Archive for month: July, 2020

Insecurities in API

Analysis

            Many IoT devices have very constrained resources and operate within hostile heterogenous environments. This scenario results in more critical and delicate security implement considerations.

Power Consumption

            Considering that many IoT devices are often battery operated or low powered, power consumption is very important when considering any security implementation. API security attacks could result in power drainage or not enough power to handle security implementations well. Bandyopadhyay and Bhattacharyya (2013) found that CoAP was more performant that MQTT in energy consumption and basic transfer over the UDP protocol. (Bandyopadhyay & Bhattacharyya, 2013).  [fig] shows a comparison of packets send using both MQTT and CoAP illustrating energy consumption is less using CoAP. It should also be noted that unlike CoAP that closes connection after each request/response, MQTT and AMQP both leave channels open listening for messages from a centralize broker (Dizdarević, Carpio, Jukan, Masip-Bruin, 2019). This results in more power usage. Dizdarević, et al. notes that because of the relatively high power, processing, and memory consumption, AMQP is best suited for resources with higher processing power.

Computational expense

            Securing APIs typically require some computation in the form of cryptography, hashing, and parsing. Of the security methods studied, it was found that CoAP over DTLS required more computation resources to implement. This is due to the CoAP using a specialized version of TLS which requires more computation in wrapping and unwrapping the UDP with the TLS security layers. This results in packet sizes being larger than the MQTT alternative which implicitly operates on UDP over TCP.

Memory requirements

            CoAP is considered a lightweight protocol, as such, headers, methods and status codes are all binary encoded. This compression reduces the overall size of package which, in turn, uses less memory (Dizdarević, et al., 2019). CoAP also uses the less memory intensive UDP protocol. However, as noted above, securing UDP requires a special implementation of TLS which increases the memory footprint of CoAP. 

Ease of use

            MQTT and AMQP both use a subscriber/publisher model with a central broker directing message. This means that devices subscribe are always open and listening to messages. Device messages need to be passed with username/password along with the message. This method is not a familiar as the tradition request/response model used by HTTP and, notably, by CoAP. This makes using GET, POST and other HTTP request methods easier to implement using CoAP. DDS is language and operating system independent. This allows for easier implementation among a wider range of developers. DDS also has supports automatic discovery allowing for devices to subscribe and publish messages without the need for a broker (Foster, 2015).

User Security

            MQTT is a subscriber/publisher protocol that employs a default plain text username/password security structure. This means that security is built in. This also means that it is easy to view the username and password for messages as they are passed across the network. For this, MQTT relies on TLS for securing transporting messages. This also means that security is more limited for MQTT. On the other hand, AMQP uses SASL mechanism that hands of security to manufacturers or companies. This results in far more flexibility in securing APIs. CoAP uses a request/reply method similar to the traditional HTTP model. This means that most HTTP method of security become applicable to CoAP, including OAuth, JWT, PSK, and RawPublicKey.

Quality of Service (QoS)

            Quality of services is important to ensure data delivery. MQTT protocol supports TCP and provides three different types of reliability mechanism for ensuring packets delivery in the form of Quality of Service (QoS) (Dinculeană & Cheng, 2019). CoAP only offers two levels of QoS. CoAP uses UDP as its transport layer which is known for speed but less reliability in packet delivery. TCP, on the other hand, guarantees message delivery but is generally slower. DDS allows for multiple levels of QoS which are fine-tuned by the user in prioritizing data exchanges (Foster, 2015).

System security

            MQTT relies on a broker for devices on the network to communicate. In a similar manner, CoAP relies on a centralized server through which requests and responses are communicated. This results in a single point of failure that could potentially compromise an IoT network. Although DDS uses a subscriber/publisher model, it does not rely on a broker. This decreases the probability for system failure because no single point of system of failure exists (Dizdarević, et al., 2019). By this measure, DDS decouples devices which allows for better overall network security.

Analysis of Protocols

Solutions	Criterion 1	Criterion 2	Criterion 3
Criterion Description
Solutions	Criterion 1 scores	Criterion 2 scores	Criterion 3 scores
Solution A
Solution B
Solution C

Table 1: an example of the UnWeighted Decision Matrix (Ramdhani, S., & Jamari, 2018).

Table 1 above shows an example of an unweighted decision matrix which can be used to identify some of the best API solutions. The typical unweighted decision matrix is used to evaluate three categories of solutions while using a three pronged criteria. Nevertheless, the matrix can be expanded to include more options and criteria, especially through the additional of supplementary columns and rows. In this regard, the matrix is considerably suitable for evolving solutions that have changing demands and options. For each criterion, a solution allocated a score ranging from 1-5, where 1 is the lowest and 5 the highest score. After each solution is scored, it is necessary to calculate the aggregate score to enhance the necessary evaluation. The aggregate scores for each alternative can be calculated using following

 as formulated in a 2018 article by Ramdhani and Jamari.

Where: is the aggregate score for each solution, n: the number of solution criterion,: refers to the total weight of the c^th criterion: and  is the specific score of x^th solution in the c^th criterion.  Typically, the aggregate score determines the most favorable solution.

