Summary
To effectively safeguard sensitive information, such as employee identity information, and an organization’s intellectual property, such as semiconductor inventions and trade secrets, we have increased our efforts to integrate cryptographic algorithms as a key component in our business. The upper executives are happy with the organization’s current level of security, but this report aims to include more secure methods (Barker, 2018). The management will learn about potential security concerns in our company through this study, along with the best techniques for reducing such risks.
The vulnerability risk and cybersecurity table results will also be analyzed and summarized. A discussion of the numerous safeguards that may be used to safeguard companies’ assets, integrity, and data-hiding technologies will also be provided. Finally, it will describe strategies for integrating email security with standard access cards (CAC).
Threats and Vulnerabilities for Network Security
Table 1 – Threat and Vulnerability Table for Network Security
An information system’s architecture consists of hardware and software combined to produce services and solutions suited for the consumer. The information system’s design includes the security elements listed below.
- LAN security
- Physical security
- Identity management
- Availability
- Privacy
- Personal security
LAN Security
This comprises diverse hardware, such as workstations, routers, firewalls, and linked devices. These dangers, including data leakage, illegal access, and spoofing, will likely materialize (Barker, 2018). These vulnerabilities may be reduced by implementing control mechanisms, including authorization and identification restrictions, ongoing monitoring, and logging processes to guarantee that data confidentiality is firmly maintained.
Identity Management
Identity management is locating, confirming, and approving the appropriate people to access and receive the proper data for the proper reason. Security breaches to PCI (personal card information), PII (personally identifiable information), and data systems are just a few security risks that might arise in a company when identity management is not done correctly (Lozupone, 2018). The following are the main processes used in identity management, notwithstanding the likelihood that risks related to this feature would materialize:
- Creation and protection of user identities.
- Identity verification before access authorization.
- Depending on the responsibilities of the users, authorizing information admission.
Physical Security
This hazard, which entails physically preventing unauthorized individuals from accessing an institution’s resources and tools and defending people from violent attacks, is likely to come to pass. Hiring security guards, installing CCTV, using access control systems to lock and unlock doors, and using biometric scanning are all standard tactics to combat physical security concerns.
Personal Security
Data systems, networks, and storage facilities should be accessible to system users at all times. Downtime caused by a lack of information might be costly for the company. Setting up offsite backups may easily take care of this and maintain production continuity in the event of information assaults on the primary servers.
Availability
Notwithstanding the remote possibility that this may occur, safeguarding employee information against theft, including equipment given by the company, such as mobile phones, is required. Concerns about personal security include the need for additional physical protection, particularly when the safety of the workforce might be jeopardized by unlawful access to the site.
Privacy
This is a well-known method of protecting confidential data from being obtained by unauthorized people, and it is highly likely to occur. Information disclosures, identity theft, or unauthorized credit access are all possible outcomes of privacy violations (Neupane et al., 2018). Encryption and decryption techniques, as well as access control and identification methods, are some of the processes that may be used to ensure privacy protection.
Plan of Protection
Cyber Threats
Any attempts to gain unauthorized access to systems, devices, or sensitive corporate data are considered cyber threats. Cyber threats can originate from both inside and outside the company. Some cyber threats and the steps taken to mitigate them are listed below.
Spoofing of IP Address
Malicious attacks, such as spoofing, involve transmitting communications from an untrustworthy provider. Cache attacks are a frequent way for spoofing to happen (Prakasha et al., 2019). The most effective technique to stop spoofing is to set up routers and firewalls with input filters to stop packets from the local network and output screens to stop assaults from the organization’s networks.
Service Denial Attacks
Service denial attacks try to interfere with vital services and systems by rendering them inaccessible to users. When the volume of bandwidth, packets, or connections increases, it may indicate a service denial assault. More bandwidth may be made available to support efficient online services, while preventative technologies such as load balancers and next-generation firewalls can also be used to stop assaults.
Packet Sniffing
Attacks, known as packet sniffers, are created to monitor network traffic and disrupt and decipher packets containing data. Attackers utilize them to get hold of passwords, pins, and other data. By using secure communication techniques and data encryption, it may be reduced.
Malware
This is the term for malicious software created by attackers to take down or harm computer systems. They consist of worms, viruses, spyware, and malware, which are dangerous to computer networks (Reuter et al., 2020). However, next-generation firewalls and anti-malware software stop these threats.
Injection Attacks
This attack primarily targets the user interface of websites. Injection attacks change the system program’s efficient operation by introducing unreliable input. Use of protected APIs and appropriate input validations can reduce this. The creation of threat response tactics is made feasible by awareness of potential dangers. A discussion of data protection strategies is provided below.
Methods of Encrypting and Hiding Information
These are technological methods for encrypting and decrypting messages using algorithmic keys. Before communicating, the plaintext is encrypted to create ciphertext (an unintelligible form) (Shakya et al., 2022). The data is subsequently converted into readable form by the message recipient. There are two different forms of encryption: symmetric and asymmetric (Rouse, 2016). Data hiding techniques are technologies that are used to hide a message in a communication.
