Teesside University: Report on Advance Security Techniques - CIS3001-N

This report provides a comprehensive analysis of advanced security techniques, focusing on a case study of ECHRS Ltd, a telephone and web portal service provider. It begins by outlining the organizational infrastructure and identifies potential vulnerabilities, particularly concerning data breaches. The report details the consequences and impacts of a data breach, including financial, legal, business reputation, and operational disruptions. It then recommends immediate actions to mitigate the breach, such as suspending operations, initiating audits, and changing passwords. The report also explores intrusion investigation using Intrusion Detection Systems (IDS) and Security Information and Event Management (SIEM) systems, differentiating between Network and Host IDS. Furthermore, it identifies potential attack vectors, including host-based attacks like malware and keyloggers, and discusses attack trees. Finally, the report suggests mitigation strategies, including threat modeling and the application of security principles, along with a reflection on the application of these techniques for future cybersecurity practices.

Running head: REPORT ON ADVANCE SECURITY TECHNIQUES
REPORT
ON
ADVANCE SECURITY TECHNIQUES
Name of the Student
Name of the University
Author Note:

1ADVANCE SECURITY TECHNIQUES
Introduction:
ECHRS Ltd is one of the telephone and web portal service provider that provides the
portal outsourcing services to its clients for enhancing the services of human resource
management as well as the payroll management throughout various sectors in Bradford. While
analyzing the organizational infrastructure it is identified that this organization consists of the
devices like desktop PCs with Windows XP to 101. Remote access to the devices and VoIP
telephony server as well. Along with this the data backup process is done with tape.
Followed by this investigation it has been noticed that in the organization performs there
activities based on the analysis of the large data which includes the several personal data of their
customers. Considering this concern they the organization has realized that they might attract any
intrusion thus, the have decided to analyze the organizational infrastructure, identified the
intrusion and mitigate them with possible actions2.
In order to support the investigation and the implementation of the appropriate mitigation
strategy this paper will help to identified that possible threats present in the organizational
structure and will also elaborate the impact of the identified threats related to the data breach.
Followed by the above identification it will then help to mitigate the identified threats with
immediate action3. Along with this identification it will further discuss about the possible threats
in which it will identify the vulnerabilities, the significance of exploitation as well as the tools of
demonstration.
1 Morgan, S., 2018. Preparing for the Canadian Data Breach Reporting Requirements. Int'l J. Data Protection
Officer, Privacy Officer & Privacy Couns., 2, p.8.
2 Rai, K., Devi, M.S. and Guleria, A., 2016. Decision tree based algorithm for intrusion detection. International
Journal of Advanced Networking and Applications, 7(4), p.2828.
3 Liu, L., Han, M., Wang, Y. and Zhou, Y., 2018, June. Understanding data breach: a visualization aspect.
In International Conference on Wireless Algorithms, Systems, and Applications (pp. 883-892). Springer, Cham.

2ADVANCE SECURITY TECHNIQUES
In consort with the above elaboration it will further discuss about the possible attack
vectors in which it will include an attack tree that consists of attack surface and attack vectors.
And after identifying the above vectors it will suggest effective mitigation strategies for those
vectors with methodologies and security principles. Lastly, this paper will consists an ICA
reflection where it will describe how these application may help in future.
Consequences & Impact of data breach:
After analyzing the organizational infrastructure of the nominated organization it has
been identified that it has faced a significant data breach which has effectively harmed that data
privacy of their clients. While analyzing the damage it is also identified that since, the primary
operation of the organization is being done with processing the client’s data thus, a major threat
of data breach has been identified in this scope4. The investigation has mentioned that in the
major impact of the data breach has mostly impacted the financial, legal as well as the business
of the nominated organization. Followed by this discussion the identified data breach
consequences and their impacts are mentioned below:-
Financial Impact-
While analyzing the organizational infrastructure of ECHRS Ltd., it is noticed that the
significance of the data breach has majorly impacted the field of accounts of the services
provider. Considering this aspect it is identified that due to the occurrence of data breach the
company has loses their accounts as the occurrence of data breach has cases a huge loss of data
which also consists the personal data of their customers and their many operational data thus, it
has significantly impacted their operations5. From this investigation it has been identified that
4 Khan, F.S., Kim, J.H., Moore, R.L. and Mathiassen, L., 2019. Data Breach Risks and Resolutions: A Literature
Synthesis.
5 Goode, S., Hoehle, H., Venkatesh, V. and Brown, S.A., 2017. User compensation as a data breach recovery action:
An investigation of the Sony PlayStation Network breach. MIS Quarterly, 41(3).

