SystemAnalysis

1、assignment coversheet surname: zhou first names: yinxinstudent number: 0050105013name: yinxin zhoupostal address: zhejiang university of science and technologycity/suburb:hangzhou post code: 310023state: zhejiang province country: chinafaculty of businessuniversity of southern queenslandcourse numbe

2、r: cis 2005course name: corporate computer and network securityfaculty: information and electronic engineering date uploaded: 12/12/09assignment due date: 12/12/09have you sent this assignment any other way (e.g. mail, email, fax): nodeclaration: by submitting this assignment i declare that:no part

3、of this assignment has been copied from any other persons work except where due acknowledgement is made in the text, and· no part of this assignment has been written for me by any other person except where such collaboration has been authorised by the examiner concerned.· i hold a copy of

4、this assignment which i can produce if the original is lost or damaged.name: _yinxin zhou_ date:_12/12/09_ n.b· an examiner has and may exercise the right not to mark this assignment without the above declaration.· if the above declaration is found to be false, action will be taken in acco

5、rdance with usq regulations.i request an assignment extension (please provide details over page)(office use only)application acceptedi have already applied for an assignment extensionapplication not acceptedexecutive summarythe task tells us bob received a call from his banks risk management and com

6、pliance division manager. he was informed that the bank believed that gamblebets security has been compromised. the banks credit card fraud system was raising alarm bells and through further investigation by the bank, a patterm was emerging that compromised credit card numbers seemed to be originati

7、ng from the credit card numbers of gamblebets customers.this reports purpose is to review security of gamblebet it system and applications, also determine whether it is the source of the fraud. it shows the investigation in terms of three aspects: hardware security, software security and management

8、security, which involves many people and protection layers. through the three aspects, it outlines a process of how to review and test the security of the fictional organization in detail. it tells people methods to find security vulnerabilities with variety of vulnerability testing and investigatio

9、n. finally, it supply some sort of security controls that should be in place in order to reduce the frauddate25 oct 2009 - 28 oct 2009titleinvestigation and test on hardware layerinvestigate scopethe scope includes and consists of any device that relate to incident. both people work in gamblebet and

10、 netbest would be involved and interviewed.the scope of this work plan include:l firewall, client server, workstation, router, and some hardware device that maybe damaged and stolen.l lan communication routethe job in this section aims at making a test on different hardware device and determine whet

11、her there have problemskey factor/prerequisitesthe firm has firewall hardware and some related hardware. it is available and has enough right to review it. to ensure that the default gateway for the internal network is firewall system.firewall investigation and testinghow to test the security of fir

12、ewall?the role of firewall in the network is important. it not only can protect the network security, but also plays a major role in the network section. people generally use a firewall to effectively prevent hackers on the internet into the internal network, and prevent the internal network system

13、which is infected uploading important data to the internet. however, the environment of network and the business needs is changing everyday. firewall may not work as predicted. therefore, it is necessary to make a test on firewall to see whether it can work well. initially, making an assessment of t

14、he following indicators: throughput, latency, packet loss rate and back-to-back frame, check all those information whether are normal. secondly, place the scanners and sniffer in the topology of the internal and external, in purpose of analysis of two-way communication problems. then, implement the

15、following steps: stop packet filtering; into the various types of packet in order to perform the rules of router, and go through the firewall; through the firewall log and the results of your scanner to determine the accuracy of routing packets; open packet filtering; connect to internet communicati

16、on, get record samples of communication between all the protocol, port, source address and destination address ensure that the specific packet should be denied or blocked. for example, if all the udp packet are set to be blocked, make sure that there is no one udp scan the ports that are allowed or

17、denied by firewall, to see the system is set up like expected;the result can be worked out by firewalls log and scanner. solution descriptionif there are some problems in the firewall, it is better to change the configuration of the firewall or replace it with a more functional firewall.router inves

18、tigation and testingwhat is to be investigated?router can be used as firewall in terms of some aspects, and prevent the attack of dos. routers security technology has developed very well, which promised the security of network. check the router device is not broken, and the configuration is set in c

19、orrect way. it is also important to focus on the following indicators of router: integrality ensure the information will not be delete, changedconfidentiality ensure the information will not be shown or decryptedavailability require the routers system resources can be authorized to access.timeliness

20、 make sure the network information can be delivered in time, not delayed because of security tackling.solution descriptionif the router is broken, purchase a new one. if there have config problem, then make appropriate adjustment.client server investigation and testinghow to test the security of cli

21、ent server?ensure the server is functional, and not exit the problem of the aging of equipment. as it is possible that server has been attacked, so test on server is important. because hardware firewall is the main part of protection for server, therefore, it needs to pay more attention to the maint

22、enance of hardware firewall. the hardware, which is placed in the room, larger it is, more well the server works. solution descriptionthere are many solutions for server attacks. establish a good security category, install some software and keep 24-hour maintenance.date29 oct 2009 - 30 oct 2009title

23、investigation and test on management layerinvestigation scopeas bigfrog software managed the credit card processing system, which can get the detail information of users credit card, it is also suspected.l the people who can offer useful information about the incident, like bob, accountant and some

