#tutorialreflection

Most of the tutorial was spent watching everybody’s something awesome presentation, and they were all really cool!. We didn’t end up going over the case study so I had a go at it a copy of days after the tutorial. 

I haven’t watched Stargate SG1, but I have seen one and a bit seasons of Stargate Atlantis. It’s a really good show!

So the problem is, I’m Major “M”, who can speak to an alien A, but I can’t see the invisible man X (Jack, from the Youtube clip). Jack can speak to the alien, who can in turn speak to me. This does seem really similar to the Houdini case, and the question was raised in the tutorial. But it does make sense, houdini focused more on authentication, while this case study is focusing more on integrity. 

Now... we can’t get Jack to do RSA in his head... if only

So how do we guarantee the integrity of our conversation, so that we know the alien is tampering with our conversation like a man in the middle attack

I remember from the BBC show Sherlock, there was a scene when Sherlock was about to open a safe, which had a trap (gun) rigged inside of it. He looked at Irene and realized it was a trap. He shouted out “Vatican Cameos”, and Holmes immediately knew there was danger. It’s a stretch but I would be hoping I would know Jack well. Maybe Jack could say something which seems innocent/random to the Alien, but to me it would immediately scream “danger, I’m/we’re in danger”. Or better yet, inspired by the Youtube clip listed on the case study page. The way Jack would talk through the alien, could be an indication of who is talking. If Jack had a very peculiar way of speaking/was very rude/worded his sentences in such a way that I knew it was Jack... that would prove integrity I think. 

We started off by going through some of the mid semester answers again. Then we covered Diffie Hellman Key exchange and a bit on certificates. We went through the various types of block ciphers.

ECB - Electronic Code Book

Break a message into blocks

Encipher each block seperately 

Patterns persist - which is a problem

CBC - Cipher Block Chaining

Use the previous ciphertext XOR with the block -> put it through the block cipher encryption 

Can’t decrypt the second without the first 

Makes it more random

Very slow I think?

CTR - Counter Mode 

Stream cipher

We went through Caff’s Buffer Overflow Questions!

I had no worries with 1.0 basic

It took me a while to figure out 1.1 whereamI, but that is only because I compiled with gcc instead of using the prescribed make file 

Still strugging with 1.2 Blind

Finally we started the case study, which was a debate on whether or not we should have more or less surveillence. We were split into two groups and we had to debate with each other. I was on the side of less surveillence. I remember listening to somebody a long time ago (who did a lot of debating), who said that when you debate, regardless of what your personal beliefs are, when you fight for your side, you begin to believe it, even for just the duration of the debate. 

I didn’t really take down notes for this part, as I was too engrossed in listening to the debate. Some of the points below I took down during the debate, others I took from the email sent by Max. 

AGAINST 

If we collect data now, how do we know what the future holds and how the data will be used in the future? Can we trust the people who hold this data? 

Rwanda example 

Census on everybodies race, it’s okay, countries relaxed

A couple of years later, that census was used to perform mass genocide 

Insider attacks stealing the data

Employees abusing the data to stalk people 

Data sold for money?

FOR

Help improve safety/ prevent crimes

Stop terrorist attacks 

Perform better background checks 

There was a point made from the FOR side which was something along the lines of we’ll get world peace. Dunno if it was serious but it got me thinking. World peace through mass surveillence sounds like a totalitarian state akin to 1984. I’d be terrified to live in one of those countries. 

In the tutorial this week, we covered cyber warfare. The topic was, what kind of cyber attracks will the russians use if we go to war with them?

Fake news - spread false info online, quickly spreading

It makes people mistrust the news, each other etc.

What is real what is false anymore? 