3ADVANCE SECURITY TECHNIQUES
due to the loss of these data and their operational strategy the company has failed to fulfill their
commitments which has caused a major loss in the business that has directly impacted the
financial aspect of ECHRS Ltd.
Legal Impact-
Along with the above considerations, since the organization is primarily based on
supporting their clients with telecommunication and web portal services thus, it consists as large
set of user data. It is very essential to protect those data for the organization with proper data
protection strategy. However, the organization does not seems to have any collaboration with the
GDPR that has influences the data breach incidence6. Hence, after analyzing this scenario it can
be stated that the occurrence of data breach has significantly violated the legal procedure of data
protection. As the organization has not incorporated with effective data protection strategy which
has caused major data breach.
Business Reputation-
Along with the above mentioned aspects it is identified that due to the occurrence of data
breach the organizational reputation will be significantly affected7. As for any organization it is
very essential to keep their information safe however which helps them to provide protection to
its organizational data. Considering this aspect it is identified that in data breach has majorly
taken the access of the personal data of the organization that has impacted the data privacy of its
users. Hence, it can be stated that it holds a major impact on the business reputation by losing the
customer trust.
6 SEissa, I.G., Ibrahim, J. and Yahaya, N., 2017. Cyberterrorism Definition Patterns and Mitigation Strategies: A
Literature Review. International Journal of Science and Research (IJSR), 6(1), pp.180-186.
7 Goliwale, P., Gupta, V., Johre, A. and Bendale, S., 2018. Intrusion detection system using data
mining. management, 5(03).

4ADVANCE SECURITY TECHNIQUES
Operational Disruption-
Followed by the above discussion it is also identified that the occurrence of data breach
holds a major impact on their organizational operations. As due to occurrence of data breach the
hacker steals the organizations important data that creates the damage in the operations of the
organization8. Hence, it can be stated that data breach hold a major impact on operational
disruption.
Recommended Immediate Action:
With allowance to the above identified impacts of data breach it has been determined that
in the organizational infrastructure of ECHRS Ltd. It is very essential to mitigate those with
immediate actions. Hence, in this section I will be discussing about the effective actions that will
help to address the data breach incident immediately. Those recommended actions are listed
below:-
Suspend all operations-
In case any occurrence of data breach it is very essential to suspend or stop all off the
operations of the organization that will help to stop the further progress of the data breach
incident. Since, while data breach will occur it will spread very fast thus, it will help to restrict
the infection if the device and the operations of the organization is in offline mode9. Considering
this concern it can be stated that the organization will then needs to analyze the offline systems to
identify the damage due to data breach.
8 Cheng, L., Liu, F. and Yao, D.D., 2017. Enterprise data breach: causes, challenges, prevention, and future
directions. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 7(5).
9 Sen, R. and Borle, S., 2015. Estimating the contextual risk of data breach: An empirical approach. Journal of
Management Information Systems, 32(2), pp.314-341.