Solutions	Criterion 1	Criterion 2	Criterion 3	Criterion 4	Criterion 5	Criterion 6	Criterion 7
Criterion (cn) Description	Power Consumption	Computational Expense	Memory expense	Ease of use	User Security	QoS	System security
Solutions (xn)	Criterion 1 Scores ()	Criterion 2 Scores ()	Criterion 3 Scores ()	Criterion 4 Scores ()	Criterion 5 Scores ()	Criterion 6 Scores ()	Criterion 7 Scores ()
MQTT	4	4	4	2	2	4	2
AMQP	2	2	2	3	3	2	2
CoAP	4	3	4	4	4	4	2
DDS	5	5	5	5	5	5	5
	15	14	15	14	14	15	11

Table 2: Unweighted decision matrix for API communication protocols

While using figures from the unweighted decision matrix illustrated in Table 2 above, the calculation of aggregate score    for different API communication protocols is shown below:

MQTT (x¹)

15*4) +14*4)+(15*4+(14*2)+(14*2)+(15*4)+(11*2)= 314

AMQP (x²)

15*2) +14*2)+(15*2)+(14*3)+(14*3+(15*2)+(11*2)= 224

CoAP (x³)

15*4) +14*3)+(15*4)+(14*4)+(14*4)+(15*4)+(11*2)= 356

DDS (x⁴)

15*5) +14*5)+(15*5)+(14*5)+(14*5)+(15*5)+(11*5)= 490

From the analysis alternatives, it is clear that DDS is the communication protocol for IoT designs. The alternative outdoes CoAP, which is the second best alternative with almost 150 points. AMQP and MQTT may be because the techniques possess significant scalability and security issues score the lowest aggregate points. In particular, AMQP has the lowest aggregate score of 224, which is less than half of that of DDS. Notably, CoAP and MQTT record almost the same aggregate scores. In this regard, while choosing between the two protocols, it is advisable to expand the criteria, hence acquire substantial insights about their performance.

Solutions

Untrusted Certificate Attacks

• Emergency Change of the certificate authorities That Issues Company’s Certifications

The certificates that a company has always used may be compromised or may not be trusted for any other reason. In this case, the company must be able to refer quickly to other certificate authorities to issue new and reliable certificates. Otherwise, the untrusted certificates and in fact, the company is considered untrusted. Users’ access to the website is reduced, and the company suffers enormous losses. Therefore, the company must be ready to shift digital keys and certificates immediately to other certificate authorities. However, few companies use an automation system to shift keys and certificates when needed. In light of NIST’s recommendation, “Preparing for Responding to Certification Authority Compromise and Fraudulent Certificate Issuances” is very important. So, companies need to know what certificates they use, where these certificates are purchased, and what other certificate authorities they switch to when needed.

When certificate authorities become untrusted, each company should remove that certificate authorities from its list of certificate exporters and replace other certificate authorities quickly. Devices of any company should be able to trust other certificate authorities and accept and install new certificates (Peters, 2015).

To avoid the untrusted certificate attacks all certificates should be validated and signed by a trusted Certificate Authority. This authority can be a reputable third-party Certificate authority or using public key infrastructure that exists within any related organization. “The latter would require the Certificate Authority root certificate to be installed on all connecting clients, which can be done through the modification of Windows Group Policy:

• Open the relevant Group Policy Object (GPO)
• In the console tree, click Trusted Root Certification Authorities: Policy Object Name/Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities
• On the Action menu, point to All Tasks, then click Import to add the root certificate”.

Expired Certificates Attacks

• New Certificates are Agile Certificates
  
  
  

In the technology world, certificates expiration has a good that it makes certificates modern. In the past, it was possible to obtain certificates for 5 years or more. Today there is a 3-year limit for issuing certificates, and the world of industry is looking to limit this time to even less than 3 years. Shorter credentials make it easier to update security standards. “Last year the entire internet migrated to the new SHA-2 signature algorithm. It was a bit bumpy because of those old 5+ year certificates out there”.  

Figure 4 SSL Validity Certificate Periods

From a policy perspective, long validity periods are not applicable. Since a new policy is issued, companies have to wait until their certification period ends, which can take up to 5 years. Once the validity periods are over, and certificates are upgraded and updated, it is possible to comply with the new policy. Uneven periods make it’s challenging to establish contingency between companies due to the lack of coordination in responding to the new policy. In many cases, users are forced to update their documents in the middle of the course.

“The CA/B Forum is an industry organization which sets best practices and standards for SSL certificate issuance. They are the ones ensuring that new certificates don’t continue to use old security measures. One of the goals the CA/B Forum has been working towards is shorter certificate validity. When SSL certificates expire more frequently, it makes it easier to improve security practices”.       
When updating company’s SSL certificates, it must be ensured that all information in certificates correctly entered. Customers should be assured that the company is the rightful owner of certificates and that the certificates’ security measures are always up to date (Lynch, 2016). To avoid expired certificates attacks, certificates should be provided and maintained periodically. Ensure that the certificate re-validation process begins at least thirty days before the expiration date.

