COIT20249 Assignment 3: Cyber Security Threats and Vulnerabilities

Desklib provides solved assignments and past papers to help students succeed.

COIT20249 ASS 3 REPORT
1

Executive Summary:
This research study has been made by an Australian cyber security organization named as
ABCT whose purpose is to make other organizations more secure and prevent them from the
different attacks made by the unauthorized users or the hackers for stealing the data. This
organization trains the employees of the different organizations to prevent themselves from
the different cyber-attacks in order to remain safe and avoid the attacks and also prevent the
stealing of the confidential data of the firms from getting lost or accessed by the unauthorized
users or hackers. This will also help other organizations to prevent themselves from various
types of cyber-attacks made by the hackers. This report consists of various measures and
various types of attacks which prove to be more useful thing so that they might be able to
prevent their organizations from various types of cyber-attacks.
The main problems faced by the users are data loss, and attacks which are done by the
unauthorized personalities and hackers. The major issues are the different types of security
threats which are faced currently by the users.
During this research study many of the techniques like IoT, testbeds and vulnerability finder
tools are discovered so that in order to improvise the security measures
The issues and threats are being investigated by the firm using a testbed technique which
was developed for detection and removal of the cyber security threats.
The main motto of this organization is to make all the firms more secure from the threats so
in order to protect their systems from the unauthorized persons and also the main motive of
this firm is to protect the homes from the cyber threats so that it can secure the systems
presented in the homes so that no one could steal the data from the home systems.
The recommendations states that the techniques like a testbed and software insurance are
implemented by the organizations in order to remove the infected viruses and prevent the
system from malicious activities made by the hackers or unauthorized users.
2

Contents
Introduction:...............................................................................................................................4
What is cyber security and why It is important for ABCT?......................................................6
Importance of Cyber-Security for ABCT..............................................................................6
Identify and explain at least 3 security vulnerabilities in ABCT’s system (you need to
consider ABCT’s case as presented above). You need to justify your answer with evidence
from research..............................................................................................................................8
Do some research, and find and list 5 different types of emerging threats (that might affect
ABCT) and describe each of them in detail. In your discussion include what damage the
attack might cause, who is responsible for these attacks and their attack techniques?..............9
Conclusion:..............................................................................................................................11
Do some research, analyse the information and give your recommendations (at least 3) how
to protect home and office from cyberattack...........................................................................13
Recommendations:...............................................................................................................13
References:...............................................................................................................................14
3

Introduction:
The main motive of the ABCT company is to make the home and office systems more secure
and less vulnerable so the company introduces the cyber security systems which are able to
prevent the whole systems of the homes and offices more secure and also prevent them from
threats which are mentioned in this research study so in order to remain secure the ABCT
company follows several measures of security for effectively and efficiently secure the
systems.
Innovation has enormously affected our present reality. In addition to other things, it has
incredibly propelled business, social insurance, travel, and office and home life. The Internet-
of-Things (IoT) is the following noteworthy worldview set to advance innovation
significantly further. It portrays a reality where consistently 'things' are altogether associated,
cooperating towards some more excellent reason. As the fame of IoT has developed, so too
has the attention on keeping up security and protection. There have been different articles
thinking about these properties over a few IoT settings, some stressing their need (e.g., by
means of helpless vulnerabilities and assaults) and open issues, and others proposing
potential answers for present and future difficulties. In addition, to draw in with, and impart
that security or protection hazard to other people, for example, normal clients in that
condition.
Not only for homes is the security also necessary for the offices for the protection of the
secret and privacy data of a company or firm.
4

What is cyber security and why It is important for ABCT?
What Is Cyber Security?
Cyber-protection or cyber security refers to many policies used to guarantee the
trustworthiness of attack, harm or unapproved access systems, projects and information.
Cybersecurity is the process of protecting from innovative attacks on structured, methods and
assignments. Generally these attacks are sometimes more effective to steal the confidential
data and also erase the secret information. Using the confidential data the attackers might
blackmail the customers and cause a huge amount of cash loss lets to the commercial
enterprise bureaucracy.
Executing compelling cyber-security actions are particularly tested currently on the grounds
that here are a larger amount of devices than persons, and attackers are winding up
progressively inventive.
A productive cyber-security method has numerous levels of insurance extent over the PCs,
techniques, developments, or evidence that one means to be cautious. In an involvement, the
overall population, procedures, and innovation should all supplement each other to make a
compelling guard for digitalized attacks.
Importance of Cyber-Security for ABCT
In the technological related world, everyone gets benefits by innovative cyber defense
programs. At a personal factor, a cybersecurity attack will achieve everything from wholesale
fraud, to intimidation activities, to the damage of serious data as family images. everyone
based on simple framework like emergency clinics, power plants and cash connected
management bodies (Bada et al. 2019). The ABCT company focuses on cyber securitu
because if the home and office systems are not secure than any third parties can leak or
access the confidential data of the users which might let them suffer from huge risks.
Substantiating these and totally different associations is prime to protection of our usual
public operations.
Everybody in order to get additional profits are just providing simpler security software’s but
the ABCT company provides the crafted technology used by cyberthreat scientists, is exactly
same as the group of 250 threat authorities at Talos, Latest developing threats have been
discovered by the world health organization and also digital assault systems are being
explored. They found latest vulnerabilities and they teaches the general society about the
5

