LAKSHMI NARAIN COLLEGE OF TECHNOLOGY

AND SCIENCE, BHOPAL

INTERNSHIP REPORT

Submitted by
SURYANSH SONI [0157CS191185]

Under the supervision of

Department of Computer Science & Engineering

Session 2022-23

1
 CONTENTS

SN Title Pages

1. Certificate 3

2. Acknowledgment 4

3. Objective 5

4. Introduction 5

5. Networking Concepts 6-11

6. Cyber Security 12-26

7. Packet Tracer 26-28

8. Final Project 29

2
 LAKSHMI NARAIN COLLEGE OF TECHNOLOGY
AND SCIENCE, BHOPAL

DEPARTMENT OF COMPUTER SCIENCE & ENGINEERING

ACKNOWLEDGEMENT

We express our deep sense of gratitude to Cisco, AICTE, NASSCOM FutureSkill, and
department of Computer Science & Engineering L.N.C.T.S, Bhopal, whose valuable guidance
and timely help encouraged me to complete this project.

A special thank goes to Dr. Ashish Khare(Prof. & HOD) who helped us by
providing timely suggestions in completing this project work. She exchanged her interesting
ideas & thoughts which made this project work successfully.

We would also thank our institution and all the faculty members without whom this
project work would have been a distant reality.

SURYANSH SONI [0157CS191185]

4
Objective:

The objective of a program of Industrial Training:

● Applying acquired knowledge in problem-based exercises in real-life Industrial

projects

● Ensuring the relevant degree coursework and training programs conducted

according to the expectations of the industry, to ensure the subject contents are
relevant and up to date.

● Providing opportunities for students to acquire practical skills and experience

working on projects alongside industry experts.

● Providing an opportunity for students to acquire interpersonal skills and the

ability to teamwork through interaction with professionals in their field of study.

● Learning about ethics in the industry.

● Learning accepted safety practices in the industry.

● Providing an opportunity for students to learn about the industry of their

discipline and related environment.

● Providing an opportunity for the industry to identify potential employees and to

feedback comments on the degree program at large.

● Providing the opportunity to obtain knowledge of how to make optimal

decisions to resolve workplace challenges.

Introduction:

This internship was provided by cisco in collaboration with NASSCOM future skills and AICTE. This
provided industry knowledge about Cyber security and networking. The process of internship involved the
completion of three certifications.

1. Introduction to cybersecurity.
2. Cybersecurity Essentials.
3. Introduction to Packet Tracer.

On completion of these three certificates, a final project was assigned to make a topology of the college
network.
And use skills learned in the certifications to secure college networks with various devices such as firewalls
and intrusion detection systems. This internship provided essential technical awareness of various cyber
attacks and their prevention

5
 BASIC NETWORKING CONCEPTS

Introduction

An interconnection of multiple devices, also known as hosts, that are connected using multiple paths for the
purpose of sending/receiving data or media is called a computer network. Computer networks can also
include multiple devices which help in the communication between two different devices; these are known
as Network devices and include things such as routers, switches, hubs, and bridges.

Components of Computer Network:

The main components of a computer network include routers, hubs, bridges, wireless routers, switches,
Wireless Routers, Switches, Wireless bridges, Modems, Cables and Connectors, etc

Routers: Routers connect multiple networks together. They also connect computers on those
networks to the Internet. Routers enable all networked computers to share a single Internet connection,
which saves money. A router acts as a dispatcher. It analyzes data being sent across a network, chooses
the best route for data to travel, and sends it on its way.

Hub: Hub is a central device that splits the network connection into multiple devices. When a computer
requests information from a computer, it sends the request to the Hub. Hub distributes this request to all the
interconnected computers.

6
Switch: Switch is a networking device that groups all the devices over the network to transfer the data to
another device. A switch is better than Hub as it does not broadcast the message over the network, i.e., it
sends the message to the device to which it belongs. Therefore, we can say that switch sends the message
directly from the source to the destination.

Modem: The modem connects the computer to the internet over the existing telephone line. A modem is not
integrated with the computer motherboard. A modem is a separate part of the PC slot found on the
motherboard.

Bridge: A bridge is a network device that connects multiple LANs (local area networks) together to form a
larger bridge: LAN. The process of aggregating networks is called network bridging. A bridge connects the
different components so that they appear as parts of a single network. Bridges operate at the data link layer
of the OSI model and are hence also referred to as Layer 2 switches.

Repeater: A repeater operates at the physical layer. Its job is to regenerate the signal over the same network
before the signal becomes too weak or corrupted so as to extend the length to which the signal can be
transmitted over the same network. An important point to be noted about repeaters is that they do not
amplify the signal. When the signal becomes weak, they copy the signal bit by bit and regenerate it at the
original strength. It is a 2-port device.

TYPES OF NETWORK:

There are various types of computer networks available. We can categorize them according to their size as
well as their purpose. The size of a network should be expressed by the geographic area and number of
computers, which are a part of the network. It includes devices housed in a single room to millions of
devices spread across the world.

A computer network is mainly of four types:

• LAN(Local Area Network)

• PAN(Personal Area Network)

• MAN(Metropolitan Area Network)

• WAN(Wide Area Network)

1. LAN (Local Area Network):

Local Area Network is a group of computers connected to each other in a small area such as a building, or
office.

● LAN is used for connecting two or more personal computers through a communication medium
such as twisted pair, coaxial cable, etc

7
 ● It is less costly as it is built with inexpensive hardware such as hubs, network adapters, and ethernet
cables.

