Instant DBMS Assignment Help

Instant DBMS Assignment Help

For any Assignment related queries, Call us at: - +1 678 648 4277 You can mail us at: - info@databasehomeworkhelp.com or reach us at: - https://www.databasehomeworkhelp.com/

Problem A series of security questions have been raised as you develop the aircraft parts system. Please answer each of the following questions in one page or less.

1.You have concluded an agreement for very close supply chain integration with ten key customers. You will hold a Web meeting with the others to discuss how to integrate access between supply chain functions. Each of the 11 parties will be able to log into all other ERP systems to perform basic supply chain functions such as order placement, checking shipment status, checking inventory, and invoice submission. Each party can only access a restricted portion of each ERP system. Each party has a different ERP system; each ERP has both Web services and Web page interfaces. You must develop a proposed approach for security.

Recommend a method for the parties to log into each system. Options include usernames/passwords, SSL certificates (for server and client), and/or Kerberos tickets. Briefly describe the pros and cons of each approach, and the basis for the one you recommend. Assume all 11 ERP systems support Kerberos, SSL and username/password security. Briefly discuss who administers each option: is it centralized over all 11 ERPs, or decentralized?

2.Using the notation in Anderson, define the protocol that is used by customer vehicles transporting materials out of your facilities. Assume: a.Drivers have IDs with personally identifying information b.Drivers have a smartcard issued by the aircraft parts company to the driver’s carrier/employer that is used to open the gate to the parts distribution center.

The card uses the same protocol as in the lecture 26 notes: T -> G : T, {T, N}KT databasehomeworkhelp.com

c. For each shipment, inbound or outbound, the freight bill number is provided electronically by the parts distributor to the carrier via a secure Web service using RSA encryption. The carrier provides it to the driver via email before the driver arrives at the distribution center. d.The driver taps his or her smart card at the gate e.The gate writes an access code to the smart card, which will be used at the loading door at your facility. This is encrypted with KT. f. The gate prompts the driver to key in the freight bill number at a touchpad at the gate. g.The gate will open after a valid smart card is tapped and a valid freight bill number is entered.

This may or may not be a good protocol. a.Define all the principals and variables in the protocol b.Define the protocol using the same notation used in lecture (e.g., T->G: T, {T, N}three protocol flaws will have steps corresponding to2. the description 3.List in the protocol in question Then describeabove. one or more KT. Yourpotential attacks that use these flaws, individually or in combination, to enter the facility improperly and/or steal a truck and its contents. Assume your attacker has substantial resources. a.List the flaws b.Describe one or more attacks 4.Your security plan has the following elements: a.Physical barriers at access points and surrounding the facility: fences, building doors and gates for vehicle access. databasehomeworkhelp.com

b.Access control for employees and visitors, based on smart cards, providing access through gates and doors, as described in question 2 above. c.Video monitoring of perimeter of distribution center, at fences, gates and outside doors. d.Inspection of inbound and outbound materials at the loading dock. e.Security staff to issue and monitor cards, monitor video, and periodically patrol the facility. f.Kerberos or SSL/certificate security for your ERP systems, Web servers and databases.

Develop 5 use cases in which an intruder can gain access to the distribution center, including transportation vehicles and the facility, or its data, including financial or payment data. Make reasonable assumptions about the implementation of the aircraft parts distributor’s security plan; you may specify the details as you wish, as part of your scenarios. Assume your attacker has substantial resources and is seeking financial gain. Try to develop the five most likely use cases. You may either draw a use case diagram, or just list the scenarios.

5.The parts distributor has decided to issue smart cards to each driver for each of the transportation carriers that serve it, an improvement over its current system. The parts distributor has also remedied the other flaws in the current protocol that you have pointed out above. The new smart card and the readers associated with it also have biometric capabilities. Driver fingerprints, iris scans and other features may be used.

Read Anderson chapter 15 on biometrics, and: a.Recommend what, if any, biometric methods should be added to the smart card. databasehomeworkhelp.com

a.Recommend what, if any, methods should be added b.Assess, briefly, what level of safety they add Hand in a Word document with your answers.

databasehomeworkhelp.com

Solutions 1.Agreement 1.Kerberos is a private key, trusted third party authentication system. It requires all the companies to have single, trusted Kerberos server.

This has an internal risk: the Kerberos administrator(s) would manage all security for each ERP, not just access to the shared features. This is probably unacceptable: a customer could spy on other customers.

Kerberos is almost always used within one organization, where these risks are minimal.

2.SSL is a public key, certificate-based authentication system. SSL certificates can be issued by the aircraft parts company or a third party, which is a certificate authority (CA). The aircraft parts company, if it issued its own certificates, would also use a root CA. Each of the 11 companies would decide which certificates had which privileges in its ERP system; there is no centralized security administration.

