Computer Security Engineering Report: Access Control, Firewalls

This report delves into the core concepts of computer security engineering, encompassing encryption techniques such as symmetric and public key encryption, along with hashing for confidentiality and authentication. It examines the threats to secure networks, particularly denial-of-service attacks, and proposes mitigation strategies. The report further explores access control mechanisms, emphasizing physical security, environmental integrity, and authorized activities. Additionally, it addresses the reduction of desktop PC theft and unauthorized use by implementing security updates, secure browsers, and software precautions. Finally, the report covers firewalls and intrusion detection systems, providing a comprehensive understanding of network security principles. This document, contributed by a student, can be found on Desklib, a platform offering AI-based study tools.

Running head: COMPUTER SECURITY ENGINEERING
COMPUTER SECURITY ENGINEERING
Name of the Student
Name of the University
Author Note

2COMPUTER SECURITY ENGINEERING
Table of Contents
Topic 3 Encryption..........................................................................................................................3
Topic 4 Secure Networks.................................................................................................................4
Topic 5 Access Control...................................................................................................................5
Topic 6 Firewalls.............................................................................................................................7
References........................................................................................................................................9

3COMPUTER SECURITY ENGINEERING
Topic 3 Encryption
Symmetric key encryption
The encryption process in the recent time is playing a very vital role in every sphere. The
message which is send from one person to another have to be secured and has to be seen that it is
not in hand of nay user expect the actual recipient of the message. In Symmetric key encryption
each of the computer system has a secret key. The secret key can be used to encrypt a packet of
information mainly with the main propose of protecting it from other users before it is send over
the network to another computer system (Goyal, Koppula & Waters, 2017). In the process of
sending message with the indicated encryption process it is very important to know the computer
which is going to interact with in order to install the key. The drawback aspect of the process is
that the transfer of key is very much important and it has to be seen that the key does not reach
anyone else than the intended recipient. Symmetric key is very similar to secret code that each of
the two computers which are interacting must know in order to complete the communication
process (Prajapat & Thakur, 2016). In Symmetric key encryption each of the computer system
has a secret key is can be considered as the most important and the most beneficial aspect of the
encryption technology related to Symmetric key encryption process.
Public key encryption
The public encryption can be referred to as a system of cryptography that mainly consists
of two keys – a public key and the private or the secret key. The public key is basically known to
everyone and on the other hand the private and the secret key are known only to the intended end
user of the message. The main aspect in this cryptographic function is that the two keys are
related in a way that only the public key can be used to encrypt the message and only the

4COMPUTER SECURITY ENGINEERING
corresponding private key which is related to the public key can be used to encrypt the message
from the recipients side (Bellare, Kane & Rogaway, 2016). The security aspect involved in the
technology is that it is virtually impossible to generate the private key if some user knows the
public key. From the hackers point of view it is generation of the private is a hard job at hand, so
the message is transferred in a secured manner.
Hashing
The hashing function is almost available in all application which is related to the
information system (Waters, 2016). The technology is very much important from the users point
of view with the security aspect related to the internet and the communication medium. The hash
function is mainly a mathematical function which is used to convert an input value which is
numerical and convert it into a numerical value which would be compressed. The value which is
returned by the hash function is termed as message digest or in order words hash value.
Technique Used For Confidentiality and Authentication
Hashing is the most popular implementation of the cryptography which uses different
aspect of security which can directly insure Confidentiality and authentication (Koppula et al.,
2017). In computer security aspect the term confidentiality and the authentication play a very
vital role. Everybody who access the network want their data to be secured and no one expect the
intended person would not get access to the data stored in the server or over the network. There
are two direct application of the hash function which is based on cryptographic property.
1. Password Storage

5COMPUTER SECURITY ENGINEERING
If the password is stored in a normal text it would be directly accessible to anyone.
Instead of this mostly login procedures store hash values of the related password in the file. The
intruder who has the intention of hacking the password would only see the hashes of the
password, even if access to the password is made (Goyal, Koppula & Waters, 2017). Logging
with the password or deriving the password would not be possible, this is due to the factor that
hash function mainly processes the property with are related to the pre- image resistance (Altman
et al., 2016)
2. Integrity Data check
The integrity data check is the most common application of the hash function. The main
aspect in the process is the generation of the checksums on the data files. The integrity check
helps the user to detect whether any change is made to their original file (Appelt et al., 2016) the
concept how ever does not give any sort of assurance related to the originality aspect. The
concept is useful on if the user is somewhat sure about the originality of the file or the data.
Topic 4 Secure Networks
The Denial of service attack is mainly an attack in which the system, server or the traffic
which is related to the network is flooded with resources and as a result of which it makes it very
difficult for the user to use them accordingly. The server is in this scenario is flooded with
inappropriate request that any task or job cannot be achieve from the system. The attack crashes
the server and it can be dealt by merely restarting or rebooting the system. There can be different
ways in which accompany can be protected from the denial of service attack. Two most effective
way in order protect are stated below
1. Create an action plan in advance

