Assessing and Securing Systems on a Wan and Applying Encryption and Hashing Algorithms for Secure Communications

In: Computers and Technology

Submitted By daniellehunker
Words 832
Pages 4
Unit 1 Individual Project
Danielle Hunker
Ethical Hacking
Colorado Technical University Online
CSS280
February 22, 2016

Assessment Worksheet
Assessing and Securing Systems on a Wide Area Network (WAN)
Course Name and Number: Ethical Hacking CSS280
Student Name: Danielle Hunker
Instructor Name: Jimmy Irwin
Lab Due Date: February 22, 2016
Overview
In this lab, a systems administrator for the securelabsondemand.com network has reported odd behavior on two servers that support legacy applications you first conducted internal penetration tests (also called a vulnerability scan) on each system and then helped secure those systems by configuring firewalls and removing vulnerable open ports.
Lab Assessment Questions & Answers 1. What is the first Nmap command you ran in this lab? Explain the switches used.
Nmap command: nmap –O –v 10.20.100.50
-O was the switch used to detect the operating system 10.20.100.50
-v was the switch used to show the detail of 10.20.100.50 2. What are the open ports when scanning 192.168.3.25 and their service names? * 80 HTTP services * 135 Microsoft EPMAP (End Point Mapper) * 139 NetBios session service * 445 Microsoft DS, SMB file sharing and CIFS (common internet file sharing) * 3389 RDP (Remote Desktop Protocol) * 5357 WSDAPI web services for devices * 49152 uo to 49157 DCOM or ephemeral ports 3. What is the command line syntax for running an SMB vulnerability scan with Nmap against 10.20.100.50?
Nmap –script=smb-check-vulns –p445 10.20.100.50 4. Explain why SMBv2 DoS (CVE-2009-3103) is bad.
SMBv2DoS is bad because this kind of vulnerability allows for a denial of service attack with the Blue Screen of Death or BSOD. 5. What is the operating system of IP address 192.168.40.238?
FreeBSD 7.x|8.x|9.x|10.x 6. What are the reverse IP…...

Similar Documents

It255 Lab 7 Encryption, Hashing, and Confidentiality

...Lab 7 Windows Encryption and Hashing to Confidentiality & Integrity Brett Reigel ITT Technical Institute IT 255 08/09/2012 Lab 7 Windows Encryption and Hashing to Confidentiality & Integrity 1. Which Key do you provide anyone you want to encrypt messages with private or public keys or both? The public key is always provided as part of the handshake in order to encryption to take place. 2. What does GPG allow you to do once it is installed? GPG allows you to encrypt your hard drives content in order to secure it. 3. Name 2 different types of encryption supported by GPG for your key? The MD5 and Sha1 type of hashing encryption are supported by GPG. 4. What happens when you sign and trust a new key on your keychain? A new key is created to include the private and public key based on how the new key was created. 5. If a user sends you a public key will he be able to decrypt your encrypted messages once you import and sign his key? Both parties need to have each other private keys in order to be able to encrypt and decrypt all messages that is exchange among themselves. 6. What are the similarities between an MD5 hash and a fingerprint? They both insert a fingerprint to the data. 7. How would you encrypt a webserver and the pages it serves up? By setting the web server to redirect it’s web traffic to SSL hence encrypting all conversations between server and host in relation to the web traffic. 8. Why is hashing all......

Words: 446 - Pages: 2

Lans and Wans

...are essential to connecting Kudler Fine Foods together. As are the hardware and software needed to create and secure the networks. Each location will be set up with its own Wireless local area connection and they will all utilize the Internet to provide a Wide Area connection for the company as a whole. LAN, WAN and Wireless technologies Local Area Networks, or LANs, are a grouping of computers networked together in a generally small geographic area. LAN technology refers to the hardware and software used to create a local area network. The most common wired methods are Ethernet and Token Ring, and WLAN technologies using IEEE 802.11. WAN or Wide Area Network technologies include ATM. TCP/IP, and Frame Relay to connect and transfer data across large distances. Using a cable such as an Ethernet cable computers on a LAN are required to share the network when passing data packets back and forth. Before sending data across the network each computer checks the line for other transmissions. If the line is clear the computer sends the data, if not the computer waits. This method is called CSMA/CD. Wireless LANs or WLANs use RF signals to transmit data across the network. Every computer on a wireless local area network share the same frequency and take turns sending data just like using a cable. Wireless LANs use CSMA/CA to check for an open line of communication to it intended target. The sending device will send out a signal to the receiving device called a Request to......