5ADVANCE SECURITY TECHNIQUES
Start Auditing-
Followed by this concern while auditing the systems of the organization that will check
the actual damage area due to the occurrence of the data breach. Along with this it is also
identified that the auditing process will determine the remedies for mitigating the data breach.
Followed by this it also helps to determine whether the data breach is still processing in the
system or not.
Password-
Followed by the above aspect it is identified that changing the password will be also very
helpful to restrict the impact of data breach into the organizational infrastructure. While
analyzing the reason behind these incidents there is a major impact of week password protection.
However, changing those password into strong passwords will help to avoid further data breach
attack.
Identify the impacted area-
Along with the above mentioned aspect the developer must analyze the affected area due
to the occurrence of the data breach. Considering this aspect in order to mitigate the identified
threats, the determination of the impact will help to decide where the maximum focus is needed.
Which will help to address the attack of data breach will possible remedies.
Identification of cause of data breach-
Along with the above remedies it is also essential to determine the reason behind the data
breach and the types of data breach as this will help to determine the vulnerabilities and the root
cause behind the occurrence of the data breach. Thus, it can be stated that the adoption of this
strategy will help to identify intrusion of the threat.

6ADVANCE SECURITY TECHNIQUES
Establish communication-
Along with the above mentioned actions it is also very essential to the develop a
communication medium between the internal ends of the operational nodes of the organization
that will help to get all the update to every branch about any incident happens in the
organizational infrastructure. Hence, it can be stated that establishment of communication will
definitely help to get fast notification and make quick action.
Investigation of Intrusion:
Usage of Intrusion Detection System (IDS) can be used for performing proper
investigation of the illegal intrusions that might occur in ECHRS Ltd. IDS is mainly focused on
monitoring network traffic for analysis of the suspicious activities as well as issues that might
harm the network and lead to security policy breaching of ECHRS Ltd. In case of malicious
violation occurring in the network, IDS instantly updates the same to the administrator and hence
wise entire security issue is updated and collected centrally with the help of the Security
Information and Event Management (SIEM) System. The main role of the SIEM is to provide a
better integration of the outputs as well as the sources that will be alarming the filter techniques
for providing proper differentiation of malicious activities from the false alarms that might
occur10. The major issue that is present in IDS is that despite providing proper alarms against the
malicious attacks, it also probes false alarms. This issue have been eliminated with the help of
the SIEM. Hence installing SIEM in IDS acts important. This installation will be helping in
proper analysis of the normal network traffic that passes via the network and malicious activities.
IDS also monitors the network packets that are inbound to the system. This checking of the
10 Sidiroglou, S., Perkins, J. and Rinard, M., 2016. Cloud Intrusion Detection and Repair (CIDAR) (No. AFRL-RY-
WP-TR-2015-0183). MIT Computer Science and Artificial Intelligence Laboratory Cambridge United States.

7ADVANCE SECURITY TECHNIQUES
inbound network packets helps in proper assessing of the traffic that is entering the system11.
Hence wise proper provisioning of the warning is provided. There are 2 types of IDS systems
that are used in the process of monitoring the inbound packets. They are namely Network
Intrusion Detection System (NIDS) and Host Intrusion Detection System (HIDS).
NIDS is based on the theory of setting up of planned points in the network system that
helps in providing proper analysis of traffic that is inbound to the network. This system performs
observation of the passing traffic in the subnet and hence wise matches the traffic that has been
passing via subnets for collection of the attacks that are presumed. In case any of the attack is
detected, an alert is sent to the administrator. However, HIDS runs on a platform of independent
host and hence wise it helps in performing analysis of the security related issues that might arises
in the devices that are present in the network of ECHRS Ltd12. HIDS is focused on examining the
incoming as well as the outgoing packets from the devices that are situated in the network.
Hence wise proper analysis of the outgoing packets will be made. The process that is used in the
process is taking snapshots. Snapshots are taken in the initial state of the packet and after the
attack is made. The difference in the snapshot acts as the major aspect that benefits the
functioning process. In case any of the analytical files are edited, an alarm is sent to the
administrator and so is performed even a file is deleted. This helps the administrator to take a
look into the matter. This strategy is used for proper examining of the critical machines that are
present in the network.
11 Chen, H.S. and Jai, T.M.C., 2019. Cyber alarm: Determining the impacts of hotel’s data breach
messages. International Journal of Hospitality Management, 82, pp.326-334.
12 Bodner, D.A., 2015. Mitigating counterfeit part intrusions with enterprise simulation. Procedia Computer
Science, 61, pp.233-239.