Weak Hashing Algorithm Attacks

• Security of Cryptographic Hash Functions (CHFs)

Three features of CHFs should be considered to meet the basic requirements for establishing a secure network. If these three features are taken into account, CHFs can be secured and applicable in many areas: pre-image resistance, collision resistance, and second pre-image resistance. Furthermore, other features should be considered when applying CHFs for different applications. 

“pre-image resistance: CHFs are considered to be computationally non-invertible which means, if a hash code H(M) is generated for a message M, it is considered to be computationally infeasible for an adversary (A) to retrieve the original message (M) back” (Kishore & Kappor, 2016, p2).

Figure 5 pre-image resistance

“collision resistance: For a CHF to be weak collision resistant or second pre- image resistant, it should be computationally infeasible for an adversary (A) to find two different messages M and M” which can generate same hash values from that CHF. That is, to find M, M”; such that H(M) = H(M”) but M ≠ M” (Kishore & Kappor, 2016, p3).

Figure 6 Collision Resistance

“second pre-image resistance: For a CHF to be strong collision resistant, it should be computationally infeasible for an adversary (A) with given CHF H and message M to find another message M” where M≠M” and H(M) = H(M”)” (Kishore & Kappor, 2016, p3).

Figure 7 Second Pre-image Resistance

It is recommended to issue stronger hashing algorithms such as the SHA-2 family of hashing algorithms (SHA-224, SHA-256, SHA-384, and SHA-512). Weaker hashing algorithms, such as SHA-1 and MD5, should be replaced to make the attack less likely (Perspective Risk, 2019).

The NIST has published a family of cryptographic hash functions, the Secure Hash Algorithm, as a U.S. Federal Information Processing Standard (FIPS) that significantly guarantees the security of hash functions. This family of hash functions includes several algorithms that have been developed in recent years to ensure robust security requirements. Many of these functions have been combined with two components: a compression function and a domain extender.

 In recent years, attack algorithms have become more efficient and inclusive. The new algorithms apply a kind of Hashing construction that works in multidimensional and multilevel systems. This view is based on the creation of a dependent chain of fast and sophisticated algorithms to prevent attacks from breaking (Kishore & Kappor, 2016).

Analysis of Alternatives

Solutions	Criterion 1	Criterion 2	Criterion 3
Criterion Description	Technology maturity	Integration risk	Manufacturing feasibility
Emergency Change of the certificate authorities	3	2	4
Agile Certificates	4	5	5
Security of Cryptographic Hash Functions (CHFs)	5	5	5

Table 1Critical Technology Elements (CTEs)Rating

The solutions to the problem of weaknesses of TLS that leads to insecurity in APIs were scored according to the defined criteria. The results are shown in the table no.1.

Technology Maturity: A technology is considered mature that has been in use for a long time so that the inherent flaws and problems of the technology are well known. The shortcomings of this technology have been fixed or minimized in advanced versions. Changing of the certificate authority’s capability in this area seems fairly poor as the mechanism of changing of the certificate authorities is still in its infancy. Companies active in this field are expanding. A more extensive advertising system is needed to inform all relevant companies.

Agile Certificate is increasing. Most companies try to familiarize employees with the basics of training of Agile Certificate. So, it has done better than emergency change of certificate authorities in the area of technology maturity. Security of Cryptographic Hash Functions (CHFs) has made fundamental changes in all areas of network security. Along with the rapid development and resources utilization, it has also helped to provide a robust security.

Integration Risk: Integration risk demonstrates the ability to integrate information technology into departments and organizations. Poor integration between the two technologies leads to problems in data integration and consequently functional failures in the process and operating systems. Emergency Change of the certificate authorities has not yet reached a stage that has been thoroughly discussed among the various departments. It seems that this solution still needs more time to be implemented seamlessly and comprehensively among the companies involved. So, it gets a lower score on this criterion.

 “Agile certification increases adaptability in Agile technologies that will increase the team productivity and enhance the customer satisfaction. Agile certificate helps companies to learn practical techniques for planning, estimating the cost of the project in an Agile way” (Greycampus.com, 2019). So, this solution will help increase the exchange of information between different departments and increase security.

“One main use of hashing is to compare two files for equality. Without opening two document files to compare them word-for-word, the calculated hash values of these files will allow the owner to know immediately if they are different. Hashing is also used to verify the integrity of a file after it has been transferred from one place to another, typically in a file backup program like SyncBack. to ensure the transferred file is not corrupted, a user can compare the hash value of both files. If they are the same, then the transferred file is an identical copy” (Chung, 2019). For the purpose of security, this solution is considered to promote efficient integration.

Manufacturing Feasibility: This analysis determines three components: Is technology feasible? Is this feasibility in line with the projected costs? Is technology profitable? (Jain & Kuthe, 2013). A quick change to a new certificate authority usually brings costs. Cutting back on time before the deadline and switching to a new certificate authority during an emergency is often accompanied by unforeseen expenses. However, switching can be very cost-effective over time. So, this solution is relatively feasible.

Agile Certificates is a feasible solution because research shows that any short-term and long-term education investment is profitable for companies. Often the cost of training staff and managers, especially in the field of security, is far lower than the unforeseen expenses of lack of knowledge about security in APIs.  

