What are different modes of unauthorized access?

You or your company might have a number of resources that you might need to protect from unauthorized people and ensure that only people who have a right to access these resources can access and use them. These resources might be either personnel, physical or informational. All this is done using access control. It is not just about creating user names and passwords whenever resources have to be accessed. There are many models, techniques, methods that can be implemented to maintain security. Also there are a number of types of attacks against each type of the distinct methods. In the process of authorization, access is granted to the authenticated subjects. It involves carrying out specific operations based up on the predefined access rights mentioned in the access criteria. This criterion is based up on the following factors:
- Clearance: Security level of the subject.
- Need – to – know: The approved formal access level.
Attackers employ a number of tricks and techniques for gaining unauthorized access to the resources and information of the company. Necessary countermeasures need to be taken so that these threats can be identified and eliminated.
There are different modes of unauthorized access as discussed further:
- Unauthorized disclosure of information: The disclosure of sensitive information might be intentional or accidental. Whatever the cause maybe, the results are always same. The individual get the information that they were not intended to access. A large part of the access control is about preventing such types of incidents from taking place. People might use different kinds of media for sharing information around the organization such as hard drives, floppy disks, shares on servers and so on. These media might contain sensitive information that might get in to the hand of the people for which it is not intended. Also new employees might be assigned old computers to work up on which might also contain some sensitive information stored by the former employees. Object reuse is one example where some object containing sensitive information might be used by other subjects.
- Emanation security: Attackers can even intercept electrical signals for stealing the information. The signals are radiated by the computers and other devices which can be intercepted by attackers by means of some specialized equipment. Using the right software as well as hardware, this information can be reconstructed without coming into the knowledge of the users using it. Main countermeasures include control zones, white noise and the TEMPEST.
- Man – in – the – middle attacks: An intruder drops in to a conversation going on between two hosts and intercepts the messages. Sequence numbers and digital signals can be used as countermeasures.
- Sniffing: This is a type of passive attack when the network is monitored by the intruder for gaining info concerning the victim and is used for attacking later. Data encryption can be done for preventing all this.
- War dialing: This is a kind of brute force attack where a program is used by the attacker using which it dials a large bank of phone numbers. This is done to check which phone belongs to a particular modem. Using this, the attacker can gain access to the network. Not publicizing telephone numbers is one countermeasure.
- Ping of death: In this Denial – of – service attack, the attacker sends oversized ICMP packets to the victim host. If the host is not familiar with how to handle such large packets, it may reboot or freeze. Implementing ingress filtering and patching the systems are some counter measures for detecting such oversized ICMP packets. Another type of DoS attack is the WinNuk.

What are some of the different cyber security standards?

Over a period of time, there have been many security standards developed that have lead to organizations being able to increase their level of security and preventing because of which the organizations are becoming more capable of safely practicing security techniques. These standards are termed as cyber security standards and are meant to minimize the chance of successful attacks on organizations and increase their cyber security. In these guides, a general outline of cyber security is given along with the specific techniques that should be implemented. There are certain standards for which an accredited body can grant a cyber-security certification. With cyber security certification one gets many advantages and one of them is benefits in terms of cyber security insurance.
Nowadays a lot of sensitive and critical information is stored on networks, clouds and computers and this is one of the reasons behind the creation of these standards. Different cyber security standards are:

- ISO/ IEC 27002: This calls for assurance and security of the information. A part of the security management practice is given in the ISO/ IEC 27002. It is also known as BS7799. It serves as a guide for good cyber security management. This is a very high level explanatory guide. This standard emphasizes that confidentiality, integrity and availability characterize the information security. It consists of 11 control areas namely:
- Security policy
- Organizing information security
- Asset management
- Human resources security
- Physical and environmental security
- Communications and operations
- Access controls
- Information systems acquisition, development and maintenance
- Incident handling
- Business continuity management
- compliance

- ISO/ IEC 27001: This is a part of the BS7799 standard which offers guidance on framework for certification or we can say that the part 2 of this standard has been replaced by ISO/ IEC 27001 standard. This standard is backward compatible so that any organization using BS7799 part 2 faces no problem in implementing this. This framework is a management system that is used in implementation of the control objectives ISO 27002 that are incorporated in to ISO 27001.

- SoGP (standard of good practice): This standard is essentially a list of best information security practices published by ISF i.e., the information security forum. It also provides a comprehensive SoGP benchmark program.

- NERC (north American  electric reliability corporation) offers many standards such as NERC 1300, NERC 1200, CIP – 002 – 1 to provide security to the bulk electric systems.

- NIST: Has provided the following standards:
- 800 – 12: Overview of the computer security along with control areas, importance of these controls, ways of implementation.
- 800 – 14: Lists most common security principles that are followed everywhere, description of computer security policy, suggestions for improvement and development of new practices.
- 800 – 26: Offers advice for the management of IT security, risk assessments and self-assessments.
- 800 – 37: Introduced a new approach for the application of risk management framework for the federal information systems.
- 800 – 53: It provided a guide for the assessment of the security controls for the federal information systems.
- ISO 15408: The common criteria are developed by this standard. it permits a number of software applications for integration and testing.
- RFC 2196: This is more like a memorandum about the development of security procedures and policies for the information systems that are connected through internet.
- ISA/ IEC – 62443: It provides all the related information such as standards and technical reports for defining the implementation of the control systems especially IACS (industrial automation and control system). The guidance is also for security practitioners, end users, control system manufacturers and so on.