● The data is transferred at an extremely faster rate in the Local Area Network.

● Local Area Network provides higher security.

Disadvantages of LAN:

● LAN will indeed save cost because of shared computer resources, but the initial cost of installing
LAN is quite high.

● The LAN admin can check the personal data files of every LAN user, so it does not offer good
privacy.

● Unauthorized users can access the critical data of an organization in case the LAN admin is not able
to secure a centralized data repository.

● LAN requires constant LAN administration as there are issues related to software setup and hardware
failures.

8
2. PAN (Personal Area Network):

Personal Area Network is a network arranged within an individual person, typically within a range of 10
meters.

● Personal Area Network is used for connecting the computer devices of personal use.

● Thomas Zimmerman was the first research scientist to bring the idea of the Personal Area Network.

● Personal Area Network covers an area of 30 feet.

● Personal computer devices that are used to develop the personal area network are the laptop, mobile
phones, media players, and play stations.

Disadvantages of PAN:

● It may establish a bad connection to other networks at the same time radio bands.

● It has distance limits i,e. It covers only short distances.

9
3. MAN (Metropolitan Area Network):

A metropolitan area network is a network that covers a larger geographic area by interconnecting a different
LAN to form a larger network.

● Government agencies use MAN to connect to the citizens and private industries.

● In MAN, various LANs are connected to each other through a telephone exchange line.

● The most widely used protocols in MAN are RS-232, Frame Relay, ATM, ISDN, OC-3, ADSL, etc.

● It has a higher range than Local Area Network (LAN).

Disadvantages of MAN:

The drawbacks of using the MAN network:

● You need more cable to establish a MAN connection from one place to another.

● In the MAN network it is tough to make the system secure from hackers.

4. WAN (Wide Area Network):

● A Wide Area Network is a network that extends over a large geographical area such as states or
countries.

● A Wide Area Network is quite a bigger network than a LAN.

● A Wide Area Network is not limited to a single location, but it spans a large geographical area
through a telephone line, fiber optic cable, or satellite links.
10
 ● The internet is one of the biggest WANs in the world.

● A Wide Area Network is widely used in the field of Business, government, and education.

Disadvantages of WAN:

The drawbacks of using WAN:

● The initial setup cost of investment is very high.

● It is difficult to maintain the WAN network. You need skilled technicians and network
administrators.
● There are more errors and issues because of the wide coverage and the use of different technologies.

● It requires more time to resolve issues because of the involvement of multiple wired and wireless
technologies.

● It offers lower security compared to other types of networks.

Ip Addresses:

IP (Internet Protocol) Address is an address of your network hardware. It helps in connecting your computer
to other devices on your network and all over the world. An IP Address is made up of numbers or characters.
When connected to the internet, the IP address allows the computers to send and receive information. Most
IP addresses are purely numerical, but as internet usage grows, letters have been added to some addresses.
There are four different types of IP addresses: public, private, static, and dynamic. While the public and
private are indicative of the location of the network-private being used inside a network while the public is
used outside of a network-static and dynamic indicates permanency.

A static IP address is one that was manually created, as opposed to having been assigned. A static address
also does not change, whereas a dynamic IP address has been assigned by a Dynamic Host Configuration
Protocol (DHCP) server and is subject to change. Dynamic IP addresses are the most common type of
internet protocol address. Dynamic IP addresses are only active for a certain amount of time, after which
they expire. The computer will either automatically request a new lease, or the computer may receive a new
IP address. An IP address can be compared to a Social Security Number (SSN) since each one is completely
unique to the computer or user it is assigned to. The creation of these numbers allows routers to identify
where they are sending information on the internet. They also make sure that the correct devices are
receiving what is being sent. There are two IP versions: IPv4 and IPv6. IPv4 is the older version which has a
space of over 4 billion IP addresses. However, the new IPv6 version can provide up to trillions of IP
addresses to fulfill the needs of all internet users and devices.

11
Cyber Security
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the
protection of computer systems and networks from information disclosure, theft of, or damage to their
hardware, software, or electronic data, as well as from the disruption or misdirection of the services they
provide.

The field has become significant due to the expanded reliance on computer systems, the Internet, and
wireless network standards such as Bluetooth and Wi-Fi, and due to the growth of smart devices, including
smartphones, televisions, and the various devices that constitute the Internet of things (IoT). Cybersecurity is
also one of the significant challenges in the contemporary world, due to the complexity of information
systems, both in terms of political usage and technology. Its primary goal is to ensure the system's
dependability, integrity, and data privacy.

Vulnerabilities and attacks

A vulnerability is a weakness in design, implementation, operation, or internal control. Most of the
vulnerabilities that have been discovered are documented in the Common Vulnerabilities and Exposures
(CVE) database. An exploitable vulnerability is one for which at least one working attack or exploit exists.
Vulnerabilities can be researched, reverse-engineered, hunted, or exploited using automated tools or
customized scripts. To secure a computer system, it is important to understand the attacks that can be made
against it, and these threats can typically be classified into one of these categories below:

Backdoor
A backdoor in a computer system, a cryptosystem, or an algorithm, is any secret method of bypassing
normal authentication or security controls. They may exist for many reasons, including original design or
poor configuration. They may have been added by an authorized party to allow some legitimate access, or
by an attacker for malicious reasons; but regardless of the motives for their existence, they create a
vulnerability. Backdoors can be very hard to detect, and backdoors are usually discovered by someone who
has access to the application source code or intimate knowledge of the operating system of the computer.