Security of Cryptographic Hash Functions (CHFs) is feasible because it does not require high costs for creation and application. The process of deploying security networks employs personnel who specialize in decrypting relevant files and can detect attacks. Investing to hire a team of professionals and create optimal conditions for them over time reduces the costs of attacking the security.

Solutions	Criterion 1	Criterion 2	Criterion 3
Criterion Description	Technology maturity	Integration risk	Manufacturing feasibility
Emergency Change of the certificate authorities	3	2	4
Agile Certificates	4	5	5
Security of Cryptographic Hash Functions (CHFs)	5	5	5

Table 3: the score of three API solutions on the unweighted decision matrix

While using score aggregating formula for unweighted decision matrix, which is given by ; ,  ; in this regard, the most essential criterion of evaluating API solutions is manufacturing feasibility. Nevertheless, scores in other criteria are still relevant in the process of identifying the best solution.in this regard, it necessary to calculate the aggregate scores for each solution. For Emergency Change of the certificate authorities solution,, , in this regard the aggregate score for this option  is given by (12*3)+(12*2)+(14*4)= 116. For Agile Certificates,,

 (12*4)+(12*5)+(14*5)=178; and finally for Security of Cryptographic Hash Functions (CHFs) ,, , hence the aggregate solution can be established by (12*5)+(12*5)+(14*5)=190. Therefore, the unweighted decision making matrix indicates that, when compared to Agile certificates and Emergency Change of the certificate authorities, Security of Cryptographic Hash Functions provide the best API solution security.

References

Arxiv.org. (2019). A Review of Man-in-the-Middle Attacks. [online] Available at: https://arxiv.org/pdf/1504.02115.pdf [Accessed 20 Nov. 2019].

Beal, V. (2019). What is API security?. [online] Redhat.com. Available at: https://www.redhat.com/en/topics/security/api-security [Accessed 21 Oct. 2019].

Bischoff, P. (2019). UDP vs TCP: What are they and how do they differ? | Comparitech. [online] Comparitech. Available at: https://www.comparitech.com/blog/vpn-privacy/udp-vs-tcp-ip/ [Accessed 20 Oct. 2019].

Brown, K. (2013). SANS Institute: Reading Room – Authentication. [online] Sans.org. Available at: https://www.sans.org/reading-room/whitepapers/authentication/dangers-weak-hashes-34412 [Accessed 22 Nov. 2019].

Chung, C. (2019). What is Hashing? Benefits, types and more. [online] 2brightsparks.com. Available at: https://www.2brightsparks.com/resources/articles/introduction-to-hashing-and-its-uses.html [Accessed 1 Dec. 2019].

Comodosslstore.com. (2019). Hazards of an Expired SSL certificate. [online] Available at: https://comodosslstore.com/blog/hazards-of-an-expired-ssl-certificate.html [Accessed 22 Nov. 2019].

Duncan, R. (2013). Netcraft | SSL: Intercepted today, decrypted tomorrow. [online] News.netcraft.com. Available at: https://news.netcraft.com/archives/2013/06/25/ssl-intercepted-today-decrypted-tomorrow.html [Accessed 21 Oct. 2019].

Greycampus.com. (2019). Greycampus. [online] Available at: https://www.greycampus.com/opencampus/agile-certified-practitioner/benefits-for-pmi-acp-certified-professional [Accessed 1 Dec. 2019].

Jain, P., & Kuthe, A. M. (2013). Feasibility study of manufacturing using rapid prototyping: FDM approach. Procedia Engineering, 63, 4-11.

Kishore, N., & Kapoor, B. (2016). Attacks on and advances in secure hash algorithms. IAENG International Journal of Computer Science, 43(3), 326-335.

Lynch, V. (2016). Why Do SSL Certificates Expire?. [online] Hashed Out by The SSL Store™. Available at: https://www.thesslstore.com/blog/ssl-certificates-expire/ [Accessed 23 Nov. 2019].

Perspective Risk. (2019). Reducing Your Risks: SSL and TLS Certificate Weaknesses. [online] Available at: https://www.perspectiverisk.com/multiple-ssl-tls-certificate-weaknesses/ [Accessed 6 Nov. 2019].

Peters, S. (2015). What You Should, But Don’t, Do About Untrusted Certs, CAs. [online] Dark Reading. Available at: https://www.darkreading.com/cloud/what-you-should-but-dont-do-about-untrusted-certs-cas-/d/d-id/1322111 [Accessed 23 Nov. 2019].

Slivker, A. (2019). What you really need to know about securing APIs with mutual certificates. [online] Nevatech.com. Available at: https://www.nevatech.com/blog/post/What-you-need-to-know-about-securing-APIs-with-mutual-certificates [Accessed 21 Oct. 2019].

Techopedia.com. (2019). What is Transport Layer Security (TLS)? – Definition from Techopedia. [online] Available at: https://www.techopedia.com/definition/4143/transport-layer-security-tls [Accessed 21 Oct. 2019].