6COMPUTER SECURITY ENGINEERING
The main aspect in this case is not waiting for the attack; it is the intelligence in response
to the potential risk before the attack is done. The main focus should be on the creation of a
system that absorbs a DDoS attack potential. Thought the precaution measure before the
intended action takes place is not 100% foolproof it does not help in mitigating the risk to a
extent. The action plan might consist of the following aspects.
 Implementation of a sensor so that it gives an indication whenever a website is down.
 Dumping of logs should be provided in any case of any malicious activity.
 Construction of ISP in order to get the understanding about the free and the paid DDoS
protection plans and its implementation (Chen et al., 2016)
 Confirmation should be obtained with the DNS TTL ( time –to –live) for system which
are prone to attack in the near future
2. Monitoring level of traffic
The result of the DDoS attack accounts in a unprecedented amount of traffic in the server
which is beyond imaginations. Putting emphasis on the hacker an ideal time to jack into the
website is when a huge amount of traffic is concentrated (Gollmann, & Meier, 2006). Therefore
the best way to notice quickly the attack is by looking out for the situation of the abnormal traffic
in the website. It can be estimated the amount of traffic in a particular website in a pre defined
time, whenever the rate increases the DDoS attack may be in active mode. Staying alert with it
monitoring and setting the threshold time or limit when the traffic goes beyond a certain level
will help an individual to protect themselves from the DDoS attack (Antonakakis et al., 2016)

7COMPUTER SECURITY ENGINEERING
Topic 5 Access Control
Rules of working in secure areas
1. Maintaining the integrity with the physical security for the secure areas.
 Confirmation that the door is closed with the access of the area.
 Never leave the door open or unattended while working in the area.
 Never allow the access of unsupervised personal by a contractor or technician
with the role of maintaining (Ling & Chen, 2016).
2. Maintaining the integrity of the environment in the area which is secured.
 Do not involve food, hazardous material or drinks in such an area.
 Never store any equipment like tools, cleaning supplies, ladder, ceiling tiles,
unused servers, etc).
 Maintenance of the fire protection unit is very much essential.
 Report of any building mechanical failure such as door not working in proper
condition, a water leak or a burned out bulb light (Chen et al., 2016)
3. Limitation of action with regards to authorized and appropriate activities.
 An approval from the ITS request should be taken in order of all the changes made in
the infrastructure and production system.
 The response on the production system in a n emergency or equipped failure must be
accordingly followed by emergency request for change.
 If not responsible or authorized never open the cabinet for equipment
 In many situation there can be a case that accidently switching of or damage of
computer equipment is done in such case the ITS service desk should be approached.

8COMPUTER SECURITY ENGINEERING
REDUCTION OF DESKTOP PC THEFT AND UNAUTHORIZED USE
Computer security mainly involve in securing the computer system and preventing it
from unauthorized access. The task of securing a system is very much challenging. Hackers are
considered to be upper hand than the normal people with emphasis on the technological
knowledge aspect . However securing the computer system is very essential in order of
protecting the data
1. Updating the system regularly: the operating system should be updated at least ones a
month in order to keep the system updated. Installing the recent patches and security installation
can help in securing the aspect.
2. Internet Browser: the browser is considered as the most important aspect in order to
achieve connectivity to the internet. One of the most renowned browsers is the Mozilla Firefox
which is mainly open source software. This is advantageous because the personal who are
involved with the security aspect can easily fix the bugs and build better security features which
are involved in the aspect. Another important aspect of Firefox is that it is Add- one or
implementation of extensions, this aspect can help in building the build in security and features
which are related to the privacy aspect.
3. Software aspect: unwanted software can directly affect or infect the computer system,
if during the downloading of the software it is not taken care of. The source of the software is the
main aspect here and it should be ensured that there is bundling of additional wanted program
with the legitimate software. If the computer system has java installed in it, it should be disabled

