Networks
Networks
6. Social networking sites are becoming ever more popular, and many other
sites now let users add each other as friends. Discuss the effect that social
context has on (i) phishing; (ii) inference control; (iii) the market for
privacy; (iv) community detection.
a) Phishing
Phishing is a type of social engineering attack often used to steal user data,
including login credentials and credit card numbers. It occurs when an attacker,
masquerading as a trusted entity, dupes a victim into opening an email, instant
message, or text message. The recipient is then tricked into clicking a malicious
link, which can lead to the installation of malware, the freezing of the system as
part of a ransom ware attack or the revealing of sensitive information.
b) Inference control
Inference control in databases, also known as Statistical Disclosure Control
(SDC), is a discipline that seeks to protect data so they can be published without
revealing confidential information that can be linked to specific individuals
among those to which the data correspond. SDC is applied to protect respondent
privacy in areas such as official statistics, health statistics, e-commerce (sharing
of consumer data), etc. Since data protection ultimately means data
modification, the challenge for SDC is to achieve protection with minimum loss
of the accuracy sought by database users.
c) Market for privacy
People value privacy differently. For example, different people are willing to
pay a range of premiums to conduct online transactions with added privacy
guarantees. Similarly, some individuals demand significantly more
compensation than others for having their location data tracked. These results
suggest the potential for a market in privacy interests. Allowing individuals to
buy and sell their privacy freely might be a boon to efficiency, in the same way
that removing a price floor or ceiling on a good reduces deadweight loss.
d) Community detection
The field of community detection aims to identify highly connected groups of
individuals or objects inside these networks, these groups are called
communities. The motives behind community detection are diverse: it can help
a brand understand the different groups of opinion toward its products, target
certain groups of people or identify influencers, it can also help an e-commerce
website build a recommendation system based on co-purchasing, the examples
are numerous.
7. The Children Act 2004 empowers the Government to establish child
protection databases for England and Wales which will, it is hoped, identify
cases of child abuse at an early stage. These databases will be fed with
medical and school records, police intelligence data, and social work
assessments. Social workers, doctors, nurses, teachers and police officers
will be able to query them. Sketch a possible security policy for such a
database, and discuss the most likely implementation problems.
Information Security Policy:
An information security policy (ISP) is a set of rules that guide individuals who
work with IT assets. Your company can create an information security policy to
ensure your employees and other users follow security protocols and
procedures. An updated and current security policy ensures that sensitive
information can only be accessed by authorized users.
8 Elements of an Information Security Policy:
• Purpose
Create an overall approach to information security. Detect and pre-empt
information security breaches such as misuse of networks, data, applications,
and computer systems.
• Audience
Define the audience to whom the information security policy applies. You may
also specify which audiences are out of the scope of the policy (for example,
staff in another business unit which manages security separately may not be in
the scope of the policy).
• Objectives
Confidentiality—only individuals with authorization can should access data and
information assets
Integrity—data should be intact, accurate and complete, and IT systems must be
kept operational
Availability—users should be able to access information or systems when
needed
• Authority and access control
Network security policy—users are only able to access company networks and
servers via unique logins that demand authentication, including passwords,
biometrics, ID cards, or tokens. You should monitor all systems and record all
login attempts.
• Data classification
To ensure that sensitive data cannot be accessed by individuals with lower
clearance levels. To protect highly important data, and avoid needless security
measures for unimportant data.
• Data support
Data protection regulations—systems that store personal data, or other sensitive
data, must be protected according to organizational standards, best practices,
industry compliance standards and relevant regulations. Most security standards
require, at a minimum, encryption, a firewall, and anti-malware protection.
• Security awareness
Share IT security policies with your staff. Conduct training sessions to inform
employees of your security procedures and mechanisms, including data
protection measures, access protection measures, and sensitive data
classification. Social engineering—place a special emphasis on the dangers of
social engineering attacks (such as phishing emails). Make employees
responsible for noticing, preventing and reporting such attacks.
8. Describe briefly security policy models that might be suitable for
protecting
(i) medical records;
(ii) police intelligence data;
(iii) school records.
a) Medical records
The Departmental of Behavioral Health (DBH clinical/medical records are the
property of the department and are maintained for the treatment of the client and
the medical staff. It is the responsibility of the department to safeguard and
secure the medical information against loss, defacement, tampering, or use by
unauthorized person(s). Records may be removed from the department's
jurisdiction and safekeeping only as provided by law.
The Medical Records unit's responsibilities are to protect and safeguard
information and information systems against unauthorized user(s). This policy
statement applies to the security and confidentiality of patient information
created electronically or paper documents. Under no circumstances will any
staff member examine and/or divulge confidential client information unless
required in the clinical and/or administrative care of the client.
b) Police intelligence data
Protecting a computer network can be a very daunting task. Here we identify
some of the more important items that a police chief should consider. These
issues will apply whether the chief maintains and operates her own network, or
simply wants to be informed about the critical issues. For example, below we
discuss the following:
• Separating the Data and Segmenting the Network
• Protecting the Network
• Educating Users and Protecting the Host
• Planning for a Cyber Incident
c) school records
• All staff are responsible for the security of buildings and property.
• At the end of the School day each member of staff should ensure that all
windows and external doors are securely fastened prior to a final check by the
building supervisor.
• All staff are responsible for keeping buildings clear of all materials that can be
used for arson or vandalism.
• Adequate security lighting is installed and maintained/monitored by site staff.
• Risk assessments are in place and are reviewed by the person responsible for
health and safety and the Board of Governors annually.
9. You are developing a multi-user computer game, and wish to make it
harder for players to cheat. (a) Discuss the possible benefits of using (i)
encryption/authentication (ii) virus detection technology (iii) intrusion
detection techniques.
Benefits of using encryption/authentication:
1. Enhance Data Security
Without any doubts, one of the most critical merits is strengthened data security.
Full disk encryption uses strong encryption algorithms to encrypt drives on your
PCs, thereby protecting all data stored in the drives. With FDE, even though the
drive is removed from the current computer and put into other devices, the drive
data is still inaccessible if without a correct key.
2. Auto Encrypt Data
Besides, unlike file or folder-level encryption, full disk encryption (FDE)
encrypts the data as soon as it’s stored to the hard drive. In other words, this
encryption process is completed automatically. Hence, it’s much more
convenient than file or folder encryption, which demands you to manually select
which file or folder to be encrypted.
Benefits of using virus detection technology:
The main role of an antivirus program is to stand against viruses and other
forms of malwares. The viruses will not only cause damages to your data, it can
degrade the overall system performance. All of them can happen without your
knowledge. The antivirus software installed on your computer detects and
removes these malwares before they cause any harms to your computer.
Benefits of using Intrusion detection techniques:
Firewalls may be able to show you the ports and IP addresses that are used
between two hosts, but in addition a NIDS can be tuned to show you the
specific content within the packets. This can be used to for uncovering
intrusions such as exploitation attacks or compromised endpoint devices that are
part of a botnet.