Ramdhani, S., & Jamari, J. (2018). The Modeling Of A Conceptual Engineering Design System Using The Decision-Matrix Logic. In MATEC Web of Conferences (Vol. 159, p. 02022). EDP Sciences. References

INFORMATION SECURITY MANAGEMENT

IS Management and Utilization Approaches

Information Preservation

            Many categories of digital material chosen for long-term preservation may include sensitive and confidential information, which must be protected to avoid non-authorized user access. In a huge number of cases, information protection may be regulatory or legal obligations on the organization. Moreover, digital materials must be managed with regard to the organization’s IS policy to prevent security breaches. International Standards Organization (ISO) 27001, especially ISO, 2013a, outlines the way security procedures can be organized and monitored. Furthermore, ISO 27002, in ISO, 2013b, offers guidelines on the deployment of ISO 27001-compliant procedures. Organizations complying with such standards can be accredited and validated by the relevant external organization. In some instances, the organization’s IS security policy may affect digital material preservation activities as well, hence may require engaging the support of Information Communication and Technology (ICT) and information governance teams to enhance preservation processes, while using the appropriate methods.

            Some information security techniques, such as encryption, immensely increase the complexity of the preservation process and should, therefore, be avoided whenever possible for archival copies. In this regard, alternative security methods, such as robust user authentication demands for remote access, lock-down terminals access restriction in secure rooms or controlled locations, may require to be more rigorously deployed for sensitive unencrypted files. Nevertheless, alternative methods may not always be feasible or sufficient and files received on ingest, especially from a depositor, may include encryption, hence it is essential to possess adequate knowledge regarding IS options, including encryption, key management, and their impacts on digital preservation.

Encryption

            Encryption is a cryptographic method that protects digital material by changing it into a scrambled state. The technique may be deployed at numerous levels, ranging from a one file to the entire disk. There exist many encryption algorithms, each of which utilizes a unique technique of information scrambling. To unscramble and convert data back to its initial form, a key may be required. The size of the key immensely determines the strength of an encryption technique. For instance, a 256- bit encryption is more secure compared to a 128-bit encryption. In this regard, large key sizes are recommended for the encryption of supersensitive, hence high risk files, to significantly reduce chances of being compromised. Nevertheless, the technique is only effective when the encryption key is unknown to third parties, who may instigate immense information security breaches. For instance, when a user has logged into a an encrypted drive and left the computer powered on and unattended will offer third parties with a tremendous opportunity to access information held in the encrypted region, hence probably leading to its release.

            In a repository, encryption security techniques can considerably lose effectiveness with time, because of the existing intensive competition between their development and that of computational mechanisms to break them. In this regard, when deployed, all encryption by a repository require active management and timely update to uphold data security. Moreover, to enhance timely access of encrypted digital material in a repository, the organization must manage the encryption keys. Destruction or loss of the keys makes the encrypted data inaccessible to the organization. Therefore, while using the encryption technique of information, an organization must ensure appropriate key management, especially by conducting periodic updates, as well as user training, to reduce chances of unauthorized encrypted information access by third parties.

Access Control

            Access controls enable an administrator to stipulate authorized digital material access and the category of permitted access, which may include read only, write. The National Digital Stewardship Alliance (NDSA) recommends four levels at which access control can be used to support the preservation of digital materials. The organization primarily emphasizes understanding of authorized users, access rights and access restriction enforcement, while using the procedure highlighted below.

NDSA Level	Activity
	Establish users with read, write, move and delete access rights to individual rights Restrict user access authorization to specific files
	Document content access restrictions
	Maintain logs of user activity on files, including preservation and deletion actions
	Conduct audit logs

Redaction

            Redaction involves digital resource analysis to identify sensitive or confidential information, and replacing or removing it to minimize chances of unauthorized access. Some of the most common redaction techniques include the pseudonymisation and anonymization, which are utilized to extract personally identifiable information, as well as clean authorship details. With regard to datasets, redaction is usually performed by removing information, but retaining the record structure in the release version. Notably, redaction should be conducted on a copy the original rather than the original itself.

            Storage of a huge number of the digital materials developed using the office systems, including Microsoft Office, is performed in proprietary, binary-encoded formats, possessing significant information which is never displayed; hence its presence may not be apparent. Moreover, such materials may include audit trails, change histories or embedded metadata that can be utilized to recover deleted information, hence circumvent simple redaction processes. A combination of format conversion and information deletion can be used to perform redaction on digital material. Specific formats, including the ASCII text files, only possess displayable information. In this regard, conversion to such a format eliminates any information which may be hidden in non-displayable segments of the bit stream. 

Incident Response Exercise & Report

SIFERS-GRAYSON CYBERSECURITY INCIDENT REPORT FORM

1. Contact Information for the Incident Reporter and Handler

Name:

Role: Information Security Analyst

Organizational unit: The Blue Team

Email address: name_secanst.ict@sifersgrayson.us  

Phone number: +1 606 645 234 123

Location: 1555 Pine Knob Trail, Pine Knob, KY 42721

• Incident Details

Status change: The Incident started from April 18, 2019 at 0.800hrs GMT-4 and ended on April 19, 20^th at 0.1000 hrs.