3.The tradeoffs between Kerberos and SSL are: a.Kerberos requires a trusted server; SSL doesn’t (though it requires a certificate authority to issue the certificates) b.Kerberos has central management of user authentication and authorization; SSL has certificates that identify the principals, but authorization (access to apps) is handled by each ERP. c.SSL can be used to establish communications between parties who don’t have a shared secret (private key). This isn’t important in this case, since the aircraft parts company and its customers are known to each other.databasehomeworkhelp.com

2. Define all the principals and variables in the protocol: 1.Principals: a.Let D be driver and his/her ID b.Let T be the smartcard issued by aircraft parts company to carrier c.Let F be the freight bill number d.Let G be the gate and its smartcard reader; KT is the shared key between the gate and all smartcards e.Let C be the transportation carrier server and KC its public key f. Let M be the aircraft parts distributor server g.Let A be the access code Define the protocol 2.Protocol: a.M-> C: {F}KC b.C-> D: F c.T-> G: T, {T, N}KT d.G-> T: {A}KT e.D->G: F username and password are controlled more closely a.A Kerberos by the Kerberos administrator. b.Both SSL and Kerberos encrypt the session with the ERP. 1.Usernames and passwords are probably the least acceptable. databasehomeworkhelp.com

a.For usernames and passwords, it will be necessary for each of the 11 companies to manage their own system. Requests to add, change or delete a username will have to be handled at all 11 systems. The same username/password pair will be assigned to a user across all 11 systems.

To manage this centrally would require a group that has admin access to all 11 ERPs, which is probably an unnecessary security risk, since these admins 3.List three would potential almostflaws certainly have access to the full ERP. a.List the flaws: 4.Driver ID not in protocol.

5.Access code written to card before valid freight bill number entered.

6.Freight bill sent in clear.

7.Shared private key KT across all smart cards. b. Describe one or more attacks: If an intruder wishes to improperly enter the facility, these flaws can be used in combination: 1.The intruder can steal a smart card from any driver of any carrier serving the distribution center. Or the intruder can use a man in the middle attack or crack the key, as in the lecture notes. Since driver ID is not in the protocol, any card will do.

2.

The freight bill number is sent in the clear from the carrier to the driver in email, so the intruder can intercept it. The intruder can also get the number when the driver keys it in, by getting the electromagnetic radiation from the key taps, or by a hidden camera databasehomeworkhelp.com near the gate, or other means. Freight bill numbers remain valid and

1.The access code is written to the card before a valid freight bill number is entered. An intruder with a stolen card can get the access code from the gate first, and then get a freight bill number later, making an attack easier. The access code may remain in effect for a long period allowing multiple attacks.

4. Use cases Some plausible scenarios are listed below. You will have others that are equally plausible.

1.Steal or hijack a high value shipment for direct financial gain a.Steal an access card, intercept a freight bill number as in question 3 2.Steal or hijack a safety critical shipment to use for blackmail or other threat. a.Same steps as above.

3.Break into the database to steal aircraft parts company’s financial information, such as bank accounts that can be stolen from. a.Attackers try all Web pages and Web services, looking for flaws in logic. Methods include cross site script attacks, SQL injection, etc.

The goal is to obtain administrator access to the database.

4.Break into the database to steal vendor or customer financial information, to steal from it. a.Same steps as in 3 above. Other possibilities are to compromise an employee, guess passwords, etc.

5.Introduce a virus in the company’s systems to shut down the distribution center or cause processes to malfunction, as an extortion attempt. a.System operators with Internet access are lured to Web sites that can infect the system software. databasehomeworkhelp.com

1.Steal trade secrets and sell them to a competitor. a.Gain access to the company’s file servers or internal network, and obtain documents with trade secrets.

5. Biometrics 2.Fingerprint readers are the most widely used biometric technique.

Equipment is readily available. The false match rate is about 1% and the missed match rate is perhaps 4% in many cases. These are likely to be acceptable for a relatively small number of drivers, and in a system where there are other elements that control access, such as having the card and the freight bill number. Fraud is possible through “lifting” fingerprints and making copies, so a sophisticated attacker must be assumed to be able to defeat the fingerprint check.

3.Iris scans are more expensive, take more time (the driver would probably have to exit the truck), but have lower error rates than fingerprint readers. Fraud is possible through taking pictures of a valid driver’s eyes and using the picture, possibly printed on a contact lens, so again, a sophisticated attacker must be assumed to be able to defeat the iris check.

4.Voice recognition is likely to be unreliable, as noted in Anderson.

Recordings are an easy way to defeat them, and there are others.

5.These methods add security in routine operations, but probably not much against a sophisticated attack. These methods work best in attended operations, so the aircraft parts distribution center security staff may need to be assigned to the gate to obtain the benefit of biometric checks.

Biometrics is unlikely to provide after-the-fact proof in court. Last, databasehomeworkhelp.com