Security Fundamentals: Assessment Item 1 - Analysis and Solutions

This document presents a comprehensive solution to an assessment on security fundamentals. It addresses the confidentiality, integrity, and availability aspects of ATM security, exploring the vulnerabilities related to PIN access and the limited chances a thief has of accessing customer accounts. The assignment delves into the use of biometrics as a robust authentication method, highlighting its unique features and advantages. Furthermore, it analyzes the implications of false positive and false negative rates in biometric systems, discussing their consequences across safety, institutional, and personal contexts. Finally, the solution explores various methods for decoding encoded text, including tools like OllyDbg and techniques such as substitution ciphers and data encryption algorithms, providing a detailed overview of encryption and decryption principles.

Assessment item 1 Security
fundamentals

Contents
QUESTION 1..................................................................................................................................1
QUESTION 2..................................................................................................................................1
QUESTION 3..................................................................................................................................1
QUESTION 4..................................................................................................................................2
QUESTION 5..................................................................................................................................2
REFERENCES................................................................................................................................3

QUESTION 1
ATMs that are provide as the services by different backs are high confidential, integrated
and has high availability. Below given are the examples for each these three aspects:
Confidentiality: Individuals make use of card and PIN in order to get access to their
account using ATM. In accordance with the expectations of customer, PIN to be confidential in
host system and at the time when transactions along with communication channel between bank
server and host system (Jerkins, 2012). At the time when the Pin is unsecure, then during
transaction account can get compromised and it is important to make use of the PIN and card
properly and it should be encrypted.
Integrity: As per the expectations of customer, the transaction records are with not
accidental or malicious charges involved. For example, when a person withdraws $1000 and as
the balance it show $43500 but accidently, balance shows $43200, then these are considered to
be unexpected loss. The transaction performed affects the users account and so integrity for
transaction should be secured.
Availability: All the ATMs should be available 24*7 as it enables to increase the growth
of banks.
QUESTION 2
In accordance with the scenario given, there are in total 3 chances in which the thief can
discover the PIN of customers. In this context, it can be stated that the thief will not be able to
get the access to the account of customers as there are very few chances on which the Pin code
can go right (Tandon, Sharma and Vincent, 2013). This way, it can also be stated that the thief
have very little chances of getting success.
QUESTION 3
Biometrics is considered to be the authentication of the basis of which common physical
characteristics of the body. In this modern era, this is considered to be most robust and consists
of features that are unique to individuals but are present in all individuals. It includes features
like retina, figure print, iris, etc. are unique identifies that only a person can have (Bolle, Connell
and Senior, 2013). All the authentication done through biometrics is beneficial as the data cannot
be lost and can’t be stolen. Apart from this, it is always available.
1

QUESTION 4
False positive rates are determined to be the situation in which unauthenticated user
identity is accepted. On the other hand, false negative rates are the type of situation when
authenticated user gets rejected. Both these situations are complementary situation and they
share inverse relation. There are different types of consequences of false negative and they are as
follows:
Safety: A person at the datacentre collapses due to cardiac arrest and so the biometric
system does not recognises.
Institutional: Condition when complete server is down, even then the biometric system
will not recognize (Simmons, Nelson and Simonsohn, 2011).
Personal: The condition when a person is not physically present for using the system,
then any other person cannot access it.
QUESTION 5
There are various ways by which the encoded text can be decoded. Some very well-
known and common ways includes some tools and techniques that can be used to decrypt the
code. Tools like OllyDbg and the SnD Crypto Scanner can be determined as one of the way by
which a piece of cipher text can be determined quickly if it was likely a result of a transposition.
Further, one of the technique that can be applied for converting into subject is substitution
cipher. This is a type of method of encrypting with the help of which the units of plaintext are
replaced with ciphertext. The units that are included consists of single letters, triplets of letters,
pairs of letters, etc. Apart from this, there are number of various other types of substitution
cipher and this is dependent upon letters (Luthra and Pal, 2011). In condition of single letters,
then it is termed to be simple substitution cipher. Further, the cipher which operates larger
groups of letters, then it is termed as polygraphic. Another type of strategy is Data encryption
algorithms, this is a type that is used for to encrypt and decrypt different parts of messages that
also includes signature and body content. Further, this is helpful enough to specify the algorithm
uniform resource identifier (URI) of the data encryption method.
2

REFERENCES
Bolle, R. M., Connell, J. H., & Senior, A. W. (2013). Guide to biometrics. Springer Science &
Business Media.
Jerkins, J. A. (2012). Virtual network community detection with a message induced
graph. Journal of Computing Sciences in Colleges, 27(5), 108-115.
Luthra, J., & Pal, S. K. (2011). A hybrid firefly algorithm using genetic operators for the
cryptanalysis of a monoalphabetic substitution cipher. In Information and
Communication Technologies (WICT), 2011 World Congress on (pp. 202-206). IEEE.
Simmons, J. P., Nelson, L. D., & Simonsohn, U. (2011). False-positive psychology: Undisclosed
flexibility in data collection and analysis allows presenting anything as
significant. Psychological science, 22(11), 1359-1366.
Tandon, A., Sharma, R., & Vincent, P. M. (2013). QR Code based secure OTP distribution
scheme for Authentication in Net-Banking. International Journal of Engineering and
Technology (IJET), 5(3).
3