ITC595 Information Security: Security Fundamentals Assignment

This assignment solution for ITC595 Information Security: Security Fundamentals comprehensively addresses various security concepts. It begins by evaluating the confidentiality, integrity, and availability requirements of ATM services, emphasizing the importance of PIN protection and transaction accuracy. The solution then delves into the vulnerabilities associated with PIN codes and calculates the probability of a successful PIN breach. Furthermore, it explores the adoption challenges and security concerns surrounding biometric authentication, contrasting it with traditional password-based systems. The assignment also discusses the significance of distinguishing between false positives and false negatives in security assessments, using examples like medical diagnostics and server farm access. Finally, it touches on the Vigenere Cipher substitution technique, demonstrating a basic cryptographic method. Desklib offers this and other solved assignments to aid students in their studies.

ITC595
INFORMATION SECURITY
Assessment 2
Security Fundamentals
Student Name: Ravikumar Rajendrakumar Patel
Student ID: 11603876
Student Email: [e-mail]
1 | P a g e

Table of Contents
Question 1........................................................................................................................................3
Question 2........................................................................................................................................5
Question 3........................................................................................................................................6
Question 4........................................................................................................................................8
Question 5......................................................................................................................................10
References......................................................................................................................................13
2 | P a g e

Question 1
ATM services that are provided by the bank for customer services. Customer facilitated by a card
and PIN to make access their account and to avail bank services.
The degree of importance with proposed requirement is given below:
Confidentiality
Privacy in the field of ATM comprised points of interest of record and exchange of cash of a
client that is essential. Bank provides ATM card and certifications in the type of ATM stick to
perform tasks like an exchange of cash. Henceforth the client believes that the utilization of the
record is classified and can't be uncovered to another. Any break in the client account harm
classification of the client and may prompt taking of client's cash.
 To utilize ATM benefit, a client needs to utilize the own ID number that is known as a
pin to get to their record utilizing ATM.
 So the client ought to need has to protect their pin private.
 The client needs have to protect their pin private amid exchange task is processed over a
server of the bank.
 So, secrecy of PIN ought to be kept up legitimately and ought to be encoded
appropriately.
Integrity
An ATM client depends on the accuracy of correspondence administrations gave by a bank in
which a client dials bank client administrations number and distinguished from the bank.
Exactness in correspondence required on the grounds that a missed association with row charges
to the client or organization.
 The client assumes that exchange record is managed with no pernicious exercises or
mishaps
Integrity Importance
 On particular time, when client pull back the measure of 500 USD and the rest adjust is
6690. Rather than refreshing 6690, it refreshed as 6200 USD, cause surprising loss of
sum.
 Transaction performed specifically influence record of the client so value-based
uprightness ought to be kept up and secured.
Accessibility
A client utilizes their telephone or phone to speak with individuals at whatever point required. Be
that as it may, fail to deliver instant service and failed to react client on that particular time then
it is no utilization for the client. So accessibility on phone is most critical to the bank. It makes
solid devotion to the clients.
 The ATM ought to be accessible 24 hours and 7 days to serve clients.
3 | P a g e

Level of Importance of accessibility
 The accessibility of ATM benefits, in the long run, helps the monetary development of
the bank. Then the ATM machine ought to provide 99.99% accessibility.
 Maximum accessibility increment client’s reliability ("Computers at Risk", 2018).
4 | P a g e