Security - What are the principal ways to secure a wireless network?

Securing a wireless network is as important as securing wired networks, and in many cases even more since it can be easier to tap into a wireless network. One or the other time all of us might have used a WiFi network which might be unsecure (highly unsecure, or may have recent holes that are not yet patched). But this would not do much harm if you are just honestly looking for connecting to the internet. If you own an unsecure wireless network, you should know that everyone is not honest as you are. Attackers with bad intentions can know what activities are taking place in your network and how your network resources can be exploited.  This problem can be fixed by following some basic principles of securing your wireless network:
- WEP and WPA encryption: Encryption is the first line of defense that you can call up for the security of your network. The data that your PC transmits to the wireless router is encoded. But usually what happens is that in most of the routers this option is disabled. You first need to check if it is enabled or not. If you keep it disabled, it will expose your network to several vulnerabilities. You should keep the encryption in enable mode and use the strongest form that is supported by your computer. WPA2 is more sophisticated when compared to WPA. WEP can be easily cracked and so it has been replaced by the most recent version of WPA i.e., the WPA2. One thing to be taken care of is that all the devices should have either WEP or WPA if you are using either of them. These two protocols cannot be mixed and used. The WEP uses the same key every time but this is not the case with the WPA. Here the keys keep on changing dynamically. This makes it almost impossible to hack. The encryption key must have a strong password like a combination of numbers and letters of more than 14 characters. If your computer has an old router that supports only WEP, use the 128-bit WEP key as it is the safest. But you should continuously keep checking for a firmware update at the manufacturer’s website. This update will provide WPA support to WEP. If no update is available, you can replace the old routers and the adapters with their new models that provide support for WPA. It’s better to go with hybrid version of the routers that support both WPA and WPA2. This will provide stronger encryption at the same time while maintaining compatibility with the other adapters.
It should be made sure that the default network name as well as the password have been changed. Doing so will make it difficult for the hackers to break int o the system and change its configuration. Even if you do have a firewall in the router, additional security measures have to be taken. The firewall does not lets the hackers break in to the system. But it does not stop people that lie in to the geographical range of wi-fi from accessing the network. There are readily available tools that can be used for sniffing the traffic through your wireless networks. To supplement the security, the software firewall should also be installed on the computer. Public hotspots are typically very unsecure.  If there are no precautions it should be assumed internet traffic whether incoming or outgoing is visible to the attackers. Before connecting to the network always make sure that is a legitimate one, make sure that the firewall is enabled. And keep the file sharing option to off. You can check whether you have selected the appropriate security options in the firewall settings. These are some tips to increase your security level when dealing with WiFi.

Security - What are some of the different ranges of wireless security measures?

When you get to be serious about wireless security, there are several mechanisms / measures that you can take, here are some details of the problem and solutions:
First – generation wireless networking has made it hard to decide whether or not you should deploy a wireless local area network (WLAN) even though there are many shortcomings such as rampant threats, vulnerabilities of the protocol and so on. Sometimes you might feel like banning the WLAN neglecting its advantages in business due to a fear of rogue AP (access points) cropping up. In either of the cases it’s a no- win situation. However, over a period of time, wireless protocols have been revised with some improvements that have made them more secure. Given the various threats (some of which can be innovative), wireless security has to be taken seriously like other types of network threats.
A WLAN security suite should be installed for providing security. The Wireless security can be more enhanced if we have a proper knowledge about how to correctly integrate wireless devices with wired networks, upgrading the existing security tools and after a due selection of the appropriate security technologies. We should be sure that security solutions for virtual private networks are based on the present generation of the encryption and authentication protocols. Because threats can come in new and improved methods, on a continuous basis, you need to keep monitoring the health of your network for keeping it secure. Attackers are always waiting for seeing an unprotected WLAN and then invading and turning it.
It is quite easy to record wireless traffic and eventually break in, getting such valuable info such as proprietary information, login details, server addresses and so on (nowadays, stealing credit card details seems to have become a business for the attackers). In addition to stealing information, the attackers can also take control of networks and use them for transmitting spams, steal bandwidth, or use this network as a Launchpad for attacking other networks. The traffic can be recorded and modified, and the consequences can be legal or financial.
A business can be disrupted even by an attacker with low technology skills with packaged scripts that make it easy to attack networks and hunt for weak points (for example, a known security hole has not be fixed and the script uses that hole to get inside and eventually gain access). The attacker can flood your internet uplinks, wired networks and access points with wireless packets. You should known from what you are defending your systems and why protecting different possible points of entry. If you don’t know this, then you don't really have a chance, at sometime or the other, you will have your network without protection, and all the security measures are in vain.
The identification of assets and the impact of the loss is critical for security analysis. If you are using connection methods such as DSL, dial up or wireless, the access requirements should be defined by your security policy. If your system follows a remote access policy for the telecommuters, it should be expanded to incorporate wireless. If there is no such policy, one should be created. The scenarios unique to the wireless network must be included. The rules of wireless network are different for the employees and office visitors. The public areas have jacks that are typically associated with some known addresses and are sometimes disabled. But the PDAs and the laptops can be easily connected to the wireless stations and access points in the nearby location. This serves as both opportunity and a threat.
For guests the peer-to-peer networking should be prohibited and sessions should be permitted through certain access points with limited bandwidth and duration. After the identification of the assets, enumeration of the risks should be done. The last step is the quantifying of the risks. In security it is always important to weigh the risk against the cost. Once you have got this right, the other WLAN alternatives can be considered. Before setting up the access points, you should take a survey of the WLAN using a discovery tool. Some set up wizards have made it possible for the employees to deploy rogue access points through which the corporate’s info and assets can be exposed to the outside world. It can also introduce disturbance in to the WLAN. These rogue apps must be eliminated. With such surveys, you can also find workstations that are not authorized to access the internet. 