Denial-of-service attack
Denial-of-service attacks (DoS) are designed to make a machine or network resource unavailable to its
intended users. Attackers can deny service to individual victims, such as by deliberately entering a wrong
password enough consecutive times to cause the victim's account to be locked, or they may overload the
capabilities of a machine or network and block all users at once. While a network attack from a single IP
address can be blocked by adding a new firewall rule, many forms of Distributed denial of service (DDoS)
attacks are possible, where the attack comes from a large number of points – and defending is much more
difficult. Such attacks can originate from the zombie computers of a botnet or from a range of other possible
techniques, including reflection and amplification attacks, where innocent systems are fooled into sending
traffic to the victim.

12
Direct-access attacks
An unauthorized user gaining physical access to a computer is most likely able to directly copy data from it.
They may also compromise security by making operating system modifications, installing software worms,
keyloggers, covert listening devices, or using wireless microphones. Even when the system is protected by
standard security measures, these may be bypassed by booting another operating system or tool from a
CD-ROM or other bootable media. Disk encryption and Trusted Platform Module are designed to prevent
these attacks.

Eavesdropping
Eavesdropping is the act of surreptitiously listening to a private computer "conversation" (communication),
typically between hosts on a network. For instance, programs such as Carnivore and NarusInSight have been
used by the Federal Bureau of Investigation (FBI) and NSA to eavesdrop on the systems of internet service
providers. Even machines that operate as a closed system (i.e., with no contact to the outside world) can be
eavesdropped upon by monitoring the faint electromagnetic transmissions generated by the hardware.
TEMPEST is a specification by the NSA referring to these attacks.

Multi-vector, polymorphic attacks

Surfacing in 2017, a new class of multi-vector, polymorphic cyber threats combined several types of attacks
and changed form to avoid cybersecurity controls as they spread.

Phishing
Phishing is the attempt of acquiring sensitive information such as usernames, passwords, and credit card
details directly from users by deceiving the users. Phishing is typically carried out by email spoofing or
instant messaging, and it often directs users to enter details at a fake website whose "look" and "feel" are
almost identical to the legitimate one. The fake website often asks for personal information, such as login
details and passwords. This information can then be used to gain access to the individual's real account on
the real website. Preying on a victim's trust, phishing can be classified as a form of social engineering.
Attackers are using creative ways to gain access to real accounts.

A common scam is for attackers to send fake electronic invoices to individuals showing that they recently
purchased music, apps, or others, and instructing them to click on a link if the purchases were not
authorized. A more strategic type of phishing is spear-phishing which leverages personal or
organization-specific details to make the attacker appear like a trusted source. Spear-phishing attacks target
specific individuals, rather than the broad net cast by phishing attempts.

Privilege escalation
Privilege escalation describes a situation where an attacker with some level of restricted access is able to,
without authorization, elevate their privileges or access level. For example, a standard computer user may be

13
able to exploit a vulnerability in the system to gain access to restricted data; or even become "root" and have
full unrestricted access to a system.

Reverse engineering
Reverse engineering is the process by which a man-made object is deconstructed to reveal its designs, code,
and architecture, or to extract knowledge from the object; similar to scientific research, the only difference is
that scientific research is about a natural phenomenon.

Side-channel attack
Any computational system affects its environment in some form. This effect it has on its environment
includes a wide range of criteria, which can range from electromagnetic radiation to residual effect on RAM
cells which as a consequence make a Cold boot attack possible, to hardware implementation faults that
allow for access and or guessing of other values that normally should be inaccessible. In Side-channel attack
scenarios, the attacker would gather such information about a system or network to guess its internal state
and as a result access the information which is assumed by the victim to be secure.

Social engineering
Social engineering, in the context of computer security, aims to convince a user to disclose secrets such as
passwords, card numbers, etc. or grant physical access by, for example, impersonating a senior executive,
bank, contractor, or customer. This generally involves exploiting people's trust and relying on their cognitive
biases. A common scam involves emails sent to accounting and finance department personnel,
impersonating their CEO and urgently requesting some action. In early 2016, the FBI reported that such
"business email compromise" (BEC) scams had cost US businesses more than $2 billion in about two years.

Spoofing
Spoofing is an act of masquerading as a valid entity through the falsification of data (such as an IP address
or username), in order to gain access to information or resources that one is otherwise unauthorized to
obtain.

There are several types of spoofing, including

Email spoofing is where an attacker forges the sending (From or source) address of an email.
IP address spoofing, where an attacker alters the source IP address in a network packet to hide their identity
or impersonate another computing system.

MAC spoofing, where an attacker modifies the Media Access Control (MAC) address of their network
interface controller to obscure their identity or to pose as another.

Biometric spoofing, where an attacker produces a fake biometric sample to pose as another user.
Tampering describes a malicious modification or alteration of data. So-called Evil Maid attacks and security
services planting surveillance capability into routers are examples.
14
Malware
Malicious software (malware) installed on a computer can leak any information, such as personal
information, business information, and passwords can give control of the system to the attacker, and can
corrupt or delete data permanently.

Information security culture

Employee behavior can have a big impact on information security in organizations. Cultural concepts can
help different segments of the organization work effectively or work against effectiveness toward
information security within an organization. Information security culture is the "...totality of patterns of
behavior in an organization that contributes to the protection of information of all kinds."

