Reference no: EM132307304

Network Security

Purpose of the assessment

The learning objective of this assignment is to extend your knowledge of networks and network attacks and to gain first-hand experience on vulnerabilities, as well as on attacks against these vulnerabilities. Using vulnerabilities as case studies, students can learn the principles of secure design, secure programming, and security testing.

1. Analyse and evaluate specific business security issues and risks relating to different business applications

2. Apply and justify basic security mechanisms utilized in business environments and explain to business the current business security' issues

3. Demonstrate an understanding of security theory, practical experience and security standards to analyse and to generate business solutions.

4. Understand the ICT profession and professional expectations in strategic information systems management

5. Communicate using effective oral and written communication tools, act in a professional manner, be an effective team member or team leader

6. Review and describe the major privacy, legal, ethical and societal issues with respect to managing digital information and information systems

Assignment Specification

Purpose:

The goal of these assignments is to gain hands-on experience in variety of threats in computer and network security. DNS attack, Firewall evasion, VPN, Buffer overflow, Packet Sniffing and Spoofing and TCP attacks.

If you are not familiar with Linux, find a source to learn common commands.

Each group member must perform the tasks involving the virtual machine on their own computer and submit the required screenshots and output files as generated from their own computer.

Description:

You are given different cases related to:
• Network security
• Software security
• Web security
• Cryptography

Each group will work on different security threat scenario assigned by your lecturer.

You will test your security case in a Virtual Box environment. To do this, you will need to download the pre- built virtual machine (VM) image for UbuntuLinux (version 16.04) which can be used for all our Linux-based labs. The VM is based on UbuntuLinux OS 16.04 (32 bit). The Linux kernel version in the VM is v4.8.0-36- generic. The VM is built based the LTS (long-term support) OS version released by Ubuntu.

Two accounts been created. The usernames and passwords are listed below:

1. User ID: root, Password: seedubuntu. Note: Ubuntu does not allow root to login directly from the login window. You have to login as a normal user, and then use the command su to login to the root account.
2. User ID: seed, Password: dees. This account is already given the root privilege, but to use the privilege, you need to use the sudo command.

The provided UbuntuLinux image contains some of the most commonly used tools and server software for security activities. Three tools to assist in the network security labs (all tools are installed in /usr/bin/):

1. Netwox: This is a network toolbox which is useful for generating different types of packets. It contains 222 network features. netwag is a graphical front-end of netwox. It should be noted that running netwox/netwag requires the root privilege.
2. Wireshark: This tool is a popular network protocol analyzer. It is useful in inspecting network packets.
3. Scapy: This tool is an interactive packet manipulation program.

On the other hand, Ubuntu operating system contains many tools that are useful for security evaluation testing.

CORE is a network emulator aimed at allowing users to generate network topologies in order to test performance of various communication protocols.

For this assignment, you can use CORE for network simulations (Bonus Task), executing and analyzing impacts of attacks. The simulated networks can include many simulated computers, and the CORE software allows you to open a terminal on each of the computers, in effect having several virtual computer on the virtual machine.

Server Software:
All services mentioned in this section are auto-started by the VM:

• Bind9 DNS Server
Bind9 is an open source implementation of components of the domain name system. It is primarily used in the DNS network security lab. The main configuration file of Bind9 is located in /etc/bind/ named.conf.options. You also need to be aware of the file /var/cache/bind/dump.db, which is the currently configured dump file.

• Apache HTTP Server
• MySQL Server

Other Servers:
ftp server (vsftpd), a telnet server (openbsd-inetd) and a ssh server (ssh).

Two text editors: gedit and sublime. gedit is the default text editor that comes with the Ubuntu OS.

The virtual machine is configured to use NAT (Network Address Translation) for networking. From the virtual machine, you can type ifconfig as root to see the IP address of the virtual machine.

The virtual machine also has an ssh server. You can ssh into the vm from the your machine, using theIP address produced by ifconfig (as above) as the destination. You can also use this to transfer files onto the virtual machine using scp or an sftp client like SecureFX

Tasks:

You are the company IT Manager. It has come to your notice that a company employee has set up a rogue web server on the internal network, using a personal laptop. The employee is using that web site to provide undesirable material to a small clique of employees, to whom the web server address has been provided secretly.

The company CEO has requested you to:

1. Obtain hard evidence that an employee is in fact using a personal laptop to set up a rogue web server.
2. Find out what other employees are accessing the rogue web site.

Take the role of a security evaluator on a penetration test. Your goal is to determine the security posture of the network. You will provide your results to management, and management will give your results to the engineers and/or network architects that can fix the security issues. This means that you must convince management of the severity of the security issues (with evidence) and you must also provide your detailed steps (for reproducibility).

Write a report that includes:

1. The problem that you are solving?

2. Approach: This section will vary highly based on the type of project you are proposing, but should convince me that you know what you're doing and that you have a plan for attacking the problem.
a. The plan to go about solving this problem?
b. Techniques are involved?

3. Your findings, the steps in your process (include tools used and commands executed including IP addresses, etc.).

4. For any security issues you find, you must provide evidence (tool outputs, Wireshark captures and timestamps of packets of interest). For more details related to timestamps https://www.elvidence.com.au/understanding-time-stamps-in-packet-capture-data-pcap-files/

5. Potential impacts and possible remediation for each finding.

6. Milestones: How will you get the work done? Present a timeline of what and when various work will be accomplished. Working in a group, discuss how the work will be divided. Obviously, you do not actually have to stick to this, but you should have a plausible plan for how you would accomplish the work.

7. Bibliography: containing the references cited in your proposal

Presentation
Each group will present their work on the final day of class (in the form of an uploaded presentation of 10 minutes). This is your opportunity to show off the work that you did. The presentation should be clear, engaging, and demonstrate your contributions.

Attachment:- Network Security.rar