When data is encrypted, a private key used to decrypt the sent message is given to the receiver, which will help them convert the sent cipher back to plain text. A secret key will be used to encrypt the secret message before it is transmitted to the recipient for a more secure method (Shakya et al., 2022). After receiving the communication, the recipient decrypts the hidden message to retrieve the original. This essay compared the encrypting method of cryptography with steganography and discussed how the latter offers superior security for concealing hidden messages (Tao et al., 2014). The many steganography approaches are illustrated in this essay, which also looks at how those techniques are implemented.
Encryption Technologies
Shift / Caesar Cipher
One of the earliest known encryption methods was the Shift/Caesar Cipher. It is a fairly simple encryption that is readily broken using brute force techniques. Each character in the 27-character English alphabet is moved forward or backward at defined character intervals of 1 to 26. Khan Academy, unknown (Wang et al., 2018). For instance, if I used a key with 5 forward-looking characters, the word “Caesar” would be encoded as “Hfjxfw.”
Polyalphabetic Cipher
These refer to ciphers created using a variety of alphabets that are intended to alternate in a systematic manner. Examples of polyalphabetic ciphers are Vigenere and Playfair (Tao et al., 2014). The Vigenere cipher employs a text string that has been converted into numeric values to determine each letter’s shift, whereas Playfair uses multiple alphabets to hide the message.
One-Time Pad Cipher/Vernam Cipher/Perfect Cipher
This technique uses an algorithm to generate random lengthy letters. This lengthy string is randomly chosen to represent the message (Wang et al., 2018). They are mixed with the plaintext message to create a ciphertext. Since the frequency of the encrypted text is consistently dispersed, decryption is difficult, increasing the text’s security.
Block Ciphers
This technique divides messages into groups or chunks and then uses symmetric keys to encrypt the groupings. Typically, the encrypted blocks are the same size as the initial blocks.
Triple DES
Using the block cipher through the (DES) data encryption standard is referred to as triple DES. This technique uses three keys to split data or information into 64-bit blocks. There are two types of triple des: two-key TDEA, in which the third and first keys are the same, and three-key TDEA, in which each key is unique.
RSA
RSA alludes to an unbalanced calculation that utilizes confidential and public keys. This technique is executed by using two indivisible numbers and then tracking down the modulus or results of those numbers, as well as examples for private and public keys.
Advanced Encryption Standard (AES)
This is a strategy for a block figure that breaks information to shape 128-digit blocks. It applies different key lengths for message encryption and was laid out to control the difficulties of information encryption.
Symmetric Encryption
The algorithmic technique uses a single key for both the message’s encryption and decryption. It makes it possible to change the message in a way that is challenging to undo without the secret key. Users should never disclose the secret key to unauthorized people since the secret key is supplied to the users, which creates certain security threats.
Text Block Coding
This technique of information concealment encrypts media files using low-bit-rate 3-D algorithms. The method is carried out via block copying from one random texture region to another with the same texture. The method employs thresholding, shifting, and autocorrelation functions during decoding. Any of these techniques may be used to secure the data by preventing illegal access to it.
Data Hiding Technologies
Data hiding technology employs algorithms to conceal private data, such as movies and photographs, so only authorized users can view it. Information-hiding algorithms are categorized based on the domain used to conceal the data and the method used to do so (Khan Academy, 2016). The following are some examples of information-hiding strategies that can be used.
- Information Hiding and Steganography: This is where a file, picture, video, or message is concealed within another message or file. It gives the hidden file the appearance of a regular file (Tao et al., 2014). This method seems to function more effectively than encryption.
- Digital Watermarking: This concealment technique is used to locate and safeguard copyright information for films or photographs. By obscuring invisible bits, the file owner safeguards copyright information in the file.
- Masks and Filtering: The method is used to conceal data in photographs. Only the sender and authorized receiver have access to the information. It is challenging to distinguish concealed files from regular files because of the masking and filtering approach (Rouse, 2016). The aforementioned measures are crucial, especially when transferring data, as they reduce the likelihood of hazards like snooping and spoofing.
Access Control Based on Smart Card Strategies
The most important thing in an organization is to prevent unauthorized access to critical network components. Many firms have access control systems in place to confirm who is using their networks and for what reason. Common Access Cards (CAC) are thought to beuseful in such situations.
Our company will successfully deploy CAC to improve both logical and physical security. Common Access Cards can store security data, including pictures, fingerprints, and PIV (personal identity verification), to authorize and authenticate workers on the workplace premises (Khan Academy, 2016). Additionally, CAC may make use of PKI (Public Key Infrastructure) certificates to assure connection security during the encryption and decryption of sensitive data such as emails and digital signatures.
The cards will be utilized as a crucial component of multi-factor authentication, particularly when connecting to the company’s network via VPN, accessing remote servers hosting sensitive data, or gaining access to the individual workstation. An additional security layer must be implemented when using authenticator software to generate PINs for servers or workstations in which encrypted data can only be decrypted using keys found in CACs (Barker, 2016). Comparing this security to using passwords or usernames, which are vulnerable to theft, is more preventative.