Words: 1327 - Pages: 6

Nt2580: Unit 7 Select Appropriate Encryption Algorithms

...Instructions: Match common encryption algorithms and methods with the scenarios representing real-world business applications and requirements. Common encryption algorithms and methods: ▪ Data Encryption Standard (DES) ▪ Rivest, Shamir, and Adleman (RSA) encryption algorithm ▪ Triple DES ▪ Diffie-Hellman key exchange ▪ International Data Encryption Algorithm (IDEA) ▪ El Gamal encryption algorithm ▪ Carlisle Adams and Stafford Taveres (CAST) algorithm ▪ Elliptic curve cryptography (ECC) ▪ Blowfish ▪ Secure Sockets Layer (SSL) ▪ Advanced Encryption Standard (AES) ▪ Digital signature Scenarios: 1. Shovels and Shingles is a small construction company consisting of 12 computers that have Internet access. The company's biggest concern is that a wily competitor will send e-mail messages pretending to be from Shovels and Shingles in order to get confidential information. Select an encryption solution that best prevents a competitor from receiving confidential information and justify the recommendation. 2. Top Ads is a small advertising company consisting of 12 computers that have Internet access. All employees communicate using smartphones. Top Ads' primary concern is protecting the data on the smartphones. Select an encryption solution that best protects the smartphones and justify the recommendation. 3. NetSecIT is a multinational IT services company consisting of 120,000 computers that have Internet......

Words: 401 - Pages: 2

Encryption a Means of Security

...Security in today’s world is one of the important challenges that people are facing all over the world in every aspect of their lives. Similarly security in electronic world has a great significance. In this seminar work, we discuss the applications of encryption techniques in database security. This is an area of substantial interest in database because we know that, the use of database is becoming very important in today’s enterprise and databases contains information that is major enterprise asset. This research work discuses the application of various encryption techniques in database security, and how encryption is used at different levels to provide the security. 1. INTRODUCTION Information or data is a valuable asset in any organization. Almost all organization, whether social, governmental, educational etc., have now automated their information systems and other operational functions. They have maintained the databases that contain the crucial information. So database security is a serious concern. To go further, we shall first discuss what actually the database security is? Protecting the confidential/sensitive data stored in a repository is actually the database security. It deals with making database secure from any form of illegal access or threat at any level. Database security demands permitting or prohibiting user actions on the database and the objects inside it. Organizations that are running successfully demand the confidentiality of their......

Words: 4175 - Pages: 17

Select Appropriate Encryption Algorithms

...Instructions: Match common encryption algorithms and methods with the scenarios representing real-world business applications and requirements. Common encryption algorithms and methods: ▪ Data Encryption Standard (DES) ▪ Rivest, Shamir, and Adleman (RSA) encryption algorithm ▪ Triple DES ▪ Diffie-Hellman key exchange ▪ International Data Encryption Algorithm (IDEA) ▪ El Gamal encryption algorithm ▪ Carlisle Adams and Stafford Taveres (CAST) algorithm ▪ Elliptic curve cryptography (ECC) ▪ Blowfish ▪ Secure Sockets Layer (SSL) ▪ Advanced Encryption Standard (AES) ▪ Digital signature Scenarios: 1. Shovels and Shingles is a small construction company consisting of 12 computers that have Internet access. The company's biggest concern is that a wily competitor will send e-mail messages pretending to be from Shovels and Shingles in order to get confidential information. Select an encryption solution that best prevents a competitor from receiving confidential information and justify the recommendation. 2. Top Ads is a small advertising company consisting of 12 computers that have Internet access. All employees communicate using smartphones. Top Ads' primary concern is protecting the data on the smartphones. Select an encryption solution that best protects the smartphones and justify the recommendation. 3. NetSecIT is a multinational IT services company consisting of 120,000 computers that have Internet......