Attack power grids

Attack telecommunications 

EMP’s

Mass surveillence 

Destroy infrastructure like water supplies

Compiled list from class

Insider attacks (military secrets)

DDOS attacks

Ransomware attacks on infrastructure

Sabotaging power

Hijack military drones

Attack GPS 

Backdooring software and logging/survillence 

Denial of tech gear (hardware) from enemy

I think this was like, attacking shipments

Jamming signals

Data theft 

Tutorial Question - Consider the main threats we face in the cyber domain of war and produce 10 recommendations for actions to be taken

I could only come up with 5 

1. Increase security on the software that controls infrastructures like electricity & water 

Air gaps

Secondary backups 

True, this one was too broad

2. Increased background checks for higher ups in the military + surveillence

On any worker in critical roles to be honest 

Military, Government, Programmers

3. Develop our own GPS system as a backup in case the American GPS system is taken down 

4. Auditing software companies to check if their workers have been compromised, or their software has been compromised 

5. Funding to educate the public/workers (especially if they work in military/government) on basics of cyber security

How to watch out for social engineering etc ...

List made by the class

Compartamentalise knowledge of intelligence

Background checks on programmers

Risk type 1 / type 2 errors

What if we let someone in, who is an insider 

What if we deny someone, who isn’t 

Make most valuable people anonymous

Doesn’t work in a democracy 

Can’t deny reputation damage 

Backdoor everything now

What if it’s found out early, and it’s the reason we go to war 

Virus that kills enemy data, wipes our own data if it’s been compromised 

Could be too dangerous to use, leaked out early?

Stay offline if possible

Limit internet access to prevent cyber attacks

Create nationwide intranet 

Prepare financial resources for war 

In event of DDOS, have redundancies for online services

International war games as training 

Locally sourced software & hardware 

After the class, we covered buffer overflows in more details, as well as other forms of attacks like format string attacks. I thought it was really cool, I’ll try out the challenges that caff posted on open learning.

We covered some of the content for the mid semester exam

The case study question was you’re the CSO of Giggle, and you’ve arranged a meeting we’re you’ll discuss the security implications of driverless cars. 

1. List the assets of the company you are concerned about

Company Reputation

Stock Price

Money 

Time 

When I saw the word assets I just kind of jumped into a finance point of view, where money was the goal, kind of neglecting safety and lives :// 

2. List the top 3 / 4 risks you are concerned about 

Driving system compromised by an attacker, risking the lives of the passengers i.e. driving them into oncoming traffic or locking the doors and driving them into a river (doctor who flashbacks: Doctor Who Series 4 Episode 4 “The Sontaran Stratagem”) 

Driving system has a bug, safety risk for both passengers and pedestrians

What if the car suddenly veered onto the sidewalk 

Ethics - Should the car swerve to avoid a pedestrian, risking the life of the passenger?

3. What the company should do to address each risk

Don’t let the car start until the latest security patches are installed 

Defintely make manual driving an option - kind of like the AI driving the car is the autopilot, and you can switch it off anytime 

4. Should we continue with the project

Yes, AI is the future

Automation is taking over, from self service checkouts to machines that spit out cars at an insane rate, cars will be no different in the future

Besides, if other companies are doing it (Tesla, Audi, VW), we should as well, because $$$ 

Answers from other groups:

1. People, Tech/Intellectual Property, Image and reputation, Car itself, Costs, Privacy (GPS tracking, but phones do that anyways), jobs + growth, infrastructure

2. Privacy, IP Theft, insider attacks, money, corruption of the government/insider, legal issues - who to blame if an accident happens, reputation risk for damages, injury and death, hijacking, of car controls

3. Good security, minimise amount that the car connects to outside networks (decrease attack surface), stronger employee vetting, careful testing, added requirements for testing/standards (quality control) 

In the tutorial we covered some of the theory in the course, preparing for our midsem exam. We went through bits of security, I found the video in the module 4 activities really nice by Adam Smallhorn. And then we spent some time on covering recon, active vs passive, online vs offline. Followed by some cryptography that’ll probably in the mid sems, we went through an example in class. 

The case study was “Secret”, how would you go about protecting a new research lab from Google. 

