Cyber Security 2023 Board Question Paper

Definition of Masquerading

Masquerading (or identity spoofing) is an attack where an unauthorized entity successfully pretends to be an authorized user or system by forging credentials, stealing session tokens, or spoofing IP/MAC addresses to gain illicit access.

Caesar Cipher Encryption of “Bimsixth”

Using the standard Caesar cipher shift of $k = 3$ ($C = (P + 3) \pmod{26}$):

• B (1) + 3 = E (4)
• i (8) + 3 = l (11)
• m (12) + 3 = p (15)
• s (18) + 3 = v (21)
• i (8) + 3 = l (11)
• x (23) + 3 = a (0)
• t (19) + 3 = w (22)
• h (7) + 3 = k (10)

$$\text{Plaintext: } \text{"Bimsixth"} \implies \mathbf{\text{Ciphertext: "Elpvlawk"}}$$

Major Difference Between IPsec ESP and AH

• AH (Authentication Header): Provides data integrity, data origin authentication, and anti-replay protection, but no data confidentiality (no encryption).
• ESP (Encapsulating Security Payload): Provides data confidentiality (encryption) in addition to authentication, integrity, and anti-replay protection.

Fundamental Problems with Password-Based Systems

1. Human Vulnerability & Weak Entropy: Users frequently choose short, predictable passwords and reuse them across multiple critical services.
2. Susceptibility to Credential Harvesting: Passwords can be intercepted via phishing, keyloggers, brute-force attacks, and credential-stuffing breaches.

Definition of Improper Sequencing

Improper Sequencing is a software design flaw where operations or instructions are executed in an unexpected or unvalidated order, enabling race conditions, unauthorized state transitions, or memory corruption.

Components of an Intrusion Detection System (IDS)

1. Sensors/Data Collectors: Gather system activity logs and monitor network packets.
2. Analysis Engine: Evaluates collected data against attack signatures or anomaly profiles.
3. Alert/Notification Console: Displays alerts and incident notifications to security personnel.

Rabbit vs. Bacteria in Computer Security

• Rabbit (Fork Bomb): A denial-of-service attack program that self-replicates rapidly within a single host to exhaust system processes, CPU, and memory tables until the machine crashes.
• Bacteria: Programs that replicate and consume disk storage space rather than CPU cycles, gradually rendering file systems unusable.

Limitations of Standard SMTP

1. Lack of Inherent Encryption: Transmits email messages and credentials in unencrypted plaintext across mail hops.
2. Absence of Sender Authentication: Does not natively verify the sender’s identity, making it vulnerable to email spoofing and spamming.

Definition of Cyber Bullying

Cyber Bullying is the repeated, deliberate use of digital communication tools (social media, messaging apps, forums) to harass, threaten, humiliate, defame, or intimidate an individual.

Definition of Cyber Law

Cyber Law is the legal framework governing digital technology, internet usage, electronic commerce, software intellectual property, data privacy, and the prosecution of computer crimes (e.g., Nepal’s Electronic Transactions Act, 2063).

Human Factor: Weakest and Strongest Link in Security

• The Weakest Link: Humans are susceptible to social engineering, phishing, cognitive fatigue, and password reuse. Technical security controls can be rendered ineffective if an employee clicks a malicious attachment.
• The Strongest Link: Well-trained personnel provide vital contextual awareness, identifying subtle operational anomalies and social engineering attempts that automated security software may miss.

Core Principles for Designing Secure Systems (Saltzer & Schroeder)

1. Least Privilege: Every process and user must operate using the minimum set of permissions necessary to perform their assigned task.
2. Defense in Depth: Implement multiple layered security defenses (firewalls, encryption, authentication) rather than relying on a single control.
3. Fail-Safe Defaults: Access decisions should be deny-by-default; access is granted only upon explicit authorization.
4. Economy of Mechanism: Keep security designs as simple and small as possible to minimize attack surfaces and implementation bugs.

Digital Signatures: DSS and RSA Approaches

• RSA Signature Scheme: The message hash is encrypted using the signer’s private key ($S = H(M)^d \pmod n$). Verification decrypts $S$ using the sender’s public key $e$ and compares it to $H(M)$.
• DSS (DSA) Scheme: Generates a pair of mathematical values ($r, s$) using modular arithmetic over prime fields. Verification checks mathematical congruences without decrypting.

RSA Algorithm with Example

Key Generation Steps:

1. Choose two distinct prime numbers: Let $p = 3, q = 11$.
2. Compute modulus: $n = p \times q = 3 \times 11 = 33$.
3. Compute totient: $\phi(n) = (p-1)(q-1) = 2 \times 10 = 20$.
4. Choose public exponent $e$ such that $1 < e < 20$ and $\gcd(e, 20) = 1$: Choose $e = 3$.
5. Compute private key $d$ such that $e \cdot d \equiv 1 \pmod{20} \implies 3d \equiv 1 \pmod{20} \implies d = 7$.
   • Public Key: $(e=3, n=33)$
   • Private Key: $(d=7, n=33)$

Encryption and Decryption:

• For Plaintext $M = 2$:
  $$C = M^e \pmod n = 2^3 \pmod{33} = \mathbf{8}$$
• Decryption:
  $$M = C^d \pmod n = 8^7 \pmod{33} = \mathbf{2}$$

Secure Electronic Transaction (SET) & Core Participants

SET is an open communications protocol designed by Visa and Mastercard to secure credit card transactions over open networks using digital certificates and dual signatures.

Key Participants:

1. Cardholder: The consumer purchasing goods using a payment card enabled with digital certificates.
2. Merchant: The online vendor selling products and requesting payment authorization.
3. Issuer: The financial institution that provides the cardholder with payment credit.
4. Payment Gateway: Operates between merchant and bank payment networks, decrypting payment tokens.

Key Considerations for Database Security Policies

1. Authentication and Role-Based Access Control (RBAC): Grant permissions based strictly on job functions; restrict superuser access.
2. Data Encryption (At Rest & In Transit): Encrypt stored tables and files (TDE) and enforce TLS for client-database communication.
3. Audit Logging & Real-time Monitoring: Maintain tamper-evident audit trails of all administrative actions and sensitive table modifications.
4. Input Sanitization & Injection Defense: Enforce parameterized queries to prevent SQL injection vulnerabilities.

Intrusion Detection & Incident Handling Procedures

An Intrusion Detection System (IDS) monitors network traffic and system operations for signs of unauthorized access or malicious policy violations.

Incident Handling Once Intrusion is Detected:

1. Containment: Immediately isolate compromised hosts or segment network subnets to prevent lateral movement.
2. Eradication: Terminate unauthorized processes, remove backdoors, and close exploited vulnerabilities.
3. Recovery: Restore clean system binaries and databases from trusted backups; verify system health before reconnecting.
4. Post-Incident Review: Document lessons learned and update firewall rules, detection signatures, and security training.