9COMPUTER SECURITY ENGINEERING
as stated by the Homeland Security. Java is responsible for many malware attacks on the
computer which are unsuspecting from the user’s point of view.
4. Virus and malware: A virus can implement anything that a normal computer program
can do. The virus spreads by infecting files or the area involved in the system and then it makes
copy of itself. On the other hand some computer viruses are not harmful at all others may
damage the data files and some destroy the files and some can directly spread to other computer
systems. Malwares is considered as a broad category of threads which are related to the computer
including unwanted programs and spyware that may get installed in the system without the
proper knowledge of the user of the computer system. an spyware program may be included with
other software’s. The spyware can reach the intended system when a download is ion activated
such as a music file.. The user should be conscious of the pop- up boxes where a answer to a
question is asked in aspect of yes and no.
Topic 6 Firewalls
An intrusion detection system is mainly designed in order to maintain all the inbound and
outbound activity of the network and identify and pattern which may be assumed to be
suspicious that may be an indication of someone attacking or attempting to break into the
network (Korman & Avidan, 2016). The intrusion detection system is considered to be passive in
the sense that its suggests user of the suspicious activity taking place – not prevent them. There
are two types of filter associated with the filtering process of the IDSs which are deep packet
inspection and packet stream analysis (Hoffmann et al.,2016).
Deep packet inspection (DPI)

10COMPUTER SECURITY ENGINEERING
The deep packet inspection role is not only limited on the footer and the header of the
packet of the information but also looks into the content of the packet (the data part) in order to
search for illegal statement and criteria’s that are predefined. This allows the firewall to make
appropriate decision about the aspect of whether to allow or disallows the packet of the data in
order to get through the route of the internet. Delving into the content with the packet is done by
the DPI by which it allows determination to be made with respect to the packet are finally
allowed traveling into the network (Desai et al., 2016)
The Deep packet inspection enforced a strong foothold in the aspect of the security. The
DPI offers just more than the examination of the packet of the data (Thorup, 2017). The network
management tools which can a future player in the security aspect of networking gather the deep
packet inspection information in order to create a better knowledge and understanding of the
network traffic, performance related to network and unifying applications. The concept also
provides an additional advantage of information that are implemented and user for network
trending, forensics and analytics with network (Roy, 2017).
Packet Stream Analysis
The packet stream analysis can be used in both way legitimately or illegitimacy. When
the technology is used legitimately the packet sniffer identifies any transmission error for the
network and data. The most important function of the technology is the network detection. The
process of packet capture is very much similar in the essence of telephone wiretapping in basic
sense detecting anything which is going through the computer network (Weiss, Y., Torralba &
Fergus, 2009). Monitoring the network problem and troubleshooting any problem when it arises
can also be an advantage of the implementation.

11COMPUTER SECURITY ENGINEERING
The Packet sniffer has a variety of function which would be very much beneficial in the
near future. By this mean it can help defend in detection of attempt of intrusion, detect misuse of
the network ,monitoring momentum with the data , debug communication in the server, filter out
suspect content, isolate and detect exploited system, gather statistic on the network issues. Thus
it can be stated that these method serves as a primary point for the monitoring purpose of the
network.

12COMPUTER SECURITY ENGINEERING
References
Altman, Y., Keren, A. Y., & Krupkin, I. (2016). U.S. Patent No. 9,306,971. Washington, DC:
U.S. Patent and Trademark Office.
Antonakakis, E., Perdisci, R., Lee, W., & Ollmann, G. (2016). U.S. Patent Application No.
15/384,025.
Appelt, D., Nguyen, D. C., & Briand, L. (2016). Automated Testing of Web Application
Firewalls (No. TR-SnT-2016-1).
Bellare, M., Kane, D., & Rogaway, P. (2016, August). Big-key symmetric encryption: resisting
key exfiltration. In Annual Cryptology Conference (pp. 373-402). Springer Berlin
Heidelberg.
Chen, P., Ong, Y. C., Page, D. N., Sasaki, M., & Yeom, D. H. (2016). Naked black hole
firewalls. Physical review letters, 116(16), 161304.
Chen, R., Mu, Y., Yang, G., Guo, F., & Wang, X. (2016). Dual-server public-key encryption
with keyword search for secure cloud storage. IEEE transactions on information forensics
and security, 11(4), 789-798.
Desai, M., Patel, S., Somaiya, P., & Vishwanathan, V. (2016). Prevention of Distributed Denial
of Service Attack using Web Referrals: A Review.
Gollmann, D., & Meier, J. (2016). Computer Security–ESORICS 2006: 11th European
Symposium on Research in Computer Security, Hamburg, Germany, September 18-20,
2006, Proceedings (Vol. 4189). Springer Science & Business Media.