8ADVANCE SECURITY TECHNIQUES
Potential Attack Vectors:
There are several potential attacking vectors in case of ECHRS Ltd. The major attacking
vectors include the likes of Hosts, Active attacks and Passive attacks. The attacking vector in
case of Host is directed straight towards the devices or the host. The most effective host attacking
vectors are namely t. It have been observed that in case of Malware, it includes programs that
will be introducing several malicious codes in the host computing devices of ECHRS Ltd. This
includes the likes of virus, Trojan and worms. These attacks are capable of imposing several
attacks in a single go. The damage that are caused are invaluable in nature. Again another
attacking vector of host is key blogger. In this case, the key bloggers tends to collect as much
data that can be collected via keyboard. Even taking screen shot of data have been an attacking
vector for this kind. Again social engineering is sectioned in 2 different sections, namely
phishing and spam. Phishing is based on deceiving the administrative body and fetch data from
the database and gain access to data that are private13. Gaining data with the help of spoofing
have been another major issue that is to be considered. Again spam is considered as unsolicited
messages that are sent to the user system in form of advertisements. These advertisements are
sent in repetitive manners. The major platform that is used in this case is email. Instant messages
are also used in this process for performing such attacks. Unsolicited attacks are also performed
in this attack section.
The cyber security vector in case of Networks are subdivided in 2 sections. The 2
sections are namely Active attacks and Passive attacks. In case of Active attack, spoofing, DDoS,
Modification and Fabrication are considered as the vectors14. In case of Spoofing, identity theft
13 Valecha, R., Bachura, E., Chen, R. and Rao, H.R., 2016, December. An Exploration of Public Reaction to the
OPM Data Breach Notifications. In Workshop on E-Business (pp. 185-191). Springer, Cham.
14 Amara, N., Zhiqui, H. and Ali, A., 2017, October. Cloud Computing Security Threats and Attacks with Their
Mitigation Techniques. In 2017 International Conference on Cyber-Enabled Distributed Computing and Knowledge
Discovery (CyberC) (pp. 244-251). IEEE.

9ADVANCE SECURITY TECHNIQUES
had been the major aspect that is to be considered. It have been seen that network address is
altered, which leads to the fact that data packets are redirected to other direction. Again in case of
DDoS, the network is constantly kept busy, which leads to the fact that packets that are inbound
in nature gets blocked and there is a constant disruption in the normal service delivery. In the
modification process, the main aspect that is considered is that the routing tables are modified
without proper authorization15. Fabrication is based on providing a false route for providing
obstacle for the information to reach the destination. This imbibes the fact that information does
not reach the destination where it is intended.
Again in case of passive attack vector, the major listings that might be considered are
namely sniffing or traffic analysis, supervision as well as eavesdropping. In case of the Sniffing
or traffic analysis, attacker detects the path of communication and hence wise there is a
miscommunication in between the receiver and the sender16. Hence wise the imposter gets to
know the amount of data that is being transacted. Eavesdropping is based on ad-hoc mobile
network. Intercepting the means of communication have been the major goal of the attacking
vector.
Mitigation with relevant threats modelling techniques:
There are 5 major steps that are to be implemented for mitigating the existing threats. The
steps that are to be mitigated are namely training the final users of the network and the
computing system. Proper usage of firewall might also be acting helpful in the process. Making
15 Ablon, L., Heaton, P., Lavery, D.C. and Romanosky, S., 2016. Data Theft Victims, and Their Response to Breach
Notifications.
16 Atre, A. and Singh, R., 2016. A Concept on Intrusion Detection System Genetic Algorithm, Fuzzy Logic and
Challenges–A Review. International Journal of Scientific Research in Science, Engineering and Technology, 2(1),
pp.287-89.