Question 2
The number of Individual Identification is a numeric number called PIN for ATM secret key or
distinguishing a client to a framework. Stick is likewise utilized for exchanges done by means of
cell phone and the client can try 3 times for entering his/her stick code else needs to enter the
individual code to unblock. PIN code verifies bank framework alongside cardholders, a
government with residents, and with workers. For the most part PIN code is utilized as a part of
POS exchange.
As far as a monetary exchange, normally both of the private PIN and the open stick code are
required to confirm a person for the framework. So an individual requires a client ID and client
secret word to get its access to the framework. The client can just access the framework when
login certification entered matches to store login qualifications of the client. A versatile can
likewise be the ensured PIN and the portable PIN for that is additionally of at least four to eight
digits. In the event that a cheat endeavoured to break-in the ATM, a PIN code will be required
and in addition client card for getting access inside the ATM without annihilating the machine.
The figuring of PIN enter to get to ATM machine could be computed based on adding up to the
number of keys accessible on ATM’s keypad and other accessible keys.
A hoodlum broke-in an ATM by utilizing screwdriver and stick card per user. He/she likewise
broke 5 keys on the ATM’s keypad. Hoodlum stopped the procedure when a client came to
ATM. The client effectively entered their stick implies the client ATM stick can be characterized
by utilizing the remaining stick. For the most part, an ATM has ten digits over its keypad and the
criminal broke five keys out of them. The ATM stick is created in a mix of 4 keys. So the most
extreme number of PINs that the criminal may need to enter before effectively finding client's
PIN is as per the following:
Remaining Keys=5
Number of Keys making up the combinations = 4
So, a total number of times the hoodlum will have to enter-in the PINs to discover correctly the
PIN is 625 (Why an ATM PIN Has Four Digits - Schneier on Security, 2018).
5 | P a g e

Question 3
To get access to PC, attendance and to access in information server a client regularly utilize
biometric secret key rather than Pin like unique mark. Such sort of secret key that is called
biometric verification. Supporters of biometric development imagine a world in which you enter
into your personal or office system using a one of a kind stamp scanner, take money from a cash
machine that yields your eye promise you are basically the database holder, perceive to your
personal bank which means the telephone make voice prints, and boarding for flights by walking
around airport terminal camera which recognizes you as a perpetual traveler. Such a fantasy still
can't rise. Biometric system faces little firm-specific challenges. The hardware is exorbitant, one
of a kind structures are conflicting to one another, and the advancement is up 'til now creating.
Wherever as PCs end up being a bit of the surface of consistent everyday presence and more
trades from checking to shopping contracts, to archiving evaluation frames are finished precisely.
The biometric client delay regularly to utilize the verification of biometric gadget since it isn't
cancellable on genuine minutes. Means, when any part of body portion of the client had to
consume or accidentally harmed, can't effectively supplant their old secret key with the better
and brighter one. That is the motivation behind why a client needs to choose 2 or 3 filters on time
of enrollment with some biometric gadgets. In the beginning time, as a result of keeping up
protection and dread of abusing information are 2 principle motivation behind why the general
population hesitant to utilize biometric security validation framework, for instance, biometric
entrance framework outside the workplace.
The three reasons why individuals might be hesitant to utilize bio-measurements are as per the
following:
Computing System consist Protected Object
Multiple programming always helps the user and support operating system to protect client
resources:
 Memory
 Sharable I/O disk
 Printer
 Database
 Procedures and sub-procedures
Multiprogramming
 Multiprogramming is a procedure that encourages to run a few programming examples
on a solitary processor.
 Multiprogramming ensures client's program and additional information on other client's
activities since information for OS is critical perspective.
OS’s basic Security methods
 Logical parting
 Cryptographic
 Physical parting
 Temporal parting
6 | P a g e

Various ways of how to counter those objections
Physical separation
 It uses various resources that are physical for example printer.
 Expensive but the implementation is very easy.
Example
 The printer is the best case of physical division.
 It is utilized to play out a few errands.
 So it requires extraordinary security from unapproved get to
 Printer gadgets are isolated based on active mode.
(Biometric Technology Application Manual Volume One: Biometric Basics Compiled and
Published by National Biometric Security Project, 2018)
7 | P a g e