Andersson and Reimers (2014) found that employees often do not see themselves as part of their
organization's information security effort and often take actions that impede organizational changes.Indeed,
the Verizon Data Breach Investigations Report 2020, which examined 3,950 security breaches, discovered
30% of cybersecurity incidents involved internal actors within a company.

Research shows information security culture needs to be improved continuously. In ″Information Security
Culture from Analysis to Change″, authors commented, ″It's a never-ending process, a cycle of evaluation
and change or maintenance.″ To manage the information security culture, five steps should be taken:
pre-evaluation, strategic planning, operative planning, implementation, and post-evaluation.

● Pre-evaluation: To identify the awareness of information security within employees and to analyze
the current security policies.

● Strategic planning: To come up with a better awareness program, clear targets need to be set.
Assembling a team of skilled professionals is helpful to achieve it.

● Operative planning: A good security culture can be established based on internal communication,
management buy-in, security awareness, and a training program.

● Implementation: Four stages should be used to implement the information security culture. They are
1. The commitment of the management
2. Communication with organizational members
3. Courses for all organizational members
4. The commitment of the employees

● Post-evaluation: To assess the success of the planning and implementation, and to identify
unresolved areas of concern.

15
Systems at risk
The growth in the number of computer systems and the increasing reliance upon them by individuals,
businesses, industries, and governments means that there are an increasing number of systems at risk.

Financial systems
The computer systems of financial regulators and financial institutions like the U.S. Securities and Exchange
Commission, SWIFT, investment banks, and commercial banks are prominent hacking targets for
cybercriminals interested in manipulating markets and making illicit gains. Websites and apps that accept or
store credit card numbers, brokerage accounts, and bank account information are also prominent hacking
targets, because of the potential for immediate financial gain from transferring money, making purchases, or
selling the information on the black market. In-store payment systems and ATMs have also been tampered
with in order to gather customer account data and PINs.

Utilities and industrial equipment

Computers control functions at many utilities, including coordination of telecommunications, the power
grid, nuclear power plants, and valve opening and closing in water and gas networks. The Internet is a
potential attack vector for such machines if connected, but the Stuxnet worm demonstrated that even
equipment controlled by computers not connected to the Internet can be vulnerable. In 2014, the Computer
Emergency Readiness Team, a division of the Department of Homeland Security, investigated 79 hacking
incidents at energy companies.

Aviation
The aviation industry is very reliant on a series of complex systems which could be attacked.A simple power
outage at one airport can cause repercussions worldwide, much of the system relies on radio transmissions
which could be disrupted, and controlling aircraft over oceans is especially dangerous because radar
surveillance only extends 175 to 225 miles offshore. There is also potential for attack from within an
aircraft.

In Europe, with the (Pan-European Network Service) and NewPENS, and in the US with the NextGen
program, air navigation service providers are moving to create their own dedicated networks.

The consequences of a successful attack range from loss of confidentiality to loss of system integrity, air
traffic control outages, loss of aircraft, and even loss of life.

Consumer devices
Desktop computers and laptops are commonly targeted to gather passwords or financial account information
or to construct a botnet to attack another target. Smartphones, tablet computers, smartwatches, and other
mobile devices such as quantified self-devices like activity trackers have sensors such as cameras,
microphones, GPS receivers, compasses, and accelerometers which could be exploited, and may collect
16
personal information, including sensitive health information. WiFi, Bluetooth, and cell phone networks on
any of these devices could be used as attack vectors, and sensors might be remotely activated after a
successful breach.

The increasing number of home automation devices such as the Nest thermostat are also potential targets.

Large corporations
Large corporations are common targets. In many cases attacks are aimed at financial gain through identity
theft and involve data breaches. Examples include the loss of millions of clients' credit card details by Home
Depot, Staples, Target Corporation, and the most recent breach of Equifax.

Medical records have been targeted in general identifying theft, health insurance fraud, and impersonating
patients to obtain prescription drugs for recreational purposes or resale. Although cyber threats continue to
increase, 62% of all organizations did not increase security training for their business in 2015.

Not all attacks are financially motivated, however: security firm HBGary Federal suffered a serious series of
attacks in 2011 from hacktivist group Anonymous in retaliation for the firm's CEO claiming to have
infiltrated their group, and Sony Pictures was hacked in 2014 with the apparent dual motive of embarrassing
the company through data leaks and crippling the company by wiping workstations and servers.

Automobiles
See also: Autonomous car § Potential disadvantages, Automated driving system § Risks and liabilities, and
Automotive hacking
Vehicles are increasingly computerized, with engine timing, cruise control, anti-lock brakes, seat belt
tensioners, door locks, airbags, and advanced driver-assistance systems on many models. Additionally,
connected cars may use WiFi and Bluetooth to communicate with onboard consumer devices and the cell
phone network.[58] Self-driving cars are expected to be even more complex. All of these systems carry
some security risks, and such issues have gained wide attention.

Simple examples of risk include a malicious compact disc being used as an attack vector, and the car's
onboard microphones being used for eavesdropping. However, if access is gained to a car's internal
controller area network, the danger is much greater[58] – and in a widely publicized 2015 test, hackers
remotely carjacked a vehicle from 10 miles away and drove it into a ditch.

Manufacturers are reacting in numerous ways, with Tesla 2016 pushing out some security fixes "over the
air" into its cars' computer systems. In the area of autonomous vehicles, in September 2016 the United
States Department of Transportation announced some initial safety standards and called for states to come
up with uniform policies.