Words: 401 - Pages: 2

Hashing & Encryption for Secure Communication

...Week 1 Lab: Implement Hashing & Encryption for Secure Communications Learning Objectives and Outcomes Upon the completion of this lab, students will be able to perform the following tasks: • Apply common cryptographic and hashing techniques on a message to ensure message confidentiality and integrity • Verify the integrity of the output of common cryptographic and hashing tools to determine whether an encrypted message is legitimate or whether it has been modified • Use and create an MD5 sum or SHA1 hash to generate a unique hash for data to assure the integrity of the data • Relate how a change to the data impacts the hash and why it is important to check the hash provided before executing or unzipping a binary or some other unknown file Assignment Requirements Watch the Demo Lab in Learning Space Unit 2 and then answer each of the following questions. Tasks: 1. Use the following encryption algorithms on the following message and record the result: “You Deserve an A”. You may use one of the readily available tools on the Internet to perform this encryption. Please provide the link (URL) of the tool you used. a. MD5: 02f3b84a0bdae954498783594c668541 b. SHA1: D44A86680D449581A82644C663F8B5C34DB6BBF1 c. Link: http://onlinemd5.com   2. Decrypt the following. You may use one of the readily available tools on the internet to perform this encryption. Please provide the link (URL) of the tool you used. a. MD5: ......

Words: 543 - Pages: 3

Implement Hashing and Encryption for Secure Communications

...Implement Hashing and Encryption for Secure Communications NaTasha Scott Dr. Jodine Burchell CIS 552 Cybercrime Techniques and Responses October 18, 2013 The MD5sum hash string for Example.txt 46edc6541babd006bb52223c664b29a3 The SHA1sum hash string for Example.txt a6f153801c9303d73ca2b43d3be62f44c6b66476 The MD5sum hash string for modified Example.txt 0e9687be578daf31a13ce42af48be3ac SHA1sum hash string for modified Example.txt 229beb78e69d5bd2f789edb6396277536f1459bb Briefly expalin why this change occurred and how it could be useful to a security analyst verifying the file. The reason why the change occurred because I have altered the Example.txt file, causing it's hash string to change. It is useful to a security analyst because he or she will know if the data has been either altered or tampered with. GPG Keys for the student account [pic] GPG Keys for the instructor account [pic] When I tried to do the GPG keys for the instructor something went wrong and I was not able to get any results like I did with the student account. I did this twice and still no results that were supposed to be there except for “permission denied”. I even followed the steps on the manual as well. It was becoming a great experience and lab exercise and I was really enjoying it until this part. Lab 2 Assessment Questions and Answers 1. Compare the hash values......

Words: 1138 - Pages: 5

Implement Hashing and Encryption for Secure Communications

...3. If you were using corporate e-mail for internal and external communications but did not want to encrypt an e-mail message, what other security countermeasure can you deploy to ensure message integrity? They could use digital signatures in the email. 4. If you are using corporate e-mail for external communications that contain confidential information, what other security countermeasure can you deploy to maximize confidentiality of e-mail transmissions through the Internet? They can use digital signatures along with cryptography. 5. What is the difference between MD5sum and SHA1sum hashing calculations? Which is better and why? MD5sum is a one-way has function that has a 128 bit has for the input. SHA1sum processes up to 512 and adds padding. Sha1sum is better because padding is added to ensure the right numbers. 6. Where can you store your public keys or public certificate fi les in the public domain? Is this the same thing as a public key infrastructure (PKI) server? It is stored on the domain. 7. What do you need if you want to decrypt encrypted messages and fi les from a trusted sender? You would need the public key to decrypt the message. 8. What encryption mechanisms are built into Microsoft® Windows XP Professional? EFS is what is built into Microsoft Windows XP. 9. Which Windows encryption mechanism provides full disk encryption and uses the Trusted Platform Module to do so? Do you recommend...