importance of cybersecurity, and reinforce open source instruments. Their work makes the
web and internet safer for everyone to use.
Identify and explain at least 3 security vulnerabilities in ABCT’s system (you need to
consider ABCT’s case as presented above). You need to justify your answer with
evidence from research.
Different types of Vulnerabilities:
 SQL injection Attack: So in order for prevention from the SQL injection attack the
users have to apply least privilege technique of consents in user’s databases. The
malicious content is inserted by the unauthorized persons in the user’s database in
order to access their confidential data and can delete and also can modify the data.
 Cross-site scripting (XSS) attack: To safeguard against XSS attacks, developers
may disinfect or remove information contribution by clients in a HTTP request earlier
replicating it in return. It may guarantee all information which is approved, detached
or left previously unqualified back to the client (Atat. 2017).
 Security Misconfigurations: It is a type of vulnerability which consists of several
vulnerability itself which is caused due to irregularity in maintenance of the systems
which provides the full access of the system to the unauthorized users.
6

Do some research, and find and list 5 different types of emerging threats (that might
affect ABCT) and describe each of them in detail. In your discussion include what
damage the attack might cause, who is responsible for these attacks and their attack
techniques?
Different types of emerging threats:
 Denial of Service (DoS) Attack: A renunciation of-administration attacks which
overdevelops the organizations assets with the goal that will not supports the
demands. the attacks on the systems and frameworks are said to be the DDoS attack,
yet it harms the large number of the organization’s systems that are contaminated by
harmful viruses and worms inserted by the unauthorized persons or hackers.
 Man in the Middle attack (MitM): The main reason of occurrence of the MitM
attack is when a unauthorised person tries to access the confidential data with the help
of client and server. Previously, cryptography was used and also smart phone security,
computer system security, a man-in-the-centre attack(MITM) may be cohort ambush
wherever the forcefulness secretively transfers Also conceivably supports the
correspondences between two collections of research data united countries
organization trust they're legally talking for one another (Chesla. 2017).
 Phishing Attack: Phishing attack is the act of sending duplicate mails or messages
that are likely to be the same as the messages sent by the original source with the
objective of stealing the confidential data of different individuals and it also affects
the clients through the fraudulent messages. It is the proof of social fraudulent
activities which are increasing day by day.
 Drive-by attack: Drive-by download attacks are a typical type of attacks which is
totally based on spreading malware or malicious software. Hackers search for shaky
websites and plant a harmful or malicious substance into its HTTP or PHP code on
one of the pages of that website. Now this malicious object might be downloaded in
the system of the person who recently accessed that website, or it may take the user or
the effected individual to a website which is accessible by the unauthorized users.
7

 Password Attack: Password currently are used to grant access to the particular
individual's secret and confidential data it can be accessed by checking out the
individual's authentication by passwords, the passwords are the form of encoding and
decoding the objects.
 Malware attack: The malicious software is inserted in the user’s system so that it can
affect the system and cause the serious damage to the user’s data. it can hide in the
most important applications which are to be used on a regular basis or transfers the
system on the internet.
Prevention Measures
 Provide proper training to the employees as per the cyber security measures so the
employees might be smart enough to prevent the systems from attacks.
 Introduce, use and latest updated antivirus and antispyware programs on each system
used for the working in the company.
 Prevention can also be made by using the firewall for the internet access.
 Take regular backups of the confidential business data for retrieval.
 Regulate substantial approach to the business systems and its portions.
 Protect the Wi-Fi routers. So that the WiFi might be only accessible by the company
professionals (Anwar et al. 2017).
 Necessitates particular client which signifies each and every worker.
 Farthest point agent admittance to data and facts and bound specialist to introduce
programs.
 Alter PINs on regular basis.
8