17
Government
Government and military computer systems are commonly attacked by activists] and foreign powers. Local
and regional government infrastructure such as traffic light controls, police and intelligence agency
communications, personnel records, student records, and financial systems are also potential targets as they
are now all largely computerized. Passports and government ID cards that control access to facilities that use
RFID can be vulnerable to cloning.

Internet of things and physical vulnerabilities

The Internet of things (IoT) is the network of physical objects such as devices, vehicles, and buildings that
are embedded with electronics, software, sensors, and network connectivity that enables them to collect and
exchange data.Concerns have been raised that this is being developed without appropriate consideration of
the security challenges involved.

While the IoT creates opportunities for more direct integration of the physical world into computer-based
systems, it also provides opportunities for misuse. In particular, as the Internet of Things spreads widely,
cyberattacks are likely to become an increasingly physical (rather than simply virtual) threat. If a front door's
lock is connected to the Internet and can be locked/unlocked from a phone, then a criminal could enter the
home at the press of a button from a stolen or hacked phone. People could stand to lose much more than
their credit card numbers in a world controlled by IoT-enabled devices. Thieves have also used electronic
means to circumvent non-Internet-connected hotel door locks.

An attack that targets physical infrastructure and/or human lives is sometimes referred to as a cyber-kinetic
attack. As IoT devices and appliances gain currency, cyber-kinetic attacks can become pervasive and
significantly damaging.

Medical systems
Medical devices have either been successfully attacked or had potentially deadly vulnerabilities
demonstrated, including both in-hospital diagnostic equipment and implanted devices including pacemakers
and insulin pumps. There are many reports of hospitals and hospital organizations getting hacked, including
ransomware attacks, Windows XP exploits, viruses, and data breaches of sensitive data stored on hospital
servers. On 28 December 2016 the US Food and Drug Administration released its recommendations for how
medical device manufacturers should maintain the security of Internet-connected devices – but no structure
for enforcement.

Energy sector
In distributed generation systems, the risk of a cyber attack is real, according to Daily Energy Insider. An
attack could cause a loss of power in a large area for a long period of time, and such an attack could have
just as severe consequences as a natural disaster. The District of Columbia is considering creating a
Distributed Energy Resources (DER) Authority within the city, with the goal being for customers to have
more insight into their own energy use and giving the local electric utility, Pepco, the chance to better
estimate energy demand. The D.C. proposal, however, would "allow third-party vendors to create numerous

18
points of energy distribution, which could potentially create more opportunities for cyber attackers to
threaten the electric grid."

Impact of security breaches

Serious financial damage has been caused by security breaches, but because there is no standard model for
estimating the cost of an incident, the only data available is that which is made public by the organizations
involved. "Several computer security consulting firms produce estimates of total worldwide losses
attributable to virus and worm attacks and to hostile digital acts in general. The 2003 loss estimates by these
firms range from $13 billion (worms and viruses only) to $226 billion (for all forms of covert attacks). The
reliability of these estimates is often challenged; the underlying methodology is basically anecdotal."

However, reasonable estimates of the financial cost of security breaches can actually help organizations
make rational investment decisions. According to the classic Gordon-Loeb Model analyzing the optimal
investment level in information security, one can conclude that the amount a firm spends to protect
information should generally be only a small fraction of the expected loss (i.e., the expected value of the loss
resulting from a cyber/information security breach).

Attacker motivation
As with physical security, the motivations for breaches of computer security vary among attackers. Some are
thrill-seekers or vandals, some are activists, and others are criminals looking for financial gain.
State-sponsored attackers are now common and well-resourced but started with amateurs such as Markus
Hess who hacked for the KGB, as recounted by Clifford Stoll in The Cuckoo's Egg.

Additionally, recent attacker motivations can be traced back to extremist organizations seeking to gain
political advantage or disrupt social agendas. The growth of the internet, mobile technologies, and
inexpensive computing devices have led to a rise in capabilities but also to the risk to environments that are
deemed as vital to operations.

All critical targeted environments are susceptible to compromise and this has led to a series of proactive
studies on how to migrate the risk by taking into consideration the motivations of these types of actors.
Several stark differences exist between the hacker motivation and that of nation-state actors seeking to attack
based on an ideological preference.

A standard part of threat modeling for any particular system is to identify what might motivate an attack on
that system, and who might be motivated to breach it. The level and detail of precautions will vary
depending on the system to be secured. A home personal computer, bank, and classified military network
face very different threats, even when the underlying technologies in use are similar.

19
Computer protection (countermeasures)
In computer security, a countermeasure is an action, device, procedure, or technique that reduces a threat, a
vulnerability, or an attack by eliminating or preventing it, minimizing the harm it can cause, or by
discovering and reporting it so that corrective action can be taken.
Some common countermeasures are listed in the following sections:

Security by design
Security by design, or alternately secure by design, means that the software has been designed from the
ground up to be secure. In this case, security is considered the main feature.

Some of the techniques in this approach include

The principle of least privilege where each part of the system has only the privileges that are needed for its
function. That way, even if an attacker gains access to that part, they only have limited access to the whole
system.

● Automated theorem proving to prove the correctness of crucial software subsystems.

● Code reviews and unit testing approaches to make modules more secure where formal correctness
proofs are not possible.
● Defense in depth, where the design is such that more than one subsystem needs to be violated to
compromise the integrity of the system and the information it holds.
● Default secure settings, and design to "fail secure" rather than "fail insecure" (see fail-safe for the
equivalent in safety engineering). Ideally, a secure system should require a deliberate, conscious,
knowledgeable, and free decision on the part of legitimate authorities in order to make it insecure.
● Audit trails track system activity so that when a security breach occurs, the mechanism and extent of
the breach can be determined. Storing audit trails remotely, where they can only be appended to, can
keep intruders from covering their tracks.
● Full disclosure of all vulnerabilities, to ensure that the window of vulnerability is kept as short as
possible when bugs are discovered.