Anyone entering the facility must either show their CAC to the guard or have it scanned, effectively regulating entry to the organization. The use of CACs allows for the effective restriction of access to office spaces, whether it is a single room or a designated zone (Khan Academy, 2016). Fingerprint scanning grants access to such places only to specific personnel. This method is highly dependable since it stops attacks that may cause enormous devastation.
The Email Security Strategy
Email is the main form of internal communication. Modernizing email security should be a top priority in businesses. Email should be using the following nonrepudiation safeguards and cryptography innovations:
Pretty Good Privacy (PGP)
PGP is a technique for encrypting, digitally signing, and decrypting data, such as emails. Data compression, hashing, and symmetric cryptography’s public key are all combined in its use. Sending messages with PGP is more protected since they cannot be damaged or altered because the content is encrypted by hashing, making the decryption key usable if the message is altered.
GNU Privacy Guard (GPG)
GPC security application technique adheres to the open standard PGP outlined in RFC4480. It is software used to encrypt and decode files holding sensitive and secret information. This software works by using pairs of the symmetric keys that each GnuPG user generates. This results in creating a public key, which is then distributed to other users via various processes so they may access important internet key servers.
Public Key Infrastructure (PKI)
This approach improves the security and integrity of email. By requiring responsibility and secrecy and directing the public to the appropriate institution or person, it facilitates secure electronic data exchanges. PKIs rely on the central directory, certificate policy, and registration authority to enable users to digitally sign files and email encryption and decryption.
Digital Signature
Digital signatures use asymmetric encryption to offer extra protection and validity to messages sent across insecure channels. They give the communication recipient confidence that there was no interference during transit. Stamp seals and digital signatures are as vital as handwritten signatures.
Mobile Device Encryption
Mobile devices use encryption techniques to protect their communications. Elliptic curve cryptography creates effective, compact cryptographic keys more quickly and with fewer computational resources than other methods (Barker, 2016). However, ECC protects mobile communications by decreasing battery use.
Recommendations
Even with all preventive measures in place, an organization cannot ensure that assaults will not occur. Therefore, it is critical to monitor any potentially harmful behavior and prevent it from accessing data systems.
Deployment Plan
The present pace of technological innovation has led to an increase in new threats and vulnerabilities. As a result, I’ll create a solid IT security team with all the required security measures. Additionally, I will ensure that there are as few flaws, defects, and vulnerabilities as possible in creating and implementing defensive software. Even if firm x does not generate software, I will order the senior management to collaborate closely with software providers to guarantee the delivery of software that is free of vulnerabilities (Li et al., 2021). The creation of a suitable defensive mechanism will be made feasible by the identification of potential security gaps.
It is crucial to check that our authentication procedures are not severe to the point where they restrict availability while keeping integrity, availability, and secrecy in mind. Even if usernames and passwords can be attacked, they can provide enough security and accountability. Opponents are working hard to target companies’ communication channels to prevent the regular operation of crucial information in the systems since data integrity is a crucial component of the company (Li et al., 2021). The adoption of contemporary cryptography is thus required to ensure acceptable security for our information systems.
References
Barker, E. (2016). Computer Security: Recommendation for key management (Special Publication 800-57, Part 1, Revision 4). National Institute of Standards and Technology. US Department of Commerce. Web.
Barker, E. (2016). Computer Security: Recommendation for key management, Part 1: General (Special Publication 800-57, Part 1, Revision 4). National Institute of Standards and Technology. US Department of Commerce. Web.
Khan Academy. (2016). The Caesar cipher. Web.
Li, Y., Wang, H., Wang, S., & Ding, Y. (2021). Attribute-based searchable encryption scheme supporting efficient range search in cloud computing. 2021 IEEE Conference on Dependable and Secure Computing (DSC). Web.
Lozupone, V. (2018). Analyze encryption and public key infrastructure (PKI). International Journal of Information Management, 38(1), 42-44. Web.
Neupane, K., Haddad, R. J., & Moore, D. L. (2018). Secrecy analysis of massive MIMO systems with MRT Precoding using normalization methods. SoutheastCon 2018. Web.
Prakasha, K., Muniyal, B., & Acharya, V. (2019). Automated user authentication in wireless public key infrastructure for mobile devices using Aadhar card. IEEE Access, 7, 17981-18007. Web.
Reuter, A., Boudaoud, K., Winckler, M., Abdelmaksoud, A., & Lemrazzeq, W. (2020). Secure email – A usability study. Financial Cryptography and Data Security, 36-46. Web.
Rouse, M. (2016). One-time pad. TechTarget. Web.
Shakya, S., Ntalianis, K., & Kamel, K. A. (2022). Mobile computing and sustainable informatics: Proceedings of ICMCSI 2022. Springer Nature.
Tao, H., Chongmin, L., Zain, J. M., & Abdalla, A. N. (2014). Robust image watermarking theories and techniques: A review. Journal of Applied Research and Technology, 12(1). Web.
Wang, Y., Zhang, S., Tang, Y., Su, Q., & Chen, B. (2018). Rational Adversary with flexible utility in secure two-party computation. Journal of Ambient Intelligence and Humanized Computing, 10(8), 2913-2927. Web.