Excersise 1 Cybersecurity design principles
Shaquile Garces-Phillips
Old Dominion University School of Cybersecurity
CYSE432: Cyber Risk CSF/CMMC
Professor: Leach Josephine
DESCRIPTION: This lab focused on the core principles of secure system design and cybersecurity risk assessment. Through design principles and a real-world cybersecurity scenario, I analyzed system vulnerabilities, evaluated potential security risks, and identified strategies to protect critical assets. This assignment strengthened my understanding of secure system design, vulnerability assessment, and applying cybersecurity concepts to real-world situations.
Focus Questions:
- What specific good design principles are covered?
The good designed principles that were cover where modularity, simplicity and layering.
Modularity- Subdivides a system into smaller parts or modules that can be independently created then used in several systems. The development of security functions as separate, protected modules.
Simplicity Design- When you design a security application on program, Keep it as simple as and small as possible.
Layering uses overlapping protection approaches to address the people, technology and operational aspects of information.
- How are authorization principles addressed?
Authorizations principles are address by making sure only the right people can access the right information. The systems checks access every time someone’s tries to utilize a resource, give user the only access they need in order to complete their job, separates duties to reduce risk and blocks access by default just in case something goes wrong.
- What are the minimization principles discussed?
The minimization principles discussed are isolation and encapsulation.
Isolation- Prevents disclosure or tampering with critical resources.
Encapsulation- Hides internal details and only exposes what is necessary.
Excersise 2 Cybersecurity Scenario
Questions to focus on:
- What techniques can be used to identify potential vulnerabilities within these assets?
A technique that can be used to identify potential vulnerabilities are vulnerability scans and software updates.
- What is the function of each exposed asset?
The function of the laptop is thati tis used by employees to do work such as accessing systems and emails
The function of the printer / scanner is that it can be used to print and scan in classidied documents.
- What kind of data is stored on each asset?
Personal data, login credentials , emails and business files.
- What would be the impact of a successful attack on each critical asset?
If a successful attack was to take place it could lead to a loss of date and both legal and financial problems
- Considering the potential impact, which critical assets are most vulnerable?
I believe that each and every last asset is vulnerable because they all can hold critical data.
Lab 2 Part III: Cryptography, Encryption and Data Formatting, Hashing, and Digital Signatures
Exercise 1:Cryptography
Questions to Focus on:
Understanding Encryption:
- What is encryption, and why is it crucial for data security?
Encryption is when information is locked do so that only authorized people are able to read it. This is crucial because it is important sensitive data from being seen or stolen.
How does encryption ensure confidentiality and data integrity?
Encryption is able to keep data confidential by making it unreadable unless you have the correct key.
Symmetric vs. Asymmetric Encryption:
- What are the key differences between symmetric and asymmetric encryption methods?
The difference between symmetric and asymmetric encryption is that symmetric encryption uses one shared key to lock and unlock data while asymmetric encryption uses two key.
- When would you use symmetric encryption, and when would asymmetric encryption be preferred? (The activity or quiz might provide scenarios to help you differentiate)
You would use symmetric encryption when you want some quickly delivered, in which as I stated before only one key is used, but if you want something to be better secured you would use asymmetric
Digital Signatures:
- What is a digital signature, and how does it function?
Digital signatures act like electronic stamps of authenticity for digital information. They ensure that the information originated from a trusted source and hasn’t been tampered with during transmission. Imagine signing a document electronically to verify your identity and confirm the document hasn’t been altered. (Frome Exercise cryptography 1)
- How do digital signatures contribute to secure communication and document verification?
Digital signatures help ensure that a message or document comes from a trusted source and has not been changed
Exercise 2:Encyrption
Highlighting Questions to Focus On:
Understanding Encryption:
- What is encryption, and how does it ensure data confidentiality?
Encryption locks data so that only people who are authorized can view it.
- Why is it essential to keep encryption keys secure?
The reason it is important to keep encryption keys secured is because whoever has the keys are able to get access to the data.
Types of Encryption:
- What are the core differences between symmetric and asymmetric encryption?
The core difference between the two is that symmetric has one shared key while asymmetric uses two keys
- When would you choose one type of encryption over the other for data confidentiality?