Security architecture
The Open Security Architecture organization defines IT security architecture as "the design artifacts that
describe how the security controls (security countermeasures) are positioned, and how they relate to the
overall information technology architecture. These controls serve the purpose to maintain the system's
quality attributes: confidentiality, integrity, availability, accountability, and assurance services".

Techopedia defines security architecture as "a unified security design that addresses the necessities and
potential risks involved in a certain scenario or environment. It also specifies when and where to apply
security controls. The design process is generally reproducible." The key attributes of security architecture
are

● The relationship between different components and how they depend on each other.
20
 ● Determination of controls based on risk assessment, good practices, finances, and legal matters.
● The standardization of controls.

Practicing security architecture provides the right foundation to systematically address business, IT, and
security concerns in an organization.

Security measures
A state of computer "security" is the conceptual ideal, attained by the use of the three processes: threat
prevention, detection, and response. These processes are based on various policies and system components,
which include the following:

User account access controls and cryptography can protect systems files and data, respectively.
Firewalls are by far the most common prevention systems from a network security perspective as they can
(if properly configured) shield access to internal network services, and block certain kinds of attacks through
packet filtering. Firewalls can be both hardware and software-based.

Intrusion Detection System (IDS) products are designed to detect network attacks in-progress and assist in
post-attack forensics, while audit trails and logs serve a similar function for individual systems.
"Response" is necessarily defined by the assessed security requirements of an individual system and may
cover the range from simple upgrades of protections to notification of legal authorities, counter-attacks, and
the like. In some special cases, the complete destruction of the compromised system is favored, as it may
happen that not all the compromised resources are detected.

Today, computer security consists mainly of "preventive" measures, like firewalls or an exit procedure. A
firewall can be defined as a way of filtering network data between a host or a network and another network,
such as the Internet, and can be implemented as software running on the machine, hooking into the network
stack (or, in the case of most UNIX-based operating systems such as Linux, built into the operating system
kernel) to provide real-time filtering and blocking. Another implementation is a so-called "physical
firewall", which consists of a separate machine filtering network traffic. Firewalls are common amongst
machines that are permanently connected to the Internet.

Some organizations are turning to big data platforms, such as Apache Hadoop, to extend data accessibility
and machine learning to detect advanced persistent threats.

However, relatively few organizations maintain computer systems with effective detection systems, and
fewer still have organized response mechanisms in place. As a result, as Reuters points out: "Companies for
the first time report they are losing more through electronic theft of data than physical stealing of assets".

The primary obstacle to the effective eradication of cybercrime could be traced to excessive reliance on
firewalls and other automated "detection" systems. Yet it is basic evidence gathering by using packet capture
appliances that puts criminals behind bars.

In order to ensure adequate security, the confidentiality, integrity, and availability of a network, better known
as the CIA triad, must be protected and is considered the foundation of information security. To achieve

21
those objectives, administrative, physical, and technical security measures should be employed. The amount
of security afforded to an asset can only be determined when its value is known.

Vulnerability management
Vulnerability management is the cycle of identifying, remediating, or mitigating vulnerabilities, especially in
software and firmware. Vulnerability management is integral to computer security and network security.

Vulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search
of known vulnerabilities, such as open ports, insecure software configuration, and susceptibility to malware.
In order for these tools to be effective, they must be kept up to date with every new update the vendor
release. Typically, these updates will scan for new vulnerabilities that were introduced recently.

Beyond vulnerability scanning, many organizations contract outside security auditors to run regular
penetration tests against their systems to identify vulnerabilities. In some sectors, this is a contractual
requirement.

Reducing vulnerabilities
While formal verification of the correctness of computer systems is possible, it is not yet common.
Operating systems formally verified include seL4 and SYSGO's PikeOS– but these make up a very small
percentage of the market.

Two-factor authentication is a method for mitigating unauthorized access to a system or sensitive

information. It requires "something you know"; a password or PIN, and "something you have"; a card,
dongle, cellphone, or another piece of hardware. This increases security as an unauthorized person needs
both of these to gain access.

Social engineering and direct computer access (physical) attacks can only be prevented by non-computer
means, which can be difficult to enforce, relative to the sensitivity of the information. Training is often
involved to help mitigate this risk, but even in highly disciplined environments (e.g. military organizations),
social engineering attacks can still be difficult to foresee and prevent.

Inoculation, derived from inoculation theory, seeks to prevent social engineering and other fraudulent tricks
or traps by instilling resistance to persuasion attempts through exposure to similar or related attempts.

It is possible to reduce an attacker's chances by keeping systems up to date with security patches and
updates, using a security scanner[definition needed], and/or hiring people with expertise in security, though
none of these guarantee the prevention of an attack. The effects of data loss/damage can be reduced by
careful backing up and insurance.

Hardware protection mechanisms

While hardware may be a source of insecurity, such as with microchip vulnerabilities maliciously introduced
during the manufacturing process, hardware-based or assisted computer security also offers an alternative to

22
software-only computer security. Using devices and methods such as dongles, trusted platform modules,
intrusion-aware cases, drive locks, disabling USB ports, and mobile-enabled access may be considered more
secure due to the physical access (or sophisticated backdoor access) required in order to be compromised.
Each of these is covered in more detail below.

