprint or face image,
anyone can unlock the authorized lock. The false negative or false rejection can save the false
authentication in the security of the nation. False negative stop the fake authentication in the
security. If a registered user of biometrics tries to login with another finger or from any other
things then a message occurs to fake login and cant login successfully. It happens same as when
another person, who never register with the biometrics tries to log in to the account then also a
message occurs on the screen to incorrect login. These all two task prevent the fake
authentication by false negative or false rejection.
Question 5:
Conversion of the data and the information from one phase plain text to cypher text where
ciphertext = NTJWKHXK AMK WWUJJYZTX MWKXZKUHE
Encryption is the method to send a message or data information in another form to the people
who can access it with a secret key or called decryption key. Sometimes password also used as a
decryption key. The data which send in an encrypted form known as ciphertext and the encrypted
data is known as plaintext. The encryption methods have two types of it, first one is asymmetric
encryption and the second one is symmetric encryption (Lord, N. 2010).
Transposition cypher or transposon is a method of encryption which is different from another
method like, in transposition method, the letters does not replace, they move around whereas in
other methods the cypher or letters replace by other latter or symbol to produce ciphertext.
The example of the transposition cypher is,
Write, ‘it is simple’ in transposition cypher, that is ‘TI SI ELPMIS’.
And the normal example of ciphertext is, “it is simple” to TI SI ELPMIS (crypto, 2018)
to determine the piece of ciphertext from the result of transposition, here is the example of this
conversion:
example: “how they work” kroeyehtwoh
this is the example of the result of transposition.
There are some methods for encryption and decryption which used to convert plaintext to
ciphertext and ciphertext to plaintext.
 SKC (Secret key cryptography): it is used as a single key for both operation, encryption
and decryption.
6

Sunil Varma Numpally 11604854
 PKC (Public key cryptography): it has two keys to perform both operations differently.
One key for encryption and another key for decryption.
 Hash Function: a math function which use to transform irreversibly encrypt data or
information. It does not contain any key so the ciphertext does not recover to plaintext.
The steps and example of ciphertext and decipher the text.
Example to encrypt the text
To convert the encrypt to decrypt code, use the substitution technique. This technique is
complete by using the given key, that is 234 and it is also known as Vigenere cypher technique.
 The formula for decryption is = Mi = DK(Ci) = (Ci - Ki) mod 26
 The number of alphabate has the range between 0 to 25 as A = 0, B = 1
 The cipher text is = NTJWKHXK AMK WWUJJYZTX MWKXZKUHE
Test first letter N, value is 13, key 234,
Mi = (13-2) mod 26 = 11 = L, now convert all the cipher text same as
N 13 - 2 11 Mod26 11 L
T 19 - 3 16 Mod26 16 Q
J 9 - 4 5 Mod26 5 F
W 22 - 2 20 Mod26 20 U
K 10 - 3 7 Mod26 7 H
H 7 - 4 3 Mod26 3 D
X 23 - 2 21 Mod26 21 V
K 10 - 3 7 Mod26 7 H
A 0 - 4 -4 Mod26 -4 W
M 12 - 2 10 Mod26 10 K
K 10 - 3 7 Mod26 7 H
W 22 - 4 18 Mod26 18 S
W 22 - 2 20 Mod26 20 U
U 20 - 3 17 Mod26 17 R
J 9 - 4 5 Mod26 5 F
J 9 - 2 7 Mod26 7 H
Y 24 - 3 21 Mod26 21 V
Z 25 - 4 21 Mod26 21 V
T 19 - 2 17 Mod26 17 R
X 23 - 3 20 Mod26 20 U
M 12 - 4 8 Mod26 8 I
W 22 - 2 20 Mod26 20 U
K 10 - 3 7 Mod26 7 H
X 23 - 4 19 Mod26 19 T
Z 25 - 2 23 Mod26 23 X
K 10 - 3 7 Mod26 7 H
7

Sunil Varma Numpally 11604854
U 20 - 4 16 Mod26 16 Q
H 7 - 2 5 Mod26 5 F
E 4 - 3 1 Mod26 1 B
Decrypt the Text using Vigenere technique:
Cyphertext: NTJWKHXK AMK WWUJJYZTX MWKXZKUHE
 Decrypted code: LQFUHDVH WKH SURFHVVRU IUHTXHQFB
 The formula is Dn(x) = (x-n) mod 26, key is 234
 here x is the decryption code and n is the total number of the key that is 3.
Take example of first decrypted code that is L = 11,
Dn (x) = (11-3) mode 26 = 8 = I, covert all same as example
L 11 - 3 Mod26 8 I
Q 16 - 3 Mod26 13 N
F 5 - 3 Mod26 2 C
U 20 - 3 Mod26 17 R
H 7 - 3 Mod26 4 E
D 3 - 3 Mod26 0 A
V 21 - 3 Mod26 18 S
H 7 - 3 Mod26 4 E
W 22 - 3 Mod26 19 T
K 10 - 3 Mod26 7 H
H 7 - 3 Mod26 4 E
S 18 - 3 Mod26 15 P
U 20 - 3 Mod26 17 R
R 17 - 3 Mod26 14 O
F 5 - 3 Mod26 2 C
H 7 - 3 Mod26 4 E
V 21 - 3 Mod26 18 S
V 21 - 3 Mod26 18 S
R 17 - 3 Mod26 14 O
U 20 - 3 Mod26 17 R
I 8 - 3 Mod26 5 F
U 20 - 3 Mod26 17 R
H 7 - 3 Mod26 4 E
T 19 - 3 Mod26 16 Q
X 23 - 3 Mod26 20 U
H 7 - 3 Mod26 4 E
Q 16 - 3 Mod26 13 N
F 5 - 3 Mod26 2 C
B 1 - 3 Mod26 -2 Y
8

Sunil Varma Numpally 11604854
Plain text is = INCREASE THE PROCESSOR FREQUENCY
Conclusion:
The aim of report achieved successfully with the completion of all requirement. The first part has
the three-term, confidentiality, availability and integrity of the case of ATM pins. The second
part has the maximum number of an attempt by the thief to hack the ATM. Next part has the
reasons behind to reluctant people for biometrics and the next has the explain of false positive
with false negative terms regarding the user biometrics authentication. The last section includes
the conversion of a cypher to plain text or plain text to cypher text.
9

Sunil Varma Numpally 11604854
Reference:
 Chia, T. (2012). Confidentiality, Integrity, Availability: The three components of the CIA
Triad « Stack Exchange Security Blog. Security.blogoverflow.com. Retrieved from
https://security.blogoverflow.com/2012/08/confidentiality-integrity-availability-the-three-
components-of-the-cia-triad/
 DASCALESCU, A. (2018). Biometric Authentication Overview, Advantages &
Disadvantages. Retrieved from https://heimdalsecurity.com/blog/biometric-authentication/
 Techwalla (2018) Retrieved from https://www.techwalla.com/articles/disadvantages-to-
biometric-identification-systems
 Gibson, D. (2010). Biometrics False Positive False Acceptance. Retrieved from
http://sy0201.blogspot.in/2010/05/biometrics-false-positive-false.html
 Lord, N. (2010). What Is Data Encryption?. Retrieved from
https://digitalguardian.com/blog/what-data-encryption
 Crypto Corner (2018). Retrieved from http://crypto.interactive-maths.com/simple-
transposition-ciphers.html
10