Physical location of the incident: Grayson City, Kentucky, USA

Current status of the incident: Complete  

Source/cause of the incident:The source of the incident was a malware attack on the drone AX10 (IP address 10. 10.10.128.82) during a trial session at the company’s test range. Installed on a PROM, the malware transferred control of the drone to the Red Team.

Description of the incident

            The incident was detected when the under trial drone AX10 was flown past the test range. During a test session of drone AX10, the engineers lost control of the vehicle to hackers in an unknown location through the home network. The hackers flew the drone to the company headquarters which is past the company’s test range. A firewall log analysis revealed a malware attack.

Description of affected resources

            The malware attack included the drone and R&D workstations, hence the Test range network (Test Range 10.10.128.0/24) and the (R&D Center 10.10.120.0/24).

 Incident category

            The Incidence was a malware attack facilitated by the employees (information system users).

Mitigating factors

            The primary mitigating factors was system restore that were set on R&D workstations and servers to enhance data and application recoverability. The use of windows operating systems, which have robust restore features enable data and applications recovery from the servers and workstations. Moreover, the use of a firewall between the R&D department and other company departments immensely assisted in the incidence detections (Nabil, Soukainat, Lakbabi & Ghizlane 2017). Analysis of firewall logs indicated the possibility of a malware attack. 

            Response actions performed

            Response to the security attacks was conducted in a series of actions that were conducted immediately after the incident was detected. The first step adopted was to unplug any PROM chips connected to workstations at the R&D department or on the drone. The PROM chips and the workstations at the R&D department were scanned using antivirus software. A system restore was conducted on the R&D workstations. The operating systems were then restored to a point before the attack was initiated to recover data and applications, hence recover system functionality.  

Other organizations contacted  

The company contacted Microsoft Inc., the manufacturer of windows operating system, to identify the system restore procedure. Moreover, the organization contacted Kaspersky, the manufacturer of the antivirus software installed on the company computers to establish more details on the nature of attack and the level of expected damages.   

• Cause of the Incident

            The primary source of security incident is network vulnerabilities, especially from the WIFI network users. Company employees at the company headquarters are misusing information system access privileges, by storing confidential data on USB keys and sharing sensitive information with strangers. Moreover, the use of ineffective antivirus software enhanced the movement of the malware from one department to another without detection.    

• Cost of the Incident:

            When compared to the previous information security incidences, the cost of the recent incident was considerably lower because it did not include a massive loss of data and business functionality. The organization was able to retrieve immense proportions of data and applications from the system restore points set before the attack. However, technical activities conducted in response to the attack were significantly costly to the organization. Specifically the disaster recovery efforts required 180 person hours, hence a budget of about $18, 000, without considering the aborted drone tests.

• Business Impact of the Incident

            The attack included an immense impact on business functionality. The R&D department was technically down for more than twelve hours after the incidence was detected, hence paralyzing any planned drone tests. Moreover, the company is expected to suffer a significant reduction in drone sales, because of reduced customer confidence.  One of the considerable issues regarding the UAS (Unmanned Aircraft Systems) is loss of control and safety of the vehicle. Thus, news about the current attacks will probably turn-away a high number of customers, hence significantly reduce revenue.  

• General Comments

            Sifers-Grayson needs a robust information security strategy to significantly reduce chances of such attacks in the future. Apart from having immense information security vulnerabilities, the company still possesses a poor incident detection mechanism. For instance, to conduct the attack, Red Team had to use an increasingly long attack vector, including almost every department in the organization. Moreover, it took an increasingly long duration of time to detect the attack (Rudd, Rozsa, Günther & Boult, 2017). Thus, the organization must implement an organization wide information strategy, including robust incident detection capabilities.

            One of the information security issues that the company must address involves handling of confidential information by employees and other stakeholders in the company. Confidential information found on the USB key collected on a lunch table facilitated the Red Team to access to the company network, hence eventually mount an attack. Moreover, employees usually share essential information with strangers (Ross, Viscuso, Guissanie, Dempsey & Riddle, 2016). In this regard, the organization is highly vulnerable to attacks conducted through the system user accounts (Lévesque, Chiasson, Somayaji & Fernandez, 2018). Therefore, to reduce the risk of future attacks, the company must create an effective system access plan, including essential employee training and a framework of access privileges. 

            Moreover, incident detection and response is extremely poor at Sifers-Grayson. The company cannot swiftly detect and respond to information security incidences. An effective SIEM tool, such as the LogRhythm’s SIEM package, can significantly assist the company in detecting information security incidences, because of its central approach to security information management (DFARS, 2019). Therefore, the contractor must identify an efficient SIEM tool to enhance tracking of incidences.

References

DFARS. (2019). 252.239-7000 Protection Against Compromising Emanations. Retrieved from https://www.acq.osd.mil/dpap/dars/dfars/html/current/252239.htm#252.239-7009

Lévesque, F. L., Chiasson, S., Somayaji, A., & Fernandez, J. M. (2018). Technological and Human Factors of Malware Attacks: A Computer Security Clinical Trial Approach. ACM Transactions on Privacy and Security (TOPS), 21(4), 18.