Words: 411 - Pages: 2

Week 1 Lab: Implement Hashing & Encryption for Secure Communications

...Lab: Implement Hashing & Encryption for Secure Communications 1. Use the following encryption algorithms on the following message and record the result: “You Deserve an A”. You may use one of the readily available tools on the Internet to perform this encryption. Please provide the link (URL) of the tool you used. a. MD5: _02f3b84a0bdae954498783594c668541 _ b. SHA1: _d44a86680d449581a82644c663f8b5c34db6bbf1 _ c. Link:_ http://www.md5hashgenerator.com/index.php / http://www.sha1-online.com/ Decrypt the following. You may use one of the readily available tools on the internet to perform this encryption. Please provide the link (URL) of the tool you used. d. MD5: 0cbc6611f5540bd0809a388dc95a615b Result:_______ MD5: Test___________ e. SHA1: 640AB2BAE07BEDC4C163F679A746F7AB7FB5D1FA Result ______SHA1: Test ________ f. Link:_ http://www.md5decrypter.co.uk/sha1-decrypt.aspx \ http://www.md5decrypter.co.uk/ 2. If you were using corporate e-mail for internal and external communications but did not want to encrypt an e-mail message, what other security countermeasure can you deploy to ensure message integrity? Digital Signature 3. If you are using corporate e-mail for external communications that contain confidential information, what other security countermeasure can you deploy to maximize confidentiality of e-mail transmissions through the Internet? A VPN. 4. What is the difference between MD5sum and SHA1sum hashing......

Words: 435 - Pages: 2

Securing a Linux System

...Unit 1 Discussion 1: Securing a Linux System Learning Objectives and Outcomes * You will present different views on security related to a Linux system. * You will be able to identify risks related to the implementation of a Web application in a Linux environment. Assignment Requirements A small community bank is studying the prospect of maintaining its own in-house Linux Web server for a Web application. The Web application will allow the bank’s customers to login, view their loan details, and check and save account balances. The company sends you a request for your services as a Linux and open source consultant. You grab the opportunity because you are dissatisfied with your current job. It is your first day in the community bank, and you are told that your role as a consultant will be to analyze all probable risks related to the prospective Web application. Your manager introduces you to the other employees, including Bob, who is an intern working on the development of the Web application. Bob is also the system administrator as he currently supports the local area network (LAN) environment. You discuss the Web application and its functioning in detail with Bob. Bob tells you that the server will be hosted at the bank’s location since the other servers are presently supporting their Microsoft Windows-based LAN. The Web application will run on any of the popular open source servers. Knowing your background, Bob is very excited to learn Linux and use this......

Words: 967 - Pages: 4

Information Systems Security

...Hardware, software and the data that resides in and among computer systems must be protected against security threats that exploit vulnerabilities. Organizations must therefore impose appropriate controls to monitor for, deter and prevent security breaches. Three areas have been considered, in a typical sense, as the basic critical security requirements for data protection: confidentiality is used to assure privacy; principles of integrity assure systems are changed in accordance with authorized practices; and, availability is applied to maintain proper system functions to sustain service delivery (Dhillon, 2007, p. 19). These security requirements are represented in Figure 1, Classic Critical Security Requirements. This figure depicts the cross-domain solutions of informal controls, also known as human relationships, and formal and technical controls, which provide for organizational and physical information security controls, respectively. Two additional security requirements have recently been added that are of particular importance to networked environments because attacks now extend far beyond traditional firewall perimeters. These are authentication, which is used to assure a message actually comes from the source it claims to have originated; and, nonrepudiation, which can be applied to prevent an entity from denying performance of a particular action related to handling data, thereby assuring validity of content and origin. Figure 2, Core Data Security Set,......

Words: 1759 - Pages: 8

Encryption in Today's Information Systems

...from gaining access to the data. The key behind keeping information safe is the method in which it’s protected and encrypted. In order to appreciate how information is secured, users must understand the encryption concepts behind it. To do this, one must comprehend the current encryption standards, the trends and developments in encryption technology, the importance of securing data, the government’s regulations pertaining to encryption, the companies involved in research and implementation, the implications of leaked or stolen data, and a brief look into the recent Heartbleed vulnerability. Encryption is at the heart of security in today’s networked world. When using the Internet, users are not always clicking around and taking in information passively, such as reading through their Facebook feed, a blog, or a news article. Often times, they are transmitting their own information while shopping online or registering for a website such as Twitter (Tyson 2014). Users take for granted the “behind the scenes” process of safeguarding the information they share while performing these day to day tasks. Simply put, encryption refers to any process used to make data more secure and less likely to be viewed or read by unauthorized or unintended parties (Tom’s Guide 2014). Encryption relies on the science of cryptography, which humans have used for thousands of years. Before the dawn of the information age, the majority of those who used cryptography were governments;......