How are Smart cards, USB tokens, and software tokens used for security?

In this article we discuss about how smart cards, USB tokens and other software tokens are used for implementing security.

Smart card: This is a type of ICC (integrated circuit card) incorporated in to a pocket-sized card along with other embedded circuits. They are made up of plastic (usually polyvinyl chloride). These are used for the purpose of authentication, identification, and application processing and data storage.  These cards serve as a strong means for authentication within large organizations for SSO i.e., single sign-on. These are also used as ATM cards, SIM in mobile phones, fuel cards, pre-payment cards, access control cards and high-security identification cards, phone payment cards, public transport payment cards and so on. Sometimes they are also used as electronic wallets i.e., funds can be loaded in to it for paying when needed to merchants, retailers, vending machines, parking meters and so on. It does not require establishing a connection to the bank. The card can also be used by someone who is not its owner. This exchange of money is protected by the cryptographic protocols. Some cards such as the German Geldkarte are used for age verification. Some commonly known cards are:
- Visa
- MasterCard
- American express
- Discover

Security token or USB token: This is a physical device used for the user authorization by the security system so that there is no difficulty in authentication process. These devices verify the identity of the user electronically. These normally replace the passwords (or can be used along with the password) and use a key for gaining access. These tokens might be used for storing for cryptographic keys which include biometric data, digital signature etc. some come with tamper resistant packaging, while others have a small keypad for entering the PIN. Some tokens have a USB connector and so called a USB token. Some come with a wireless Bluetooth interface. With such interfaces the generated key number sequence can be transferred to the system. A token can stored 4 types of passwords:
- Static password token
- Synchronous dynamic password token
- Asynchronous password token
- Challenge response token

Tokens consist of chips whose functions can be very simple or at the same time to very complex. They use multiple authentication methods in the latter case. Simple tokens do not need to be connected to the system.

Software tokens: This is a two-factor authentication security device used for the authorization of the computer services. These tokens are stored in the electronic devices such as mobile phone, PDAs, PC, laptop etc. this is totally opposite of the hardware tokens that are stored on some hardware device dedicated to it. Both these types of tokens are quite vulnerable to man-in-the-middle attacks or other phishing attacks. However these tokens do have some benefits over the smart cards and USB tokens. Firstly you don’t require carrying them nor do they run on batteries that might run out. They are less expensive when compared to the hardware tokens. These tokens have two primary architectures namely the public-key cryptography and the shared secret. In the second architecture type the configuration file is given to each end-user by the administrator containing the user ID, PIN and the secret key. This type is open to many kinds of vulnerabilities. Attackers can compromise the stolen file. On top of this, these configuration files are subject to offline attacks and these are also difficult to be distributed. The latest software tokens use the public-key cryptography architecture to overcome most of the drawbacks of the shared secret architecture. 

Security - What is meant by a spoofing attack?

A spoofing attack can be described as a situation in which a program is successfully masqueraded by another person or program in the area of network security. This is done by falsification of inbound data through which the masquerading program gains an advantage, of the illegitimate kind. A number of TCP/ IP protocols do not have mechanisms for the source and destination authentication of the messages. This makes them too much vulnerable to the spoofing attacks. Thus some extra precautions have to be taken by the applications for verification of the sending and receiving host identity. A source IP address is forged using which IP packets are created. This is done for impersonation of identity of some other computer system and to conceal the sender’s identity. Thus, IP protocol is the basic one that is used for sending data across the networks. Each packet consists of numerical addresses. The header field of the packet is usually forged so that it appears as if it is from someone else.
The man-in-the-middle attacks against the network’s hosts are often carried out with the help of two types of spoofing namely ARP spoofing and the IP spoofing.
The implementation of firewalls having capability of inspecting the packets deeply can prevent the spoofing attacks from taking advantage of the TCP/ IP protocols. This can also be done by taking measures for the verification of the message sender and the recipient’s identity. There are sites which are pay sites and they can be accessed only through a certain log-in page that is approved by them. This enforcement is made by referrer header checking in the HTTP request. This is so because the referrer header can be changed by the unauthorized users to gain access to the site content. This is called referrer spoofing.
Sometimes the copyright holders also use spoofing for inserting un-listenable and distorted versions of works on networks where file is shared. This is termed as poisoning the file – sharing networks. Another type of spoofing attack is the caller ID spoofing. Caller ID info is often provided by the public telephone networks including the name and number of the caller. VoIP (voice over IP) is one such technology in which the caller ID info can be forged by the callers so as to present names and numbers that are false. This false information is then forwarded by the gateways that connect public networks and allow spoofing.
It is also possible that the origination of the spoofed call might be some other country. In that case the laws in the country of the recipient might not be applicable to the caller. This has also limited the effectiveness of the laws against the caller ID spoofing. This results in a lot of scams. Another type is email spoofing or email address spoofing. The information of the sender that you see in the emails can be easily spoofed. Spammers use this technique quite often for hiding their information. This creates problems such as spam backscatter, misdirected bounces and so on.
A GPS receiver can be deceived by GPS spoofing attacks. In this the counterfeit GPS signals are broadcasted that have been structured to appear same as the normal GPS signals. This can also be done with original signals and rebroadcasting them at some other point. Because of the receiver will estimate its position wrongly. One variant of GPS spoofing attack is the carry off attack. This attack involves synchronization and broadcasting of the signals and genuine signals together. This gradually increases the power of the counterfeit signals which causes them to drift away from the genuine signals.