Technologies used in Securing the Home as well as offices:
Current mechanism framework (ICS) is a usual expression that includes a rare kinds of
regulator systems, which includes regulatory control and evidence safeguarding (SCADA)
frameworks, discrete regulator structures (DCS),
Regularly found in the mechanical divisions and basic foundations, Programmable Logic
Controllers (PLC). An ICS consists of mixes of control segments (e.g., electrical, mechanical,
pressure-driven, pneumatic) that demonstrate together to achieve a modern goal (e.g.
manufacturing, issue conveyance or liveliness). These sorts of systems are frequently made
out of various interconnected gadgets with brought together or decentralized control
contingent upon the application. Current necessities of measured quality, decentralization,
simplicity of upkeep, and minor functioning expenses have incurred fashioners of system
control frameworks concerning the reception of Internet convention (IP) routable information
interchanges conventions generally found in home and office situations (Yousefi-Azar et al.
2017).
A cyber security execution testbed has been developed by the National institute of Standards
and Technology (NIST) for mechanical control systems. The main motive of the developed
testbed is to measure the performance of recent regulated frameworks (ICS) when consisting
with the cybersecurity assurances as per the accepted procedures and necessities
recommended by national and worldwide standards and rules. The motivation behind the
testbed is to copy certifiable modern frameworks as intently as conceivable without repeating
a whole plant or get together framework. The testbed recreates an assortment of modern
situations that incorporate procedures with moderate elements and others with quick
elements. Arrangement of quicker versus moderate is a relative assurance and relies upon the
kind of estimations being made. A moderate procedure is one in which changes to state
happen bit by bit after some time. Procedures with quick elements will display an observable
difference in state not long after the framework is bothered.
Different modern conventions are utilized all through the test-bed including IP-routable and
non IP-routable conventions. Routable conventions incorporate Internet Protocol (IP)- based
conventions (e.g., Transmission Control Protocol (TCP) and User Datagram Protocol (UDP))
just as mechanical application layer conventions (e.g., EtherNet/IP, Open Platform
Communication (OPC), and Modbus/TCP).
While these are fantastic perspectives, their detail and point of view make them to some
degree hard to apply and utilize while taking part in functional security errands, for example,
hazard investigation. Here, we allude particularly to situations where one wishes to utilize
9

such topical reference focuses alongside other data (e.g., arrange setups) to show the hazard
in a specific IoT organization.
More and more efforts are being required to identify new use cases and improvise
performance metrics. The company will continue to refine the technique for measuring ICS
security performance, and the results will be reported in most of the researches. This testbed
provides the contribution between the government officials and private sector employees for
making the business environment more secure and efficient.
By looking on the worldwide attack reports DDoS assaults, cause the potential security issues
of home switches should be tended to. Specialist organizations must refresh the firmware of
home switches and IoT gadgets to fix vulnerabilities all the more rapidly. Nonetheless, there
are such a significant number of brands, types, and measures of switches that the troubles of
firmware the executives are high. In this paper, we planned an over-the-air firmware update
framework for ISPs to deal with their boundless switches and directed trial for one million
switches. The consummation rate of firmware update is up to 96.32%. It achieved high
versatility and execution.
A risk is a situation that might be the reason of serious damage. A ineffectiveness is a
inadequacy through which cyber-crimes could occur. These two problems strengthen either
without dissimilar reasons no cyber-crime, yet a threat practicing helplessness implies greater
losses (Teng et al. 2017). To control such a huge amount of losses, we can either square or
reduce the risk, or close the limitation and vice versa.
10

Conclusion:
PC security efforts to guarantee the confidentiality, dependability, and user-friendliness of
handling systems and their portions. Three chief pieces of a figuring systems are accountable
to these attacks. Equipment, encoding, and data. These three, and the related techniques to
them, are immobilized to computer system’s security vulnerabilities.
Different measures of preventing the systems of an organization from different types of
attacks are to Keep the systems and data away from the infected databases, train the
representatives of the firms on regular basis, manage the firewall to prevent the internet
access for the users, regularly change the passwords, only use a least-benefit model, make
consistent changes, and regularly review your IT frameworks for attack prevention.
A cyber security test-bed is constructed to improvise the security systems of the industry in
order to prevent the industry from different types of attacks. This testbed allows the users and
researchers to generate validation requirements and also allows the researchers to research
and generate the knowledge about the security practices.
In this research study the different threats made by the hackers and the unauthorised persons
are analysed so that in order to build the different mechanisms for creating both the business
and homes prevented from cyber threats and attacks and it might also prevents its data loss
and unauthorised access. The different testbeds are also prepared so that in order to minimize
the cyber security risks and different types of attacks are also prevented by using these
testbeds.
11

Do some research, analyse the information and give your recommendations (at least 3)
how to protect home and office from cyberattack.
Recommendations:
This research study focuses on the security of the homes and offices so that in order to
prevent themselves from the different types of harmful cyber-attacks. This research study
mainly focuses on the mostly occurred attacks so that in order to provide the knowledge to
safeguard the different industries and homes from the cyber security attacks. The following
are the recommendations to the users:
 A cyber security execution testbed has been developed by the National institute of
Standards and Technology (NIST) for mechanical control systems. The main motive
of the developed testbed is to measure the performance of recent regulated
frameworks (ICS) when consisting with the cybersecurity assurances as per the
accepted procedures and necessities recommended by national and worldwide
standards and rules.
 Different measures of preventing the systems of an organization from different types
of attacks are to Keep the systems and data away from the infected databases, train the
representatives of the firms on regular basis, manage the firewall to prevent the
internet access for the users.
 A productive cybersecurity method has numerous levels of insurance extent over the
PCs, techniques, developments, or evidence that one means to be cautious. In an
involvement, the overall population, procedures, and innovation should all
supplement each other to make a compelling guard for digitalized attacks.
12