Question 4
In this assessment I have to identify circumstances where false negative are significantly more
serious than false positive. Chip data is frequently used to perceive interpretation factor
confining targets. In any case, the closeness of false or fake positives and negatives in the data of
the chip convolutes and pieces examinations, especially when the coupling centres for a specific
translation factor are taken a gander at transversely finished species or conditions. An
Expectation-Maximization based approach could be proposed to manage and translate the
fundamental bona fide checks of positives/negatives from the watched counts. In this approach’s
perspective, we inspect the effect of false positives/negatives on reasoning related to elucidation
heading. Understanding elements expect a basic part quality way by the authority to specific
DNA groupings in regulatory areas of their destinations. Correct recognizing proof of coupling
centres around the interpretation factors is premier to the perception of the managerial
instrument. The tests of Chromatin immune-precipitation are typically used to recognize the
authoritative concentrations in eukaryotes and prokaryotes. Chip tests outfit us with information
about coupling centres around a particular controller at the genome level. From a viewpoint,
consider a prosperity gauge case, where we have to the asymptomatic chest tumour with respect
to our patient's mammography. Imagine that perceiving danger will trigger the further
examination (we won't instantly treat our patient) while if we don't recognize illness, we send our
patient to his/her home back with a noteworthy smile all finished and prompting for everything
to be great. This case in this way is unsymmetrical since we absolutely need to go without
sending home the wiped outpatient (a False Negative). We could, nevertheless, influence the
patient to hold up to some degree increasingly and focusing on additional by asking for that he to
give more tests paying little heed to whether or not he keeps an eye on False Positive. In such a
condition, we would support False Positives over the False Negatives. False positives are the
cases where we get positive results for the tests when we could have received negative results.
It's sometimes known as a false alert or a false positive blunder. It's regularly used as a piece of
the restorative field, in any case, it can moreover apply to various locales. A couple of instances
of the false positives as mentioned below:
• Pregnancy test to be done is received with certainty when the patient isn’t pregnant.
• A test of pre-birth returns positive result for Down's disorder when your child doesn’t
have any confusion.
• A tumour screening test also returns a positive result, yet the patient doesn't have that
ailment.
Disease programming on the PC erroneously recognizes a harmless program to be a malicious
one. The false positives could be alarming, especially with respect to helpful tests. Examiners are
dependably attempting to perceive clarifications behind false promising focuses remembering the
ultimate objective to make tests touchier. A related thought is a false negative, where the patient
gets a negative result when the patient could have received a positive result. For example, the
pregnancy test might return negative result regardless of the way that the patient is certainly
pregnant.
8 | P a g e

False negative happens when a biometric gadget neglects to verify the person. The two
conditions when the false negatives are fundamentally more genuine than the false positives are
as per the following:
• Personal: The safe’s owner confined by biometric gadget from getting to, leads him unfit
to utilize a required asset when proprietor extremely required sum accessible in the safe.
• Institutional: Server going down and expected to get to the server farm for giving an
administration. Consistently losing a thousand million income of association and biometric didn't
verify me prompt lose more cash and income
• Safety: A representative in server farm association tumbled down on the floor due to
heart assault and biometric gadget doesn't confirm me as well as the outcome she could kick the
bucket.
9 | P a g e

Question 5
We will be using the Vigenere Cipher substitution technique.
Vigenere cipher decryption formula is:
In the range of alphabet A is equal to 0 and z is equals to 25.
Provided Text: NTJWKHXK AMK WWUJJYZTX MWKXZKUHE
Procedure:
Letter = T
Address Value = 19
Substitution Key = 234
Formula: 16 mod 26 and Result = Q
Using the above Procedure following are the decrypted code:
Letter = N and Resultant = L
Letter = T and Resultant = Q
Letter = J and Resultant = F
Letter = W and Resultant = U
Letter = K and Resultant = H
Letter = H and Resultant = D
Letter = X and Resultant = V
Letter = K and Resultant = H
Letter = A and Resultant = W
Letter = M and Resultant = K
Letter = K and Resultant = H
Letter = W and Resultant = S
Letter = W and Resultant = U
Letter = U and Resultant = R
Letter = J and Resultant = F
10 | P a g e