Security - What is meant by smurf attack?

A type of denial-of-service attack is the smurf attack. This attack involves broadcasting a large number of ICMP (internet control message protocol) packets to a computer network with the spoofed IP address of the victim through an IP broadcast address. Most of the devices online on that network respond to this broadcast by replying to the IP address of the source. Now, since the number of devices connected to the network and replying to this broadcast is very large, the system of the victim will get flooded with incoming traffic. This results in a slow down of the victim’s system and it becomes impossible to work on it. The attack was named after the name of the program’s source code called the ‘smurf.c’ which was released by TFreak in the year of 1997. At that time a lot of IP networks were vulnerable to this attack. But today most networks are immune to such attacks and very few are still vulnerable to it.
Now let us talk about the mitigation of these attacks. It can be fixed in two steps as mentioned below:
- The individual routers and hosts should be configured so that they do not respond to such broadcasts and the ICMP requests.
- Routers should be configured to not forward the packets to the destination address. The 1999 standards configured the routers for default forwarding of such packets. In the same year, these standards were changed.

Another solution to this problem is the network ingress filtering. This sort of filtering is implemented for rejecting those ICMP packets based up on the source address that has been forged. An example of router configuration that won’t allow packet forwarding in cisco routers is:
Router (config – if) # no ip directed – broadcast

Even though this example prevents a network from participating in the smurf attack, it does not prevent it from becoming its target. There are computer networks that lend themselves to be used in the attacks. Such networks are termed as the smurf amplifiers. They tend to worsen the smurf attack since their configuration is such that a lot of replies to the ICMP addresses will be generated from them at the spoofed IP address or the victim computer.

A variation of the smurf attack is the ‘fraggle attack’. In this attack a large UDP traffic along with the victim’s IP address is sent to an IP broadcast address by the attack at ports 7 and 19 i.e., echo and chargen respectively. The way of working of this attack is quite similar to the original smurf attack. All the devices on the network will send the traffic to the victim address causing the same kind of flooding as in the case of smurf attacks. The source code for this attack was also released by TFreak called the fraggle.c.
Smurf attacks are a way of exploiting the IP broadcast addressing for creating a denial – of – service attack. The affected networks becomes inoperable. ICMP is usually used by network administrators for exchanging info about the network state. During the attack, these messages are used to ping the devices on the network to see if they are in a functional state. If a device is functional it returns a response to this message. When there are a large number of pings as well as replies to them, a large traffic is created which renders the network unusable. Since the IP broadcast addressing is seldom used it can be disabled at the network routers. This is a suggestion given by CERT for coping with the problem of smurf attacks. 

Security: What is meant by heap overflow?

There are two types of overflows in computer programming, namely buffer overflow and heap overflow. In this post, our focus is on the second one i.e., the heap overflow. This is nothing but a variant of the buffer overflow, and this type of overflow occurs in the data area of the heap. The manner in which these overflows can be exploited is quite different from the exploitation methods of the stack – based overflows. The allocation of the heap memory takes place dynamically during the execution time of the application. It usually stores the program data. Specific ways are used for corrupting the data during exploitation. This results in the program overwriting the internal structures like the pointers in linked lists.
There is a technique called the canonical heap overflow technique that can be used for overwriting the malloc Meta data which is dynamic memory allocation linkage. The pointer exchange resulting because of this overwriting is used for overwriting the pointer of a program function. As an example for this, consider two Linux buffers allocated adjacent to each other on the data area of heap. When the data is written across the boundary of the first one, it causes the Meta data in the second to be overwritten. Here the in – use bit of the second buffer can be set to 0 and the length can be set to a negative value that is small enough to copy the null bytes. When the free() is called by the program with the first buffer, it will try to merge the two buffers as one. The buffer that will be freed will then hold the pointers BK and FD in 8 bytes. The FD contains the BK and can be used in pointer overwriting. But there are several reasons as to why this is not possible.
Below mentioned are the heap overflow consequences:
- Accidental overflow can cause the data to corrupt or the program to behave in an unexpected way. This can be caused by any process that uses the memory area that is affected from the overflow problem.
- The operating systems that have no protection for memory can be affected by any process.
- A deliberate exploitation of the overflow can cause the alteration of the data and the way a program using that data executes. An example is of the Microsoft JPEG GDI+ vulnerability MS04 – 028. Heap overflows are often used by the iOS jail breaking for gaining code to utilize it for the kernel exploitation.

There are three ways in windows and linux following which can prevent the occurrence of the heap overflows. The other operating systems do not provide all these three. These ways are:
- Preventing the payload execution by means of code and data separation with hardware features.
- Introducing randomization so that there is no fixed offset for the heap.
- Introducing sanity checks in the heap manager.

The GNU libc from version 2.3.6 and onwards comes with built – in protection for the heap overflows. It also has capability of detecting the overflows. For example, when the unlink function is called, it checks for the consistency of the pointer. However these protections hold good only for the old – mannered exploitations and so are not perfect for the modern operating systems. Linux includes support for the NX – bit and ASLR since 2004. The Microsoft OS comes with protection against heap overflows in windows XP, server 2003 and service packs. The later OS include the following:
- Heap entry meta data randomization
- Removal of the data structures that are commonly targeted.
- Randomized heap base address
- Algorithm variation etc. 