Words: 767 - Pages: 4

Lab 1 Securing Systems

...Lab #1 – Assessment Worksheet Assessing and Securing Systems on a Wide Area Network (WAN) 1. What is the first Nmap command you ran in this lab? Explain the switches used. The first nmap command used was nmap -O -v 10.20.100.50. -O was to detect the operating system of the 10.20.100.50 machine, while -v showed much detail. 2. What are the open ports when scanning 192.168.3.25 and their service names? There are twelve open ports. 80 is HTTP services, 135 is the Microsoft EPMAP aka DCE/RPC locator service, 139 is the NetBios session service, 445 is the Microsoft-DS, SMB file sharing, and the common internet file sharing, 3389 is the RDP, 5357 is the web services for devices, and 49152 to 49157 is the DCOM or ephemeral ports. 3. What is the command line syntax for running an SMB vulnerability scan with Nmap against 10.20.100.50? nmap --script=smb-check-vulns -p445 10.20.100.50 4. Explain why SMBv2 DoS (CVE-2009-3103) is bad. It allows a denial of service attack with the blue screen of death. It makes the system a high risk system. 5. What is the operating system of IP address 192.168.40.238? The operating system is FreeBSD 7.X|8.X|9.X|10.X The only open port is port 22 which indicates it is the SSH. 6. What are the reverse IP addresses for the three remote computers scanned in this lab? 10.20.100.50 is 50.100.20.10-apples.colo9.sg.com. 192.168.3.25 is 25.3.168.192-WASHDC103.mainstreet.coresite.com. 192.168.40.238 is 238.40.168.192-lichen.de...

Words: 291 - Pages: 2

Encryption and Its Uses in Communication

...Encryption is a very important aspect of our daily lives. Everywhere we go and everything we do now involves some sort of encryption technology. From turning on our cars to using a card access to gain entry to our workplace, encryption is there. More specifically, encryption in communication is a vital component to everyday life. Without encryption, our lives would be much different and unsecure. According to Oded Goldreich (2004), There are 2 main types of encryption: One is called Symmetric-key and the other is public-key encryption (pp 375-376). The Symmetric-key algorithm uses the same cipher for both encryption and decryption. Conversely, the public-key algorithm requires 2 separate keys. One of these keys encrypts the text or message and the other decrypts it. A big drawback to using the Symmetric-key system is that both parties must possess the single, shared key (Mullen & Mummert, 2007). The public-key system kept both parties having separate keys that neither even knew about, but could still decipher the message. Encryption is defined as the activity of converting data or information into code. There are a lot of different ways that we use encryption. Cell phones, web browsers, wireless access, and computer passwords are all different types of communication encryption. Encryption is definitely not a new technology. It has been used by militaries and governments to communicate secretly for years. Cell phones are a prime example of the encryption we use today. In......

Words: 1437 - Pages: 6

It255: Unit 7 Select Appropriate Encryption Algorithms

...Instructions: Match common encryption algorithms and methods with the scenarios representing real-world business applications and requirements. Common encryption algorithms and methods:  Data Encryption Standard (DES)  Rivest, Shamir, and Adleman (RSA) encryption algorithm  Triple DES  Diffie-Hellman key exchange  International Data Encryption Algorithm (IDEA)  El Gamal encryption algorithm  Carlisle Adams and Stafford Taveres (CAST) algorithm  Elliptic curve cryptography (ECC)  Blowfish  Secure Sockets Layer (SSL)  Advanced Encryption Standard (AES)  Digital signature Scenarios: 1. Shovels and Shingles is a small construction company consisting of 12 computers that have Internet access. The company's biggest concern is that a wily competitor will send e-mail messages pretending to be from Shovels and Shingles in order to get confidential information. Select an encryption solution that best prevents a competitor from receiving confidential information and justify the recommendation. 2. Top Ads is a small advertising company consisting of 12 computers that have Internet access. All employees communicate using smartphones. Top Ads' primary concern is protecting the data on the smartphones. Select an encryption solution that best protects the smartphones and justify the recommendation. 3. NetSecIT is a multinational IT services company consisting of 120,000 computers that have Internet access and 45,000 servers. All employees......

Words: 401 - Pages: 2