Letter = J and Resultant = H
Letter = Y and Resultant = V
Letter = Z and Resultant = V
Letter = T and Resultant = R
Letter = X and Resultant = U
Letter = M and Resultant = I
Letter = W and Resultant = U
Letter = K and Resultant = H
Letter = X and Resultant = T
Letter = Z and Resultant = X
Letter = K and Resultant = H
Letter = U and Resultant = Q
Letter = H and Resultant = F
Letter = E and Resultant = B
So Resultant Code will be
LQFUHDVH WKH SURFHVVRU IUHTXHQFB
Now we will be use Caesar cipher on the above code:
Following is the following that will be applied on the resultant code:
Let take the Letter Q:
Letter = Q
Formula= 13 mod 26 and Resultant = N
We will apply the above procedure on the rest of the letters:
Letter = L and Resultant = I
Letter = Q and Resultant = N
Letter = F and Resultant = C
Letter = U and Resultant = R
11 | P a g e

Letter = H and Resultant = E
Letter = D and Resultant = A
Letter = V and Resultant = S
Letter = H and Resultant = E
Letter = W and Resultant = T
Letter = K and Resultant = H
Letter = H and Resultant = E
Letter = S and Resultant = P
Letter = U and Resultant = R
Letter = R and Resultant = O
Letter = F and Resultant = C
Letter = H and Resultant = E
Letter = V and Resultant = S
Letter = V and Resultant = S
Letter = R and Resultant = O
Letter = U and Resultant = R
Letter = I and Resultant = F
Letter = U and Resultant = R
Letter = H and Resultant = E
Letter = T and Resultant =Q
Letter = X and Resultant = U
Letter = H and Resultant = E
Letter = Q and Resultant = N
Letter = F and Resultant = C
Letter = B and Resultant = Y
So the Final Plain Text is INCREASE THE PROCESSOR FREQUENCY
12 | P a g e

References
 Computers at Risk. (2018). https://www.nap.edu/. Retrieved 8 April 2018, from
https://www.nap.edu/read/1581/chapter/4
 Chia, T. (2018). Confidentiality, Integrity, Availability: The three components of the CIA
Triad « Stack Exchange Security Blog. Security.blogoverflow.com. Retrieved 8 April 2018,
from https://security.blogoverflow.com/2012/08/confidentiality-integrity-availability-the-
three-components-of-the-cia-triad/
 What is confidentiality, integrity, and availability (CIA triad)? - Definition from WhatIs.com.
(2018). WhatIs.com. Retrieved 8 April 2018, from
https://whatis.techtarget.com/definition/Confidentiality-integrity-and-availability-CIA
 Why an ATM PIN Has Four Digits - Schneier on Security. (2018). Schneier.com. Retrieved
8 April 2018, from https://www.schneier.com/blog/archives/2007/07/why_an_atm_pin.html
 How many ATM pincode permutations/combinations can be produced with 4 digits?.
(2018). https://www.quora.com/. Retrieved 8 April 2018, from https://www.quora.com/How-
many-ATM-pincode-permutations-combinations-can-be-produced-with-4-digits
 Biometric Technology Application Manual Volume One: Biometric Basics Compiled and
Published by: National Biometric Security Projec. (2018). Retrieved from
http://www.planetbiometrics.com/creo_files/upload/article-files/btamvol1update.pdf
 (2018). https://brainly.in/. Retrieved 8 April 2018, from https://brainly.in/question/3170514
 Simple Ciphers Explained | Chapter No. 3 | Fasttrack To Cryptography | Digit. (2018). Digit.
Retrieved 8 April 2018, from https://www.digit.in/technology-guides/fasttrack-to-
cryptography/simple-ciphers-explained.html
 ciphers?, P. (2018). Possible ways to crack simple hand ciphers?. Crypto.stackexchange.com.
Retrieved 8 April 2018, from https://crypto.stackexchange.com/questions/3826/possible-
ways-to-crack-simple-hand-ciphers
 Fielding, A.H. and Bell, J.F., 1997. A review of methods for the assessment of prediction
errors in conservation presence/absence models. Environmental conservation, 24(1), pp.38-
49.
13 | P a g e