How is security management done in medium sized businesses?

There are a number of security risks that affect businesses, whether these businesses be small, medium or large. Something common to handling such risks and preventing these risks from causing major loss to the businesses is through the design of proper risk management principles. These are handled through several stages - Firstly the risks have to be identified along with the causes for these risks; Secondly the consequences of the risks coming true are identified (and this could even mean going to the worst case scenario); thirdly, the impact of the risks on security is determined and the risks are prioritized based upon this assessment.
There are two types of security threats namely external security threats and the internal security threats.

External security threats include:
- Attacks from competitors who want access to intellectual property or want to determine other secrets of the organization
- Hackers who want to get into the company and can then cause huge amount of damages
- In today's world, risks include external worms or other attackers from getting access to the internal infrastructure of the organization.

The internal threats include:
- Employees trying to get access to areas of the organization that they should not have access to.
- Usage of buggy software or those that contain trojans by employees, that increases the risk to the infrastructure of the company.
- Data being lost to hard disk crashes or the like.
- Securing data transfers such as is being increasingly used for cloud based transactions.

Now let us see how security management is done in the medium businesses. The medium sized businesses can use the following:
- A unified threat management system can be designed & implemented with an expert in charge.
- A strong firewall can be used.
- For the purpose of authentication, strong passwords can be used. These passwords should be changed on a monthly or bi – weekly basis as required.
- A robust password must be used for a wireless connection.
- An optional network analyzer or network monitoring software can be used.
- A virtual private network or VPN can be used for maintaining communication between the satellite offices and the main office. There are many advantages of using a VPN. The expenses of leased data lines are reduced. Also it provides a very secure network for communication. It very well imitates the private line that has been leased. What makes this network private is that the encryption of the links. This makes it very convenient to use. This is a very good choice for medium sized businesses who need such connectivity and want security.
- Clear employee guidelines should be followed for accessing the non – work related websites, internet, and sending and receiving info.
- All the accounts must be monitored for accountability so as to monitor the individuals logging on to the intranet of the company.
- A back up policy should be created for recovering the data in case the hardware or software fails or a security breach occurs that affects the data in a wrong way.

How is security management done in large businesses?

Security management is very much required, in fact essential, if you are doing a large scale business or responsible for the security. In this article we discuss about some steps that can be considered for increasing the security (and you might have issues with some of the steps, or perform some additional steps):
- There might be a lot of unwanted people from whom you wish to keep your network and database safe. For this purpose a strong network guard must be used with an equally strong firewall and proxy.
- Here the basic anti – virus software would not work. You have to go for strong antivirus packages. There are separate internet security software packages also.
- Stronger passwords can be used for authentication purpose and it should be changed on a bi – weekly or a weekly basis if a wireless connection is being used. The password must be robust and follow the protocols to prevent the password from being guessed.
- A network analyzer can be created for the purpose of monitoring the network. It can be used as and when required.
- There are certain physical security precautions that can be exercised for the employees.
a) Physical security management techniques can be implemented such as the closed circuit television for the zones that are restricted with security viewing these videos.
b) The perimeter of the company can be marked by security fencing backed up closed circuit television cameras.
c) The security rooms and the server rooms are fire – sensitive and so they should be equipped with fire extinguishers.
d) Physical security can be maximized with the security guards who have been given specific protocols to follow.
Some of the above points hold good for large govt. institutions and schools too. School networks can put up a firewall and proxy that is adjustable for restricting outsiders from accessing the database. Schools too need to use strong internet security software packages, also because students tend me to be the most curious and prone to using software that may have viruses or worms. Librarians, administrators, and teachers should constantly supervise the network to provide guarantee protection against security threats. An internet usage policy that is easy to understand, accept and enforce for differentiating between the personally owned and school owned devices. for the institutes that provide higher education must implement the FERPA compliance. Large govt. agencies should also use stronger firewalls and proxy for keeping the intruders at bay. Strong encryption must be done for safe–guarding the communication. The wireless connection must be authorized in whitelist. Others should be blocked. All of the networking hardware must be deployed in secure zones. A private network should be created up on which all the hosts should reside after which they won’t be visible to the outsiders. Security management procedures that are used by various organizations include risk analysis, risk assessment, classification of information, and categorization of assets, and rating the vulnerabilities of the system. These measures are followed for the implementation of the effective controls. The principles of the risk management are followed for managing the security threats. The types of the security threats can be classified in to two broad categories namely the external security threats and the internal security threats.
Avoiding the possibility of creating any opportunity for attackers is the best thing to do in the first place. The effectiveness of the controls that are used for controlling these threats is assessed. The consequences of the risks are also assessed. The risks have to be prioritized as per the impact they can have on the security system. 

How is security management done in home and small businesses?

