Computer Forensics and Security Fundamentals Coursework 1

Computer Forensics and Security
Fundamentals
Coursework 1
YOUNES AHMED, 18061675
14/12/2018
1

Contents
System Audit.........................................................................................................................................3
Computer Misuse Act 1990...............................................................................................................3
Port Scanning & the TCP Handshake.................................................................................................3
Vulnerability Assessment of Metasploitable Virtual Machine...........................................................4
Common Vulnerabilities and Exploits Identified................................................................................4
Mitigation..............................................................................................................................................5
Firewalls Background.........................................................................................................................5
IP Tables Background and Deployment.............................................................................................5
Additional Mitigation Approaches.....................................................................................................7
Bibliography.......................................................................................................................................8
2

System Audit
Computer Misuse Act 1990
Computer Misuse Act 1990 is a act for protecting the computer material from hacker and virus
writer. Any unauthorized user can not login the system. Therefore, the login screen carry out a
message saying that the access is limited to authorized user only. This thing cannot prevent a hacker
to access the data but the hackers will not be claim ignorance of committing offence (Yan and Yu
2015). The Act says you need permission to use a computer system. Someone performing security
testing on a system that is not theirs needs to obtain the permission of the system’s owner first, or
they risk violating the CMA. This is a fact regardless of whether or not the system to be tested is a
physical server or a virtual server rented from the cloud.
Port Scanning & the TCP Handshake
Port scanning is a technique to identify the ports of a target computer and create a communication
channel for attack. The main reason for port scanning is that some system does not use fixed ports
for some services, some services are used some arbitrary ports. Therefore, port scanning is used
know the details about the ports (Smart, Malan, and Jahanian 2015). In three way-handshaking
client first send a synchronization message to the server along with its sequence number then server
send a SYN_ACK packet to the server means server acknowledge the client synchronisation packet
along with its own sequence number. After that the client send an acknowledgement packet to the
server and then data transfer can take place. Port scanning use the same TCP 3-way handshaking for
identify the open ports of a target computer. This process is called SYN scanning. This process send a
SYN message to the server and the server send a SYN_ACK message to the client and then a RST
packet is send to the server as a third party. In this way the shortly resets the TCP connection (Ma,
Liu, and Wen 2016 ). For this the 3-way handshaking is not complete therefore, the connection is not
logged on to the target computer.
3