USB dongles are typically used in software licensing schemes to unlock software capabilities,[citation
needed] but they can also be seen as a way to prevent unauthorized access to a computer or other device's
software. The dongle, or key, essentially creates a secure encrypted tunnel between the software application
and the key. The principle is that an encryption scheme on the dongle, such as Advanced Encryption
Standard (AES) provides a stronger measure of security since it is harder to hack and replicate the dongle
than to simply copy the native software to another machine and use it. Another security application for
dongles is to use them for accessing web-based content such as cloud software or Virtual Private Networks
(VPNs). In addition, a USB dongle can be configured to lock or unlock a computer.
Trusted platform modules (TPMs) secure devices by integrating cryptographic capabilities onto access
devices, through the use of microprocessors, or so-called computers-on-a-chip. TPMs used in conjunction
with server-side software offer a way to detect and authenticate hardware devices, preventing unauthorized
network and data access.

Computer case intrusion detection refers to a device, typically a push-button switch, which detects when a
computer case is opened. The firmware or BIOS is programmed to show an alert to the operator when the
computer is booted up the next time.

Drive locks are essentially software tools to encrypt hard drives, making them inaccessible to thieves.Tools
exist specifically for encrypting external drives as well.

Disabling USB ports is a security option for preventing unauthorized and malicious access to an otherwise
secure computer. Infected USB dongles connected to a network from a computer inside the firewall are
considered by the magazine Network World as the most common hardware threat facing computer networks.
Disconnecting or disabling peripheral devices ( like camera, GPS, removable storage etc.), that are not in
use.[130]

Mobile-enabled access devices are growing in popularity due to the ubiquitous nature of cell phones.
Built-in capabilities such as Bluetooth, the newer Bluetooth low energy (LE), near-field communication
(NFC) on non-iOS devices, and biometric validation such as thumbprint readers, as well as QR code reader
software designed for mobile devices, offer new, secure ways for mobile phones to connect to access control
systems. These control systems provide computer security and can also be used for controlling access to
secure buildings.

IOMMUs allows for hardware-based sandboxing of components in mobile and desktop computers by
utilizing direct memory access protections.

Secure operating systems

One use of the term "computer security" refers to technology that is used to implement secure operating
systems. In the 1980s, the United States Department of Defense (DoD) used the "Orange Book"
standards, but the current international standard ISO/IEC 15408, "Common Criteria" defines a number of
progressively more stringent Evaluation Assurance Levels. Many common operating systems meet the

23
EAL4 standard of being "Methodically Designed, Tested, and Reviewed", but the formal verification required
for the highest levels means that they are uncommon. An example of an EAL6 ("Semiformally Verified
Design and Tested") system is INTEGRITY-178B, which is used in the Airbus A380 and several military
jets.

Secure coding
In software engineering, secure coding aims to guard against the accidental introduction of security
vulnerabilities. It is also possible to create software designed from the ground up to be secure. Such
systems are secure by design. Beyond this, formal verification aims to prove the correctness of the
algorithms underlying a system; important for cryptographic protocols for example.

Capabilities and access control lists

Within computer systems, two of the main security models capable of enforcing privilege separation are
access control lists (ACLs) and role-based access control (RBAC).

An access control list (ACL), with respect to a computer file system, is a list of permissions associated with
an object. An ACL specifies which users or system processes are granted access to objects, as well as what
operations are allowed on given objects.

Role-based access control is an approach to restricting system access to authorized users, used by the
majority of enterprises with more than 500 employees, and can implement mandatory access control (MAC)
or discretionary access control (DAC).

A further approach, capability-based security has been mostly restricted to research operating systems.
Capabilities can, however, also be implemented at the language level, leading to a style of programming that
is essentially a refinement of standard object-oriented design. An open-source project in the area is the E
language.

End-user security training

The end-user is widely recognized as the weakest link in the security chain and it is estimated that more than
90% of security incidents and breaches involve some kind of human error. Among the recorded forms of
errors and misjudgment are poor password management, sending emails containing sensitive data and
attachments to the wrong recipient, and the inability to recognize misleading URLs and to identify fake
websites and dangerous email attachments.

A common mistake that users make is saving their user id/password in their browsers to make it easier to log
in to banking sites. This is a gift to attackers who have obtained access to a machine by some means. The
risk may be mitigated by the use of two-factor authentication.

As the human component of cyber risk is particularly relevant in determining the global cyber risk an
organization is facing, security awareness training, at all levels, not only provides formal compliance with
regulatory and industry mandates but is considered essential in reducing cyber risk and protecting
individuals and companies from the great majority of cyber threats.
24
The focus on the end-user represents a profound cultural change for many security practitioners, who have
traditionally approached cybersecurity exclusively from a technical perspective, and moves along the lines
suggested by major security centers to develop a culture of cyber awareness within the organization,
recognizing that a security-aware user provides an important line of defense against cyber attacks.

Response to breaches
Responding to attempted security breaches is often very difficult for a variety of reasons, including

Identifying attackers is difficult, as they may operate through proxies, temporary anonymous dial-up
accounts, wireless connections, and other anonymizing procedures which make back-tracing difficult - and
are often located in another jurisdiction. If they successfully breach security, they have also often gained
enough administrative access to enable them to delete logs to cover their tracks.
The sheer number of attempted attacks, often by automated vulnerability scanners and computer worms, is
so large that organizations cannot spend time pursuing each.
Law enforcement officers often lack the skills, interest, or budget to pursue attackers. In addition, the
identification of attackers across a network may require logs from various points in the network and in many
countries, which may be difficult or time-consuming to obtain.
Where an attack succeeds and a breach occurs, many jurisdictions now have in place mandatory security
breach notification laws.