24、relevant technique workers.l the people who have access to the credit card details.l the establishment and implementation of security management and protection system.key factor/prerequisitesthe ceo of company would provide the detail information about all staffs, what they do, and who is responsibl

25、e for a specified job, as well as the policy of management. it is helpful to understand and find the problem.investigation on relevant peoplewhat is to be investigated andhow is to investigate?ask the ceo of gamblebet about the management of the company, detail information of all works, especially a

26、ccountant and some people can have access to detail of credit card. ask the technology manager of netbest hosting services the information about those it people who are in charge of gambelbets service. the information of those workers task and what roles should they played in the firms. check whethe

27、r there have some workers responsible for two or more tasks at the same time, which would leads to key information known to people. for example, the manager of security cant responsible for database management as well. as bigfrog manages gamblebets betting system application and credit card processi

28、ng system, it is also need to ask who has access to the detail credit card, and their information. on the other hand, some relevant information about the systems they offered is involved. investigation on security management and protection systemhow to investigate itask employees about the situation

29、 in this time, the system whether has some exception and what they deal with them. firstly, to ensure that when technical people from other companies come to do some maintenance, the gamblebet should assign a specified worker to supervise the whole process and when computers were sent outside for ma

30、intenance, they need to get the permission by the manager. before the equipments are sent to repair, whether workers delete all data in the storing medium after backup them. make sure that all employees are not allowed to install any software which is not permitted. in addition, ensure company had t

31、rained all employees on information security, so that every employee has an awareness of how to protect information system. finally, focus on if the company have detail device, system operation and maintenance records and security log analysis, system performance monitoring measures and operational

32、status.solution descriptionif there is something not matches the requirement, make up for it, and establishes a functional security policy to control the condition. date1 nov 2009 - 3 nov 2009titleinvestigation and test on software layerinvestigate scopebigfrog software provides some assistance on s

33、oftware to gambelbet, i.e. credit card processing system, therefore, those software from bigfrog software are also should be includedthe following are the scope of this investigation:l credit card application and authentication system in the firm.l the database of storing detail information of credi

34、t card and user, computer, antivirus software, firewall software, encryption technology, system vulnerability, intrusion detection systems.l the pci dsskey factors/prerequisitesthe company provides all the software information that they are using.credit card application and authentication systemhow

35、to test the system?the system provides apply service, authentication service, and some others for users. however, it also comes up with many problems that may reveal the credit card detail. the condition always resulted from system vulnerability which would lead to hacker attacks. therefore, testing

36、 on system vulnerability is important. vulnerability testing should be divided into 2 categories: web server testing and web application testing. system vulnerability detection tool can be used if necessary. in addition, system version is an important part of testing. an old and obsolete system is m

37、ore likely to suffered attack from hackers. finally, ask the project manager of bigfrog software if there have encryption technology of information transmission between user and bigfrog, gambelbet and bigfrog. solution descriptionit is better to update the version of system, and if there are some sy

38、stem vulnerability, download the patches in time. add encryption technology of information transmission to system in order to reduce the possibility of stole information.security of databasewhat is to be investigated?how to test the database?as database stores detail information of many things, so t

39、he safety of it is especial important. the first thing to ensure is the firewall of database works well and not suffered attacks. then, check the database whether is encrypted. only the person that is permitted can have access to database, and the password not lost. ensure when need to delete the da

40、ta, backup it, and delete it after confirmation. if some data need to keep for long time, then make sure the company prepared a specified policy and move the data from one medium to another medium before the medium lose the function of storing. it can prevent the data from being lost. solution descr

41、iptionencrypted database with two or more password, and be stored in different people. establish a good policy to manage database store.the pci dsswhat is to be investigated?how to test it?the pci dss is widely accepted policy and protocol, designed to optimize the credit card, prevent cardholder

42、9;s personal information from being used by others. therefore, make an investigation of both gamblebet and bigfrog to determine whether they do things according to the standard. the detail steps of investigation is in following:ensure users data cant be or include the default data with system, and c

43、ant be changed easily by users.ensure important information should be encrypted when transmitted in public network and would not be decrypted.ensure there have no vulnerability for application and always update the software that against attack.solution descriptionask both gamblebet and bigfrog devel

44、oped according to pci dss, which is benefit for users and companies.the most likely factor leads to incidentthe firewall is the most likely factors which lead to the incident, as almost every hacking attack on the firewall nowadays. therefore, firewall is the most important part to test and concern

45、for every technical worker. solutionupdate the configuration of firewall or purchase a new stronger and functional to meet business demand.my journaldateactivityduration time18 nov 2009read the request carefully, understand the meaning, the purpose of the task, and learn about what knowledge should

46、be used in order to deal with the job. review the knowledge and collect some related materials which can be used. after these preparations, outline the points of the task so that i can analysis the condition with these points in the next few days. 2 days 21 nov 2009through careful analysis, divided the job in 3 fields: hardware security, software security, management s