10ADVANCE SECURITY TECHNIQUES
periodic updates are also considered to be important. Keeping an eye on the latest trend of the
digital security might also act helpful in the process. Constant updating of the antivirus might
also act important for ECHRS Ltd. in order to eliminate the risks that might be faced. In this
process.
Training of the final users: The users who will be using the network needs proper training
in increasing the security of the platform. It is considered that for increasing the robustness of the
system, the main aspect that is to be considered is that due to the lack of knowledge regarding
security of network among the users have been acting as a major reason of presence of loop
holes that are present in the networking systems. Hence if proper training is provided regarding
the scope of insecurity and data breach the entire issue can be eliminated. This process can be
performed with the help of regular talks with the users and provide them with proper
consultancies regarding the loop holes that ensures that robustness of the network system gets
higher.
Firewall usage: the major benefits that are received due to the usage of firewall are
blocking trojan, preventing hackers and preventing key loggers. With the help of this character of
preventing Trojan, the main benefit that is received is that the firewall intrudes latches in the
computer files and hence wise this ensures that the entry of the Trojan is blocked in the initial
stage17. Another benefit that is received is that it prevents access of the hackers. It have been seen
that hackers try to gain access to the computing system and hence try to make entire computing
system more robust. Preventing key loggers have been another main aspect that is to be
considered18. A key logger is mainly focused on spyware software intrusions that are focused on
17 Amara, N., Zhiqui, H. and Ali, A., 2017, October. Cloud Computing Security Threats and Attacks with Their
Mitigation Techniques. In 2017 International Conference on Cyber-Enabled Distributed Computing and Knowledge
Discovery (CyberC) (pp. 244-251). IEEE.
18 Zheng, X., Roelofs, A.P.A. and Lemhöfer, K.M.L., 2019. Language Selection and Intrusion Errors in Speaking.

11ADVANCE SECURITY TECHNIQUES
trials of cyber criminals. These criminals targets the keystrokes and hence wise this affects the
identification of the private online accounts. Firewall prevents these security related issues as
well.
Making periodic updates ensures that the software stays updated so that the loop holes
that are present in the system19. Hence with regular updates being provided, the loop holes are
eliminated. Hence this increases the robustness of the system.
Again proper back up of the data of the data is to be taken. This will be acting beneficial
in case increasing the robustness of the data that are stored20. It have been seen that even of the
data is breached, it can be retrieved.
ICA Reflection:
After completion of this discussion I have learned several important aspect of IT security,
impacts and its mitigations. While analyzing the infrastructure of the nominated organization it is
identified that there is a major data breach threat is present that majorly impacts the business,
legal concern as well as the financial aspect of the organization. However, after getting the idea
about the immediate mitigation actions I have learned that few easy and smart tricks may help
the prevention for data breach. Making allowance to these, the study has also helped to get a
detail idea about the possible intrusion into the organizational infrastructure that may impact the
services to the organization as well as the data privacy of the organizational data. Along with the
identification of the intrusion it has helped to mitigate the intrusion with possible approaches.
Hence, after completion of this study it can be declared that this study will help me in future
19 Astani, M. and Ready, K.J., 2016. Trends and preventive strategies for mitigating cybersecurity breaches in
organizations. Issues in Information Systems, 17(2).
20 Zuech, R., Khoshgoftaar, T.M. and Wald, R., 2015. Intrusion detection and big heterogeneous data: a
survey. Journal of Big Data, 2(1), p.3.

