Cyber Security 2022 Board Question Paper

Step-by-Step Solutions: Core Cyber Security Concepts

i. Denial of Receipt:

A repudiation attack where a recipient maliciously denies having received a specific message, file, or transaction. Countered via non-repudiation digital receipts.

ii. Block Cipher vs. Stream Cipher:

• Block Cipher: Encrypts fixed-size blocks of plaintext simultaneously (e.g., AES 128-bit blocks, DES 64-bit blocks).
• Stream Cipher: Encrypts plaintext bit-by-bit or byte-by-byte continuously using a pseudorandom keystream (e.g., RC4, ChaCha20).

iii. Types of VPN:

1. Remote Access VPN: Connects individual remote telecommuters to a corporate network.
2. Site-to-Site VPN: Connects entire branch office networks securely across the internet.

iv. Characteristics of a Proactive Password Checker:

Rejects weak or compromised passwords during creation by verifying length, entropy, and checking against leaked password dictionaries.

v. Principle of Psychological Acceptability:

Security mechanisms should not make resource access so cumbersome that users attempt to bypass or subvert the controls.

vi. Virus vs. Worm:

A virus requires a host executable to propagate; a worm is a standalone program that self-replicates across networks autonomously.

vii. Hacker vs. Cracker:

A hacker explores and analyzes security architectures; a cracker breaches security systems with malicious intent for theft or vandalism.

viii. Secure Email:

Email secured using asymmetric cryptography for end-to-end encryption and digital signatures (e.g., PGP, S/MIME).

ix. Inference Control:

Techniques in statistical databases that prevent users from deducing confidential individual records through aggregate statistical queries.

x. Trademark vs. Patent:

A trademark protects distinctive brand names and logos; a patent grants exclusive rights to novel functional inventions.

Biba Integrity Model

The Biba Integrity Model is a formal state-machine model focused on information integrity rather than confidentiality:

1. Simple Integrity Axiom (No Read Down): A subject at a given integrity level cannot read data from a lower integrity level ($s$ can read $o \iff I(s) \le I(o)$).
2. Star ($\star$) Integrity Axiom (No Write Up): A subject at a given integrity level cannot write data to a higher integrity level ($s$ can write $o \iff I(o) \le I(s)$).

• Goal: Prevents low-integrity (untrusted) data from contaminating high-integrity critical data.

RSA Decryption Numerical Problem

Given:

• Ciphertext $C = 8$
• Public Key $e = 3, \quad n = 33$

Step 1: Factor $n$ to find $p$ and $q$$n = 33 = 3 \times 11 \implies p = 3, \quad q = 11$$

Step 2: Compute Euler’s Totient $\phi(n)$$\phi(n) = (p - 1)(q - 1) = (3 - 1)(11 - 1) = 2 \times 10 = 20$$

Step 3: Compute Private Key $d$$e \cdot d \equiv 1 \pmod{\phi(n)} \implies 3d \equiv 1 \pmod{20}$$

Testing values: $3 \times 7 = 21 \equiv 1 \pmod{20} \implies \mathbf{d = 7}$.

Step 4: Decrypt Ciphertext $C$ to find Plaintext $M$$M = C^d \pmod n = 8^7 \pmod{33}$$

• $8^2 = 64 \equiv -2 \pmod{33}$
• $8^4 \equiv (-2)^2 = 4 \pmod{33}$
• $8^6 = 8^4 \times 8^2 \equiv 4 \times (-2) = -8 \pmod{33}$
• $8^7 = 8^6 \times 8 \equiv (-8) \times 8 = -64 \equiv 2 \pmod{33}$

The original plaintext is $\mathbf{M = 2}$.

Comparison: DSS vs. RSA Digital Signature Approaches

1. RSA Approach: The hash of the message is directly encrypted with the sender’s private key to form the signature. Anyone with the sender’s public key can decrypt the signature to verify the hash.
2. DSS (Digital Signature Standard) Approach: Uses SHA with the Digital Signature Algorithm (DSA). It produces a pair of large numbers ($r, s$) that verify authenticity without revealing private key components.

SSL/TLS Handshake Protocol Flow

$$\begin{matrix} \textbf{Client} & & \textbf{Server} \\ \text{ClientHello (Supported ciphers, nonce)} & \longrightarrow & \\ & \longleftarrow & \text{ServerHello (Chosen cipher, nonce)} \\ & \longleftarrow & \text{Certificate (Server Public Key) + ServerHelloDone} \\ \text{ClientKeyExchange (Pre-master secret encrypted with Server PubKey)} & \longrightarrow & \\ \text{ChangeCipherSpec + Finished} & \longrightarrow & \\ & \longleftarrow & \text{ChangeCipherSpec + Finished} \\ \textbf{Secure Symmetric Encrypted Session} & \longleftrightarrow & \textbf{Established} \end{matrix}$$

Architecture of Intrusion Detection Systems (IDS)

An IDS consists of four functional architectural modules:

1. Sensors/Agents: Collect security event data from packet sniffers, host system logs, and network interfaces.
2. Analysis Engine: Analyzes incoming sensor feeds using Signature-based detection (known threat patterns) or Anomaly-based detection (statistical deviations from baselines).
3. Alert/Response Module: Generates administrator alerts or triggers automated countermeasures (e.g., firewall rule updates).
4. Database Repository: Stores attack signatures, event logs, and baseline behavior profiles.

Four Common Security Programming Vulnerabilities

1. Buffer Overflow: Writing data past the allocated boundaries of a buffer in memory, allowing attackers to overwrite execution return addresses (e.g., using unsafe strcpy() in C).
2. SQL Injection (SQLi): Concatenating unsanitized user inputs into database queries, allowing attackers to bypass authentication or extract sensitive data.
3. Cross-Site Scripting (XSS): Injecting malicious client-side JavaScript into web pages viewed by other users.
4. Improper Error Handling & Information Leakage: Returning verbose database stack traces to end users, revealing internal server architectures to potential attackers.

Digital Forensics: Definition & Investigation Procedures

Digital Forensics is the scientific preservation, identification, extraction, documentation, and analysis of digital evidence stored on electronic devices for legal proceedings.

Standard Investigation Phases:

1. Identification: Identifying crime scenes, potential digital devices, and relevant storage media.
2. Preservation: Isolating evidence and creating bit-stream disk images while maintaining strict chain of custody.
3. Analysis: Recovering deleted artifacts, analyzing timeline metadata, and identifying malicious footprints.
4. Documentation and Reporting: Compiling factual forensic reports suitable for presentation in court.