Nabil, M., Soukainat, S., Lakbabi, A., & Ghizlane, O. (2017, May). SIEM selection criteria for an efficient contextual security. In 2017 International Symposium on Networks, Computers and Communications (ISNCC) (pp. 1-6). IEEE.

Ross, R., Viscuso, P., Guissanie, G., Dempsey, K., & Riddle, M. (2016). Protecting controlled unclassified information in nonfederal information systems and organizations (No. NIST Special Publication (SP) 800-171 Rev. 1 (Withdrawn)). National Institute of Standards and Technology.

Rudd, E. M., Rozsa, A., Günther, M., & Boult, T. E. (2017). A survey of stealth malware attacks, mitigation measures, and steps toward autonomous open world solutions. IEEE Communications Surveys & Tutorials, 19(2), 1145-1172.

Human Origin and Evolution

The origin and evolution of human beings as a distinct species is a branch of biological anthropology with immense interest among researchers and students of anthropology today than any other time in history. Human evolution as part of biological anthropology aims to bring to light the development of the human race as a distinct species through the evaluation of fossils. Similarly, the study of human evolution aims at acquiring a clear understanding of similar traits with our closest primate relations on top of defining the social relationships with non-primate species. Lastly, the study of human evolution is important so as to understand how the process of evolution has contributed to the variations in the human species.  As a result, the only way to understand the biological structure and functionality of the present human beings is to study and closely evaluate the process of human evolution through the analysis and comparison of fossils in relation to the modern populations.

The origin of life is a highly debated topic in the field of science and related studies like anthropology and archaeology to name but two. It is estimated that the earth and other heavenly bodies were formed about 4600 million years ago. The earth was formed as a result of the reaction of different gases and other chemical elements and compounds present in space then. It is theorised that the chemical processes responsible for the formation of earth also produced simple celled organisms which form the foundation of the studies of the human revolution. As a result, it is believed life on earth began around 4600 million years ago from simple cell organisms to the present complex life forms.

Scholars from different fields of science with interest in defining the human origin and evolution the likes of Louis Pasteur a French microbiologist, A. J Oparin a Russian biochemist and the father of evolution Charles Darwin all agree on one principle; life originates only from pre-existing forms. These scholars argue that the conditions on earth 4600 million years were very different from the present day atmosphere. The Primordial earth a term used to refer to earth as it was 4600 million years ago was probably in gaseous state and through diverse chemical processes compounds condensed to form a solid matter called earth and simple one cell organisms similar to today’s cyanobacteria.  The cyanobacteria are photosynthetic organisms which release oxygen as a by-product and it is believed the bacteria are responsible for altering the earth’s atmosphere. The oxidizing effect provided the perfect conditions for the simple one cell organisms to develop so as to appropriately adapt to the existing environment. Correspondingly, this forms the basis of the biological definition of evolution which states that evolution is the gradual unfolding of new and complex forms of life from previous less complex forms over a long period of time.

For quite a substantive period there have been contradictory theories of evolution from a group of scientists that aim to explain the process of evolution through mathematical reconstructions. The most profound scholars of this view include Sewall Wright of the United States and Ronald Fisher and B.S Haldane of Great Britain to name but two. While their studies produced resourceful insights their results were unknown and complex for evolutionary biologists in the world of science. However, the recent past has witnessed the merger of these two groups through the use of genetics to explain the drastic change of life forms throughout the history of mankind. Contrarily, as biological anthropologists we will restrict ourselves to understanding the origin of life, the biological functionalities and behavioural patterns of present organisms in relation to past life forms from an evolutionary perspective.

The best approach to understand the human evolution is by first familiarising oneself with the basic principles of biological anthropology. Biological anthropology defines evolution as the gradual biological transformations of ancestral populations through morphological and genetic changes to become much modern populations. There have been many cases of evolution documented in nature and a good number of the cases show the differential success in reproduction in a population results to transformations of morphology and genetics in subsequent generations. Similarly, humans are said to share almost 99% of their DNA with apes and monkeys which is an indication of a common ancestry between the two species. Likewise, humans, apes and monkeys share a significant percentage of their DNA with bananas as well. This cements the fact that life is made up of the same amino acids and as such it developed from a simple one cell to the more complex and diverse present populations. Therefore, human beings just like all other creatures developed from simple cell organisms and adopt different forms due to their ability to respond differently to the ever changing environment.

There are two notable figures in the world of evolution namely Gregory Mendel and Charles Darwin. These two have immensely contributed to understanding the concept of human evolution the latter through his theory of Natural Selection and the former through his studies on genetic heredity. Mendel ran a series of experiments breeding peas with different traits over generations to lay the foundation for the modern day study of genetics. Mendel through his study realised that there were elements in cells that remained in cells even after subsequent breeding and referred to them as dominant characteristics. The opposite is what is referred to as recessive characteristics. Consequently, later it was discovered that all cells including in human populations behave in a similar manner as peas with both the dominant and recessive characteristics. As a result, the conclusions of Mendel have been adopted to solidify Darwin’s arguments of evolution to come what is referred to as the Darwin’s genetic theory of natural selection.