As there are different kinds of networks, so there are different types of security management for them. In this article we shall talk about how security management is done in the home and small businesses. Only basic security is required for a small office or at home. On the other hand a lot of maintenance is required for large businesses and large institutions. Also here, normally used hardware and software is used when compared to the sophisticated hardware and software that is used for the prevention of spamming, hacking and other kinds of malicious attacks. Here we list some basic points for security management at home and small office:

- A basic firewall can be installed or even a unified threat management system can be used.
- A basic antivirus software will do the task if you are working in the windows environment.
- Other software that can be installed for security include anti – spyware programs. A number of anti – virus and anti – spyware software are available in the market.
- If you are using a wireless connection, you must take care to secure your system with a robust password. A number of security methods are supported by the wireless devices. so try to use the strongest of those methods such as the AES, WPA2. A wide range of devices are supported by the TKIP. But they can only be used in the cases where there is no compliance with the AES.
- While using wireless, the default SSID name of the network must be changed. Another security measure that can be taken is to disable the SSID broadcast as this is not required for the home use. This can be easily bypassed by the use of modern technology and if the attacker has some knowledge regarding how the wireless traffic can be detected.
- You can enable the MAC address filtering for keeping track of all the MAC devices that are on that network connected to your router. Even though strictly this is not a security feature, it does can be used for limiting and monitoring the DHCP address pool for the attackers by both AP association and exclusion.
- Static IP addresses can be assigned to the devices connected to the network. This is done for complementing the other security features and to make the AP less desirable to the attackers.
- The ICMP ping on the router must be disabled.
- You can even review the logs of the router and the firewall for identification of any abnormal traffic or connection if any is there.
- Passwords must be set for all the accounts.
- If you are using a windows operating system, you can create multiple accounts for the family members to limit all the activities.
- Children of the family must be given lessons about the information security.

Security management is about identifying the important assets of the user that of course includes the information assets and checking whether the policies protecting these assets are implemented properly. It is also about protecting these assets from loss. It identifies the critical assets and focuses on protecting them first. The potential threats to the system are assessed. Then measures are taken for eliminating or minimizing these threats. The security risks are managed by the virtue of the risk management principles. It involves identification of the risks, assessment of the effectiveness of the control strategies, determination of the consequences. The risks are identified by means of the impact they can have. The identified risks are classified and appropriate response is selected for each. 

What are different types of attacks that network face?

With a lack of security measures and checks in the right place, we put our data to risk of various types of attacks. Attacks are of two types namely active attacks and passive attacks. The active attacks involve altering the information with an intention of destroying or corrupting the network and the data. If you do not have a security plan in place your network and data are vulnerable to these types of attacks. In this article we discuss about few of such attacks:
- Eavesdropping: generally most of the network communications occur in a format that is very unsecure (i.e., clear text). This gives a chance to the attacker to gain access to all the available data paths in that network for interpreting or listening to the traffic. Eavesdropping on someone’s communication is referred to as snooping or sniffing. The eavesdropper gets a great chance for monitoring the whole network which has become a great cause of concern for the administrator of an enterprise.  There are services that are based up on cryptography. With a lack of strong encryption the data of these services can be read or traversed by the eavesdropper.
- Data modification: after the data has been read by the attacker or eavesdropper, altering this data is his/ her next step. Without coming to the knowledge of the receiver and the sender the data in the packet can be modified by the attacker. Even if confidentiality is not required in all the communications, it is a must that any of the messages should not get modified in the transition.
- IP address spoofing (identity spoofing): the computer’s IP address is used by most of the operating systems and the network for identifying whether an entry is valid or not. In some cases, a false assumption of the IP address is possible. This is called identity spoofing. Some special programs might be used by the attacker for constructing the IP packets that might seem to come from the systems that are inside the intranet of the corporate. After the attacker gains the access to a network having a valid IP address, he/ she might reroute, delete or modify the data.
- Attacks based up on passwords: the password based access control is a common denominator of many network security plans and operating systems. By this we mean that your user ID and password determine your access rights. Always protection to identity information is not provided by the old applications as they might be validated when passed through the network. This might give a chance to the eavesdropper who poses as an authorized user for gaining access to the data. Whenever a valid user account is found by the attacker, he/ she gets the exact rights which are possessed by the real user. Now suppose if the user is admin of the network, then attacker gets the same rights as the admin and can create accounts for subsequent use. After gaining access to an account, the attacker can get lists of the authorized users and network info. He can make changes in the configurations, routing tables and access controls of the networks and servers.
- Denial – of – service attack: this attack prevents a valid user from using the network or the computer. By means of this attack the attention of the staff can be diverted from the internal information systems so that they don’t get to know about the intrusion. In the meantime attacker can make more attacks. Invalid data can be sent to the network services or applications. He can even overload the whole network so that it shut downs. 

What is a transposition cipher method?

- The transposition cipher method is one of the cryptography methods used for securing the communication from eavesdroppers. 

- This method of encryption shifts the positions of the units or letters of the plain text based up on some regular system so that a permutation of the plain text is generated. 

- This permuted plain text is termed as the cipher text. 

- Thus, the cipher text is generated by changing the order of the units. 

- Mathematically the following functions are used:

Ø  Bijective function: For encryption of the character’s position and

Ø  Inverse function: For decrypting the message

Now we shall see about some of the implementations of the transposition cipher:

1. Rail fence cipher: 

- This form of the transposition cipher has been named so because of the way that it follows for encoding.

- Here, the characters of the plain text are written on the successive rails in a downwards manner of some imagined fence.

- Then, we move upwards once getting to the bottom. 

- For reading the message, it is taken in rows.

2. Route cipher: 

- In this form of transposition cipher, a grid of given dimensions is taken on which the characters of the plain text are written out. 

- Then, the message is read based up on the pattern mentioned in the key. 

- For example, the pattern might be inwards spiral in clockwise direction starting from topmost right.