12ADVANCE SECURITY TECHNIQUES
while developing advance security process for any organization as this has significantly helped
me to asses and mitigate the organizational risk.
Bibliography:
Ablon, L., Heaton, P., Lavery, D.C. and Romanosky, S., 2016. Consumer attitudes toward data
breach notifications and loss of personal information. Rand Corporation.
Amara, N., Zhiqui, H. and Ali, A., 2017, October. Cloud Computing Security Threats and
Attacks with Their Mitigation Techniques. In 2017 International Conference on Cyber-Enabled
Distributed Computing and Knowledge Discovery (CyberC) (pp. 244-251). IEEE.
Astani, M. and Ready, K.J., 2016. Trends and preventive strategies for mitigating cybersecurity
breaches in organizations. Issues in Information Systems, 17(2).
Atre, A. and Singh, R., 2016. A Concept on Intrusion Detection System Genetic Algorithm,
Fuzzy Logic and Challenges–A Review. International Journal of Scientific Research in Science,
Engineering and Technology, 2(1), pp.287-89.
Bodner, D.A., 2015. Mitigating counterfeit part intrusions with enterprise simulation. Procedia
Computer Science, 61, pp.233-239.
Chen, H.S. and Jai, T.M.C., 2019. Cyber alarm: Determining the impacts of hotel’s data breach
messages. International Journal of Hospitality Management, 82, pp.326-334.

13ADVANCE SECURITY TECHNIQUES
Cheng, L., Liu, F. and Yao, D.D., 2017. Enterprise data breach: causes, challenges, prevention,
and future directions. Wiley Interdisciplinary Reviews: Data Mining and Knowledge
Discovery, 7(5).
Goliwale, P., Gupta, V., Johre, A. and Bendale, S., 2018. Intrusion detection system using data
mining. management, 5(03).
Goode, S., Hoehle, H., Venkatesh, V. and Brown, S.A., 2017. User compensation as a data breach
recovery action: An investigation of the Sony PlayStation Network breach. MIS Quarterly, 41(3).
Khan, F.S., Kim, J.H., Moore, R.L. and Mathiassen, L., 2019. Data Breach Risks and
Resolutions: A Literature Synthesis.
Liu, L., Han, M., Wang, Y. and Zhou, Y., 2018, June. Understanding data breach: a visualization
aspect. In International Conference on Wireless Algorithms, Systems, and Applications (pp. 883-
892). Springer, Cham.
Morgan, S., 2018. Preparing for the Canadian Data Breach Reporting Requirements. Int'l J. Data
Protection Officer, Privacy Officer & Privacy Couns., 2, p.8.
Rai, K., Devi, M.S. and Guleria, A., 2016. Decision tree based algorithm for intrusion
detection. International Journal of Advanced Networking and Applications, 7(4), p.2828.
SEissa, I.G., Ibrahim, J. and Yahaya, N., 2017. Cyberterrorism Definition Patterns and Mitigation
Strategies: A Literature Review. International Journal of Science and Research (IJSR), 6(1),
pp.180-186.
Sen, R. and Borle, S., 2015. Estimating the contextual risk of data breach: An empirical
approach. Journal of Management Information Systems, 32(2), pp.314-341.

14ADVANCE SECURITY TECHNIQUES
Sidiroglou, S., Perkins, J. and Rinard, M., 2016. Cloud Intrusion Detection and Repair
(CIDAR) (No. AFRL-RY-WP-TR-2015-0183). MIT Computer Science and Artificial
Intelligence Laboratory Cambridge United States.
Valecha, R., Bachura, E., Chen, R. and Rao, H.R., 2016, December. An Exploration of Public
Reaction to the OPM Data Breach Notifications. In Workshop on E-Business (pp. 185-191).
Springer, Cham.
Zheng, X., Roelofs, A.P.A. and Lemhöfer, K.M.L., 2019. Language Selection and Intrusion
Errors in Speaking.
Zuech, R., Khoshgoftaar, T.M. and Wald, R., 2015. Intrusion detection and big heterogeneous
data: a survey. Journal of Big Data, 2(1), p.3.