Introduction to Cyber Security Proof Reading Services

Introduction

In the current world of technological evolution, people and institutions rely on the information systems to communicate and share information as well as store vital institution’s data. Information system involves a network of assets which co-ordinate together to store, transform, retrieve and disseminate information of a learning institution, a corporation or a business. Information systems have essential contributions to the educational sector. To harness the benefits of individuals using their own electronic devices the Southern Cross University have adopted the policy of Bring Your Device (BYOD) to classes at Performance Management Education.

The use of these electronic devices to access, process and create the information and data of the university generates issues concerning information security breaches. The institution needs to implement strategies to prevent security breaches to the information and data. The university should undertake the information security strategies to guarantee that it still controls and manages the data accessed using BYOD device and also ensure that few reasonably possible restrictions are imposed on the university information resources accessed utilizing the BYOD policy.

This report analyzes the critical information assets of the university and discusses the threats caused by BYOD policy. It will also explore certificate-based authentication and compare with another authentication technique and also provide spam handling instructions for the university.

TASK 1

BYOD Risk Assessment

In developing, information security strategy, the first essential procedure is to identify and comprehend the critical assets that require protection. The critical information assets in an organization are the assets that impact integrity, confidentiality, availability and support the institution’s mission and vision and it strategic objectives[ CITATION Bor15 \l 1033 ].

1. The critical information assets of Southern Cross University are namely
2. Educational and research: examinations, intellectual development, research projects and information about students
3. Human resources: personal data of staff and reports.
4. Legal: contracts and internal documentation, employees confidential information of staff
5. Finance and Economics: financial information and procurement documentation
6. Information Technology: Databases, logins, and passwords, IT management information and IT developments copyright

BYOD Policy: Threats and Vulnerabilities

The adopted BYOD policy in classes at Performance education will arise various threats to the identified critical information assets of the university. Organizations have no complete or little control of the electronic devices in which their employees are utilizing and also have no control of the security conditions when employees are assessing its information systems[ CITATION Dan15 \l 1033 ]. The threats which may be brought by the BYOD policy are malware, phishing, social engineering, malicious mobile applications and Denial of service. Phishing is a well-constructed email that evades the network security strategies and obtains information systems data[ CITATION JCh14 \l 1033 ].

Malware is a rapidly growing information systems problem due to a high number of downloads and applications[ CITATION Pat131 \l 1033 ]. Malware may be utilized to steal the confidential information of employees and students and deviate financial transactions by using the security vulnerabilities such as insecure wireless networks and weak firewalls brought about by the mobile devices which cannot be controlled by the information technology department[ CITATION Cue15 \l 1033 ]. Phishing utilizes vulnerabilities such as personal cloud services and social networks in an unacknowledged staff or student collaboration environment to obtain financial gain and steal personal information. In social engineering, spam emails and spam on social networks utilize the vulnerabilities of human emotions to spread malware and inappropriately obtain confidential staff and students’ data. Denial of service threats results from vulnerabilities due to improper network planning resulting from the adoption of mobile electronic devices results in attacks on databases and log repositories. Vulnerabilities such as mobile device misconfiguration occur when employees install unauthorized and non-corporate applications which then provide opportunities for stealing institution information such as legal documents.

Risk Assessment

Information system risk assessment is implemented to give an a prioritized assessment and evaluation of the probability and impact of information security occurrences and presenting the potential threat to the information from each scenario as well as the existing protective measures[ CITATION She16 \l 1033 ]. In deciding whether to implement a quantitative and qualitative risk assessment, the advantages and disadvantages of the two frameworks are analyzed. Quantitative style advantage is that it takes into consideration the risks and locates section that requires urgent action[ CITATION Tix17 \l 1033 ]. Its disadvantage is that it makes cost-benefit analysis difficult because it does not provide specific, quantifiable magnitude of impacts measurements. Qualitative style advantage is that it provides cost-benefit analysis since it provides specific, quantifiable magnitude of impacts measurements. Its disadvantage is that its outcomes may be unclear depending on the measurements' numerical range.

The risk assessment process to be used by the university is outlined below;

Determine the critical processes of the university that guide and support them in attaining the institution’s objectives and mission. The senior administrators and the information systems senior officers should develop a framework for determining the critical processes of the university.

Identification of the information assets from the determined critical processes undertaken by the university in achieving their duties and mission objectives.

Establishment of the risk analysis scope and the objectives by considering the critical processes and the information assets of the university and taking into account the resources available to execute the activities.

Review of the Institution’s environment and develop a list of the possible threats scenarios and potential threat agents.

Evaluation of the risk scenarios by determining the probability of threat occurrence and their potential impact on the institution’s information systems

Determination of the framework for solving the identified risk; prevention, mitigation, avoidance,

Determine the cost-benefit analysis of the defined risk scenarios by taking into account the risk level of the classified information assets.

Selecting the security strategies to be adopted to lessen the risk levels on the critical information system assets of the institution

Task 2

Certificate-Based Authentication

Introduction

Threats of Bring Your Device and threats of rogue machines has resulted in institutions adopting information security strategies that ensure approved users and devices to access the network resources. One such security strategy which should be adopted by the Southern Cross University is Certificate-Based Authentication. This technique employs the use of a digital certificate to identify a user and device before giving access to an organization’s information system resources. Certificate-Based Authentication comes with various benefits namely user-friendly, easy deployment and management, mutual authentication, easy to extend to eternal users and leverages on existing policies.

Working Principle of certificate based authentication

The working principle of certificate-based authentication can be elaborated in the following steps[ CITATION ONe17 \l 1033 ];

A certificate with published public keys is issued for a client, and private keys database corresponding to the public keys is maintained by the client software. The password to the database is given to the client upon request for the first time in any given session.

The private key for the user’s certificate is retrieved by the client by unlocking the private database and then utilizes the private key to digitally sign randomly generated data. The digitally signed data and the signature act as evidence for the validity of the private key

The randomly generated signed data evidence and the user’s certificate is then sent by the client through the network

The server then utilizes the submitted evidence and the user's certificate to authenticate the identity of the user.

Finally, the server further performs other authentication tasks such as the presence of a certificate in an LDAP entry evaluation of the client permission to access a particular resource. If the user is allowed, its then enable the user to access the requested the information system resource.

A typical certificate based authentication is where a server requests a client to provide a valid certificate in order to allow access[ CITATION ONe17 \l 1033 ]. The user then authenticates with his username and password. User’s identity is not performed in this type of authentication since the certificate is not cross-checked (Figure 1)