- The route ciphers may use many keys unlike the rail fence cipher. 

- In fact, the number of keys used for enumerating the messages of reasonable length by modern machinery might be too great. 

- Also, it is not necessary that all the keys might be good in equal terms. 

- Excessive chunks of the plain text might be left if bad routes are chosen. 

- Also, the plain text might be simply reversed, thus giving a clue to the crypt analysts about the routes. 

- The union route cipher is a variation of the traditional route cipher. 

- The difference between the two is that this one transposed the whole words unlike route cipher which transposed individual letters.

- But since transposing the whole words could expose them, they were first hidden by a code.

- The entire null words might be added for adding humor to the cipher text.

3. Columnar transposition: 

- In this form of transposition cipher, a fixed length is determined for the rows in which the message is written. 

- But for reading the message a column by column approach is followed where some scrambled order if followed for choosing the columns. 

- A keyword is chosen which is used for defining the permutation of the columns as well as the width of the rows. 

- The spare spaces might be filled with the null characters in case of the regular columnar transposition. 

- On the other hand, in these spaces are left as such in the irregular columnar transposition cipher. 

- The keyword specifies some order following which the message is read column - wise. 

- The column lengths have to be worked out by the recipient for deciphering the message. 

- This is done based up on division of the length of the message specified by the key length.

4. Double transposition: 

- A single columnar transposition is vulnerable to attacks since the possible lengths of the column and anagrams can be guessed. 

- Therefore, a stronger version of it i.e., the double transposition is followed. 

- This is a two-time application of the columnar transposition. 

- For both the transpositions, either the same key might be used or different keys.

- This was the most complicated cipher before the coming of the VIC cipher. 

- It offered reliable operation under difficult conditions. 

What is a substitution cipher method?

There are two classic methods for cryptography namely transposition cipher method and the substitution cipher method. In this article we shall discuss about the latter one i.e., the substitution cipher method. 

- This method of encoding involves replacement of the units or letters of the plain text with some other units or letters. 

- The encoded text is then called as the cipher text. 

- The replacement of the units is made based up on some regular system. 

- These units might be individual letters, pairs or triplets of letters and so on. 

- On the receiver’s side, an inverse substitution is required for deciphering the text. 

- We can make a comparison between the transposition ciphers and the substitution ciphers. 

- In the former ciphers, the plain text units are rearranged unlike in substitution cipher where units are replaced.

- The order of rearrangement in the transposition ciphers is somewhat more complex than what is followed by the substitution ciphers and the units are not changed.

- On the other side, the sequence of the units remains same in the substitution cipher but they are themselves altered. 

There are various types of substitution cipher as mentioned below:

Ø  Simple substitution ciphers: 

- This involves substitution of the single letters and thus has been termed as the simple substitution. 

- The alphabet can be written out in some order so as to represent the substitution.

- This alphabet is referred to as the substitution alphabet. 

- This alphabet might be revered or shifted or scrambled in some complex manner. 

- In such cases, it is termed as the deranged alphabet or the mixed alphabet. 

- The creation of the mixed alphabets involves writing out a keyword while removing the repeating letters and then rewriting the leftovers in the same sequence. 

- For avoiding the transmission errors, the cipher text is written in block form and the spaces and the punctuation are omitted. 

- This also helps in creating disguises for the boundaries between the words.

Ø Homophonic substitution: 

- This method is followed for increasing the difficulty for the frequency analysis attacks. 

- The frequencies of the letters of the plain text are disguised by homophony. 

- Here the letters of the plain text are mapped to many symbols of the cipher text. 

- Normally the plain text symbols with highest frequencies are mapped with more equivalents when compared to their low frequency counterparts. 

- This leads to the flattening of the frequency distribution which in turn raises the difficulty of frequency analysis. 

- For the invention of larger alphabets a number of solutions are employed. 

- The simplest of these solutions is using a numeric substitution alphabet. 

- Another method uses the variations of the existing alphabet i.e., writing it upside down, or in upper case and lower case etc. 

- Nomenclature is also a variant of the homophonic substitution. 

- The other two types of homophonic ciphers namely straddling checker board and book cipher.

Ø Polyalphabetic substitution: 

- It involves the use of the multiple cipher alphabets. 

- For the facilitation of the encryption process, these alphabets are written out in a big table which is referred to as the tableau. 

- The particular poly alphabetic cipher is defined by the method with which the tableau is filled and the alphabet is chosen. 

- Some types of the polyalphabetic ciphers are:

             1. Beaufort cipher

             2. Gronsfeld cipher

             3. Running key cipher

             4. Autokey cipher

Ø  Polygraphic substitution: 

Here the letters of the plain text are substituted in terms of large groups instead of individual letter substitution.

Ø Mechanical substitution ciphers: 

Some examples of this type of substitution ciphers are enigma, rotor cipher machines etc.

Ø The one-time pad: 

This one is a special substitution cipher which has been proven that it is unbreakable mathematically.

What is Traditional Cryptography?

- Cryptography is the practice that involves study and application of the techniques for making communication secure with the adversaries or the third parties. 

To be more general, it involves construction and the analyzation of the protocols for overcoming the impact of the adversaries and other aspects concerning the information security such as the following:

Ø  Data confidentiality

Ø  Data integrity

Ø  Authentication

Ø  Non – repudiation

- The modern cryptography in contrast to the traditional cryptography intersects the computer science, mathematical and the engineering disciplines. 