Incident response planning

Incident response is an organized approach to addressing and managing the aftermath of a computer security
incident or compromise with the goal of preventing a breach or thwarting a cyberattack. An incident that is
not identified and managed at the time of intrusion typically escalates to a more damaging event such as a
data breach or system failure. The intended outcome of a computer security incident response plan is to
contain the incident, limit damage and assist recovery to business as usual.

Responding to compromises quickly can mitigate exploited vulnerabilities, restore services and processes
and minimize losses. Incident response planning allows an organization to establish a series of best practices
to stop an intrusion before it causes damage. Typical incident response plans contain a set of written
instructions that outline the organization's response to a cyberattack. Without a documented plan in place, an
organization may not successfully detect an intrusion or compromise and stakeholders may not understand
their roles, processes, and procedures during an escalation, slowing the organization's response and
resolution.

There are four key components of a computer security incident response plan:

● Preparation: Preparing stakeholders on the procedures for handling computer security incidents or
compromises
● Detection and analysis: Identifying and investigating suspicious activity to confirm a security
incident, prioritizing the response based on impact, and coordinating notification of the incident

25
 ● Containment, eradication, and recovery: Isolating affected systems to prevent escalation and limit
impact, pinpointing the genesis of the incident, removing malware, affected systems, and bad actors
from the environment, and restoring systems and data when a threat no longer remains
● Post-incident activity: Post-mortem analysis of the incident, its root cause and the organization's
response with the intent of improving the incident response plan and future response efforts.

Packet Tracer
Packet Tracer is a cross-platform visual simulation tool designed by Cisco Systems that allows users to
create network topologies and imitate modern computer networks. The software allows users to simulate the
configuration of Cisco routers and switches using a simulated command line interface. Packet Tracer makes
use of a drag-and-drop user interface, allowing users to add and remove simulated network devices as they
see fit. The software is mainly focused on Cisco Networking Academy students as an educational tool for
helping them learn fundamental CCNA concepts. Previously students enrolled in a CCNA Academy
program could freely download and use the tool free of charge for educational use.

Packet Tracer can be run on Linux, Microsoft Windows, and macOS. Similar Android and iOS apps are also
available. Packet Tracer allows users to create simulated network topologies by dragging and dropping
routers, switches, and various other types of network devices. A physical connection between devices is
represented by a 'cable' item.

Packet Tracer supports an array of simulated Application Layer protocols, as well as basic routing with RIP,
OSPF, EIGRP, and BGP, to the extent required by the current CCNA curriculum. As of version 5.3, Packet
Tracer also supports the Border Gateway Protocol.

In addition to simulating certain aspects of computer networks, Packet Tracer can also be used for
collaboration. As of Packet Tracer 5.0, Packet Tracer supports a multi-user system that enables multiple
users to connect multiple topologies together over a computer network.

Packet Tracer also allows instructors to create activities that students have to complete. Packet Tracer is
often used in educational settings as a learning aid. Cisco Systems claims that Packet Tracer is useful for

26
network experimentation.

Role in Education
Packet Tracer allows students to design complex and large networks, which is often not feasible with
physical hardware, due to costs. Packet Tracer is commonly used by NetAcad students since it is available to
them for free. However, due to functional limitations, it is intended by Cisco to be used only as a learning
aid, not a replacement for Cisco routers and switches. The application itself only has a small number of
features found within the actual hardware running a current Cisco IOS version.

Packet Tracer is unsuitable for modelling production networks. It has a limited command set, meaning it is
not possible to practice all of the IOS commands that might be required. Packet Tracer can be useful for
understanding abstract networking concepts, such as the Enhanced Interior Gateway Routing Protocol by
animating these elements in a visual form. Packet Tracer is also useful in education by providing additional
components, including an authoring system, network protocol simulation,, and improving knowledge and
assessment system.

Network topology
Network topology is the arrangement of the elements (links, nodes, etc.) of a communication network.
Network topology can be used to define or describe the arrangement of various types of telecommunication
networks, including command and control radio networks, industrial field busses, and computer networks.

Network topology is the topological structure of a network and may be depicted physically or logically. It is
an application of graph theory wherein communicating devices are modeled as nodes and the connections
between the devices are modeled as links or lines between the nodes. Physical topology is the placement of
27
the various components of a network (e.g., device location and cable installation), while logical topology
illustrates how data flows within a network.

Distances between nodes, physical interconnections, transmission rates, or signal types may differ between
two different networks, yet their logical topologies may be identical. A network’s physical topology is a
particular concern of the physical layer of the OSI model.

Examples of network topologies are found in local area networks (LAN), a common computer network
installation. Any given node in the LAN has one or more physical links to other devices in the network;
graphically mapping these links results in a geometric shape that can be used to describe the physical
topology of the network. A wide variety of physical topologies have been used in LANs, including ring, bus,
mesh, and star.

Conversely, mapping the data flow between the components determines the logical topology of the network.
In comparison, Controller Area Networks, common in vehicles, are primarily distributed control system
networks of one or more controllers interconnected with sensors and actuators over, invariably, a physical
bus topology.

28
Final Project

29