Mendel discovered four important principles of genetic heredity which act as reference in the study of the human evolution. First, he stated that the units of inheritance are discreet elements and remain so generation after generation without alterations even it may seem so at a glance. In his experiments he observed that the inside colour of peas was either green or yellow and no matter how many generations he crossbred they remained the same. Mendel referred to these units of inheritance as genes. Organisms inherit a single discrete unit or gene from each parent. Genes are located in a pair of chromosome with each chromosome pairing with an appropriate chromosome from each parent. In peas each chromosome carrying the colour gene pairs with an appropriate colour gene to produce either a yellow or green colour depending on the dominance and recessiveness of individual genes.

Mendel also discovered that different traits are inherited independently as long as genes are on different stems. Mendel concluded this after observing the different organs of the pea plant from the flowers to the stems. Mendel observed that whether a plant had long or a short stem had no effects on colour of the seed solely because the colour genes were located on different chromosomes. Mendel’s fourth principle states that even though each organism inherits a single gene from each parent some of the genes may recessive and thus fail to express. In the presence of dominant traits and recessive traits the dominant traits express though its recessive traits may express in subsequent generations. As such, a green coloured seed has green as the dominant trait and yellow as the recessive trait.

The principles of genetics have been widely used to explain the concept of evolution in the context of human beings. Researchers have discovered several dominant and recessive traits in human beings among them the ability or inability to roll the tongue and the ability or inability to taste a chemical known as PTC. Importantly, Mendel acknowledged that the environment can affect the inherited traits mainly through exposure to different strengths of sunlight, occurrence of diseases in early age or inadequate nutrition over several generations. Mendel’s principles of genetics formed the basis for scientific study of genetics at the micro and the molecular level to explain how human populations evolve over time. Science explains the evolution of a simple single cell to a larger multiple celled unit through a linear genetic model: atom to molecule (amino acid to protein or nucleic acid to DNA) to gene to chromosome to cell to individual body to population. It is through a complex process of protein synthesis that organisms assume different forms but the origin of all species is from simple single cell organisms.

Darwin’s theory of Natural Selection argues that individuals may give birth to off springs increasing their number but resources remained relatively stable. Darwin also observed that biological variation occurs among all species and variation is an inherited characteristic. Consequently, Darwin concluded that in the event that there was limited resources to sustain the present populations’ individuals with favourable variations for survival are likely to live longer passing on the favourable survival characteristics to its off springs.  The end result will be that there will be a population of individuals with favourable survival traits and with continued competition individuals that cannot keep up with the competition will be naturally selected out of populations in the3 long run making such groups extinct. Darwin clearly explains this through the example of the long neck of the giraffe. Darwin argues that a long time ago there were both short-necked and long-necked giraffes. However, due to the competition for food resources only the long-necked giraffes had the favourable survival trait and hence able to pass its long-necked trait to its off springs. Short giraffes due to inadequate food resources produced less off springs progressively getting less and less to the point of extinction.  Thus, Darwin’s theory of Natural Selection provides profound knowledge on the study of the human evolution and explains the different variations in the modern human populations.

Mutation is another important factor responsible for the process of evolution and as such requires extensive analysis and review. Mutation refers to the change of the genetic make-up of an organism and it only through the change of the genetic material of organism that they can transform to different forms. Mutation in an organism takes place when the genetic material is undergoing replication. The majority of mutations that become part of the evolutionary process take place at the base level of the DNA with chain effects in the behavioural patterns and biological structure of an organism.  Mutations are caused by both human related factors chemical elements in food substances or human induced radiation activities or from natural causes like global warming, cosmic radiation or the instability of the DNA.  Equally, mutation is among the fundamental factors that influence evolution not only in human populations but also in all other organisms since it is evident that all organisms evolved from simple single cell organisms.

Mutations and natural selection are responsible for the vast majority of macro evolutionary events, mutations introducing the new genetic material and natural selection producing the variability that evolution works on; but in the shorter run genetic drift or gene flow may be the major cause of change in some lineages.

How did the major U.S. wireless service providers become an oligopoly?

Introduction

An oligopoly is a large firm that sells rare products and services in the market. Oligopolistic corporations face competition from a few corporations that sell similar products or services.

Answer and Explanation

 Initially, the FCC licensed A and B carriers, which were set up by an auction process. After a while, a high number of independent carriers of type A which were not linked to local telephone companies of type B were consolidated.

The wireless firms were started as oligopolies because the fixed cost of the mobile phone network was very high at the time. In the mid-1980s, the cost of cells phone was about 100 USD, which is about 300 USD today. AT&T was divided into RBOCs (regional phone companies) with wireless allocations that had a near-zero value. With time, mergers consolidated several components of the old Bell systems.

A drop in prices and an increase of cell phone popularity enhanced the reduction of rates, which yielded a virtuous cycle, by allowing the spread of capital costs among a high number of users. New technologies and new cellular bands were later licensed to serve more customers and provide more completion.  Currently, only four major carriers serve millions of customers in the United States.