[SOLVED] EE5815 Topics in Security Technology Assignment 3 R

EE5815 – Topics in Security Technology

Assignment 3

Electronic submission only on Canvas

Submission guidelines:

–     Please prepare your assignment in “PDF” format.

–     For observe the departmental rules for late submission (i.e. 10% deduction per day).

–     10 points for each question.

Security Management

1)  Assume that you area manager responsible for the security of e-Banking systems in a bank. You heard that HongKong Monetary Authority (HKMA) had a guideline called the “Supervision of E-banking”

a)    Google for the document, and give the URL showing where the above HKMA guideline fore-Banking can be found.

b)   Read  the  HKMA  guideline.  Briefly  describe  at  least  three   major technology-related controls relevant to e-banking that you need to consider in youre-Banking infrastructure.

[Hint: you only need to give a brief description (that is, a few lines) summarizing  the  main  points.  Please  don’t  simply  copy  pages  of paragraphs from the HKMA document without understanding. ]

c)    Your  HK  e-Banking  system  is  using  a  Cisco firewall to protect the Internet  perimeter  and  your  IT  colleagues  are  familiar  with  this firewall. Now, to strengthen the security, it is proposed to purchase for another firewall to set up another tier of internal firewall.  Your IT colleagues proposed to purchase the same Cisco firewall and use itas an internal firewall. Would you approve this proposal? Why?

d)   Goto the bank’s website of your account, is this website secure? Why? Identify  the  digital  certificate  from  the  website,   and  collect  the following information:  1)  Issue to,  2)  Issue  by,  3) Validity  Period, and 4) Fingerprints.

e)    Please collect the information in d) with the help of CityUGPT. Please notify the differences and analyze them

Public Key Systems

2)  In the RSA cryptosystem, it is possible that M = C, that is the plaintext and the  ciphertext  are  identical.  For  modulus  N  =  667,  and  encryption exponent e = 3, how many messages M would encrypt to itself? Please do not consider M = 0 or 1 in this question.

Technical Tools

3)  Network packet sniffing.

a)     Install Wireshark to your machine. Please show evidence (e.g. screen dump) that you have downloaded and installed this package into your personal computer.

b)     Describe the purpose of this program.  How do you start capturing the packets, and how do you use filters for just TCP packets?

c)     Start capturing the packets. While packet collection is still running, attempt to access to your email.

Describe:

How you access to your email (e.g. using webmail, or pop3, etc)

Can your username and password be seen during the sniffing process?

During  the  sniffing  process,  can  you  observe  other  network protocols in addition to the protocol that you used for email access? If so, name two such protocols and briefly explain why they exist.

d)     Compare the operations in b), c) and the operations you have done in the team-based  learning  class.  Briefly  describe  the  similarities and differences.

4)  Install a mobile banking app to your iOS or Android device (if you don’t have these devices, do this exercise with a web browser connecting to an e-banking site).

a)    Name the app or web environment you will use in this exercise.

b)   Google for “web debugging proxy”. Pick one of such tools (e.g. “Fiddler Web Debugger”, “Burp Suite”, etc) and attempt to use it as a proxy to capture the list of URLs visited by your chosen mobile banking app.

Go to the login name, and arbitrary input values to attempt to login (You don’t really need to login with a valid username / password; a failed login is good enough.  But please only try it once)

Show the list of URLs that will be involved in the login process. Are all requests to the bank protected by SSL?

c)    Display  the  digital certificate of the BOCHK website, and elaborate what kind of encryption standards are being used in this certificate.

Sage Questions

5) ECC Question,please show your code and results in your answers.

a.)  Define  an  elliptic  curve  over  the  finite  field  with  suitable  parameters where p should be a 11-bit prime.

b.)  Encrypt  the  message  M=”2024EE5815″  using  ECC  with  the  NIST’s secp521 elliptic and decrypt back the plaintext.

6) RSA Question, please show your code and results in your answers.

a.)  The RSA key ‘n’ is 4819. What are the factors (pand q) of ‘n’?

b.) Using (a),when e = 7, what are the corresponding public and the private keys?

c.)  The RSA encrypted message ‘C’ is received by both Alice and Bob whose

private   and    public    keys    are    ‘da,     (ea,    na)’    and    ‘db,     (eb,    nb)’ respectively. If the original message before the encryption is ‘M’,who is the intended recipient of the message? [M=190,  C=1912,  (ea,  na)=(31, 5293),   da=2491,   (eb,   nb)=(31,   4891),   db=3679].  Please  show  your detailed process of computing.

Hands-on Practice Question

7) In this exercise, you need to create a free account on Google Cloud Product and learn  one  tutorial   on https://cloud.google.com/docs/tutorials to  use  Google Cloud to use function and products to realize some design on the website.

The followings are some instructions for this lab session.

Requirements:

a)   Please  notify which tutorial you read and what you have learned in Google Cloud,or

b)   (10 points) You can also learn other products of cloud products. Please also introduce the content as shown in a).

c)   (Bonus:  10 points) You can finish one tutorial with the help of guidance and generate certain outputs. Please show your results and introduce what you have learned in this process.