There are various applications of cryptography as in the following:

Ø  ATM cards

Ø  Computer passwords

Ø  Electronic commerce

- The traditional cryptography was synonymous with the process of encryption which involves converting the information which is in readable state to such a state in which it appears like utter nonsense. 

- The one who generated the encrypted message also shared the technique for decoding the message only with the desired recipients, thus the unwanted people are precluded from doing so.

- Cryptography is in use since the World War I and the methods that were used then now have become so complex and eventually its application increased. 

- Modern cryptography’s foundation is based up on the computer science and the mathematical theory. 

- The designing of the cryptographic algorithms is done around the computational hardness assumptions. 

- In practice, this makes these algorithms quite hard to break by any third party. 

- However, theoretically it is possible to break in to such a system but for doing so any known practical means are in-feasible.

- That is why, all these schemes are considered to be computationally safe and secure. 

For the following, the continuous adaptation of these methods is required:

Ø  Improvements in the algorithms for the integer factorization.

Ø  Faster computing technology.

- Also, there are schemes that are information – theoretically secure and even with unlimited computing power, these schemes cannot be broken.

- One such scheme is one time pad. 

- Also, the implementation of these schemes is also quite difficult when compared to the schemes that are computationally secure but are theoretically breakable. 

- Traditionally cryptography referred only to the encryption which involves conversion of the ordinary info in to cipher text or unintelligible text. 

- The reverse process of this is decryption. 

- The pair of algorithms that carry out these two processes is called the cipher. - Each instance of the operation of the cipher is controlled by a key which is kept secret between the communicants. 

- The purpose of this key lies in decryption of the cipher text. 

- Earlier the encryption and the decryption process were carried out directly by the ciphers without involvement of any integrity or authentication checks. 

- Before the advent of the modern cryptography, the traditional cryptography was known to be concerned only with the message confidentiality i.e., converting the message from comprehensible text in to incomprehensible text and vice versa. 

- The message was thus unreadable for the eavesdroppers and the interceptors without key. 

- For ensuring the secrecy in the communications, the encryption process was used. 

- But now the field expands far beyond the confidentiality issues.

- It now consists of techniques for authentication and message integrity checking, secure computation techniques, interactive proofs, digital signatures and so on. 

- Earlier two types of classical ciphers were used namely substitution ciphers and the transposition ciphers. 

- The former type involved replacing the letters by some other letters.

- The transposition ciphers involved rearrangement of the letters. 

- Some examples of early ciphers are caeser cipher, atbash cipher etc. 

- The early ciphers were assisted by some other physical aids and devices. 

- Eventually more complex ciphers could be developed with the development of the digital computers. 

- Any kind of data that could be represented in binary format could be encrypted.

What is link encryption method?

- Link encryption method is one of the classic methods used in the digital communications for the application of the crypto.

- Link encryption method has been designed for hiding the secrets and preventing the forgery of data. 

- It is quite a simple concept that has been discussed here and it fits for all the types of existing applications and software used in the communication.  

- Even though this method does not works well enough for most of the applications, it is the simplest of all. 

- Link encryption method is a security measure that should be used only if your security objectives match with those of the link encryption method. 

- It is commonly used in the applications where a boundary has to be maintained between the internal users and the external users. 

- With the link encryption it gets easy for the internal users to share data whereas it is just the opposite for the external users. 

- It provides transparent protection except for the separation that is maintained between the two classes of the users. 

Below we mention some security objectives that can be met with the link encryption:

Ø  Maintaining confidentiality: Our systems of course store very sensitive data. While exchanging the data with other systems, it is required that the risk of leakage involved should be as minimum as possible.

Ø  Communication with the outsiders: Obviously, we do not want to share our data with the unwanted outsiders and unauthorized sites and so we want these to be blocked. Such exchanges should be prevented from happening even by carelessness or accident.

Ø  Hiding data traffic: As much as possible we want our data and its details to be shielded from the outsiders. This data might contain information about the destination host and other info necessary for communication control. However, here it is assumed that the information will not be leaked by the insiders.

Ø  Familiarity and safety: We rank these two factors above the cost.

Ø  Protection of the data transfers: We need protection for our data against any sort of tampering or forgery by the outsiders during the transition. An assurance is important.  This objective is unconditionally met by this link encryption method.

- From security standpoint, a design is yielded by the link encryption that is highly reliable. 

- If in your organization some security parameter has been established that is strong enough, link encryption is the best technique for its maintenance. 

- A strict control is kept over the flow of physical documents through this security parameter. 

- The link encryption provides a complementary protection for the flow of the electronic documents. 

- We can have an environment with every data link that traverses the boundary having encryptors. 

- The documents will be kept within the parameter limits. 

- The data leaving the parameter will be protector by means of the encryptors. 

- Link encryption method is being used since years in banking organizations and military communications for providing secure links. 

- The link encryption uses the in-line encryptors as its building blocks.

- This hardware devices takes plain text and converts it into cipher text.

The encryptors have their own vulnerabilities as mentioned below:

Ø  Rewrite attacks: It is also known as the plain-text attack, it is used for forging the messages. Few crypto algorithms are vulnerable to these attacks.

Ø  Replay attacks: Most of us think that the encrypted data is self-validating and so by matching the encryptor with its keys a sensibly de-crypting message can be generated. Since the encrypted data is accessible to the outsiders, they can also access the message that decrypts sensibly.

Ø  Covert signaling attacks: This attack is based on the idea that there is always a way to leak info if there exists an internal process that tries to do so.