You would use symmetric encryption when you want some quickly delivered, in which as I stated before only one key is used, but if you want something to be better secured you would use asymmetric
Exercise 3 Encryption and data formatting
Highlighting Questions to Focus On:
Understanding XOR:
- What is the XOR operation, and how does it work on binary bits?
It is stated that XOR is a fundamental bitwise operation used in computer science. It operates on individual bits (0s and 1s) of two binary numbers and produces a 1 only if the corresponding bits are different. (one is 0 and the other is 1) if the corresponding bits are the same (both 0’s or both 1s) the XOR operations results in 0.
- How does the XOR operation differ from logical AND and OR operations?
XOR is different from other logical operation and OR operations because It only gives 1 result when two bits are different. AND gives a 1 only when both bits are 1 and OR gives a 1 when at least 1 bit is 1.
XOR for Encryption (Limitations):
- How is XOR used in the game for encryption?
XOR is used in the game for simple encryption methods.
- Why is XOR alone not considered a secure encryption method in real-world scenarios?
The reason XOR alone is not considered a secure encryption method in real world scenarios is because it is not secure enough to use it by itself in the world sceniors. XOR usually uses short or simple keys that could possibly be guessed by trying many possibilities.
Exercise 4: Hashing
Highlighting Questions to Focus On:
Understanding Hashing:
- What is hashing, and how does it transform variable-length data into a fixed-size output?
Hashing is transforming digital data of any size (Text,files, etc.) into a fixed sized string of characters called a hash value or hash digest. This process acts like a digital fingerprint for the data.
- What are the key characteristics of a good hash function (efficiency, fixed-size output, collision resistance)?
Key characteristics of good hashing is a fixed size output: In which it says regardless of the input data length, the hash function always produces a hash value of the same predetermined size. In addition, Efficiency has hashing algorithms which are designed to be computationally efficient, meaning they can generate hash values quickly. Lastly Collision Resistance in which it is highly unlikely for two different data inputs to produce the same hash value (collisions).
Hashing in Action:
- How does the provided activity demonstrate the hashing process?
The activity demonstrates the hashing process by taking different inputs and running them through a hash function and creating a fixed size hash. In addition, it also shows that even a. small change in the input creates a different hash.
- Why is it important that even small changes in the input data lead to different hash values?
It is important because even a small change in the data creates a different hash, which helps show if the data was changed or even tampered with.
Enhancing your knowledge: Digital Signatures
Highlighting Questions to Focus On:
Understanding Digital Signatures:
- What are digital signatures, and how do they contribute to information security by ensuring authenticity and integrity?
It is stated that Digital signatures is used to authenticate and. Verify documents and data to avoid tampering and digital modification or forgery during the transmission. A digital signature uses the public key cryptography architecture. Typically an asymmetric key system encrypts using a public key and decrypts with the private key for.
- How do digital signatures differ from traditional handwritten signatures in terms of functionality and purpose?
Digital signatures differ from traditional handwritten signatures because they do more than show agreement. A Handwritten signature only shows that someone accepted and signed for a document but a digital signature uses encryptions to prove who signed the document and also protects it from being changed
The Digital Signature Process (Based on the Activity):
- Explain the steps involved in creating and verifying digital signatures as presented in the activity? Focus on the specific actions you perform within the activity.
The digital signature starts with hashing that uses a cryptographic flash function, Next singing with a private key, Then lastly attaching a signature.
- Why is hashing such a crucial element in the digital signature process? How does it contribute to verifying the integrity of the data?
The reason that hashing is a crucial element because it helps protect the document from being changed, in which the smallest change to the document would create a completely different hash which makes tampering easier to detect.
Public vs. Private Keys:
- How do public and private keys work together to enable secure digital signatures?
Public and private keys work together to keep digital signatures secure. For instance the private key is secrete and is only used by the person signing the document, while the public key is shared with other so they can check the signature.
- Why is it essential to keep the private key confidential? What security risks might arise if it’s compromised?
The reason it is important to keep private keys confidential is because if someone was able to get access to them they could create a fake digital signatures that look exactly like the real one, In which this could lead to fraud and data being changed.