1. List the main things you need to protect for the new office

Access to servers / computers

Access into the building 

Access to any sensitive data 

Can’t risk anything being leaked out/ smuggled out/ secretly recorded 

Protect the workers from harm?

2. List three features of your security

Security badges, need to be scanned in order to access the building. Security guard at gate to verify badge plus something akin to airport security, like facial recognition plus to check what you’re bringing into the lab. 

Once through, you’ll need an access code to enter different parts of the building, only areas you need to be in, are the areas you can access with the access code. This stems from the compartamentalization idea, different parts of the project are held in different locations, need different badges/ security clearance in order to access them. Guards everywhere

Security check as you exit as well, to double check who you are and to check what you are bringing out 

My ideas were critiqued and some interesting points were made which I agree with

Security guards everywhere - social engineering, they can be compromised

Check what you’re bringing out - what if it’s a USB? encrypted? how pedantic do you want to be 

Ideas from other students:

Part 1:

IP / Physical Design / Data

Design of the place

Remote access

Insider attacks - protect from employees 

Protect reputation of the company

Protect keycards / passwords/ codes

Technology used in production

Part 2:

Timelock

Access only at certain times, corrupt data if password entered incorrectly

Tap card + security has to tap their card as well

Important stuff - glass in the room, everyone can see what you’re doing 

Security by hiding in plain sight - the outside of the building is plain and broken down, nobody would suspect a high tech google lab would be inside 

So this weeks tutorial was based on airplane doors. The prereading was a bunch of news articles on incidents that occured during flights, revolving around airplane doors. The question in the tutorial was to give 5 recommendations on how to prevet future disasters on airplanes. 

Our group came up with these:

1. Dual key system in order to access the cockpit, the keys are changed on every flight. Each staff knows only one of the two codes. This does make threatening a bigger issue, an attacker could just threaten the lives of the staff, and get them to enter the code in. 

2. Lower the need for the the pilots to exit the cockpit. We could add a toilet into the cockpit so they wouldn’t need to leave. This does have an added cost associated with it. As a side note, imagine if the cockpit was similar to like a bank teller desk. Pilots are barred from leaving the cockpit, there’s a toilet in the cockpit. Food/water is passed through like a little slot, so they won’t even need to exit the cockpit for food/water. More secure, but they might go insane. 

3. Aircrafts overidable from aircraft control. This does introduce a big risk that the controls could be compromised by an attacker. 

4. Mandatory mental/physical health checkups. It would mainly focus on mental health, maybe mandatory checkups with a psychiatrist every two months or something. The downsides to this is, it puts a lot of pressure on the checkups, if the psychiastrist thinks theres something wrong, you could lose your job. This might lead to pilots trying to fake being fine. 

The article in the first link for the case study material, I felt like the way that the writer wrote the article, he/she was heavily biased towards believing in mediums, going so far as to write down about houdini. The articles just talked about a lady called Mina/Margery who became a medium at the insistence of her husband who was a doctor who belived in mediums. She did a lot of seances, and was tested by a harvard committee, where houdini tried to prove she was a fraud. 

Case Study Questions: How could houdini and his wife develop a protocol so that when houdini passes, his wife could use a medium to contact houdini’s spirit, and that she could verify that it really was houdinis spirit. 

1. State and briefly justify the most important properties your protocol should have

Using the CIA principles, our group chose authenticity as the major property

2. Give your protocol

Houdini and his wife would memorise a list of one time pads

Other groups:

1. Computable by humans, high enough entrophy/randomness

2. list of ordered random words - greeting “handshakes”

Tutors sample answer:

Keep asking questions about their personal life until they’re content 

This tutorial was really helpful for understanding what is needed for the identity task of this unit. Everyone got individual feedback but the points discussed were mainly generic. I have outlined key points from each section.

Portfolio Digital and Print

Images must be high quality (can be edited), Type can be adjusted, A title page that makes an impact (minimal contact details), Think about how pages work together with a grid system, Text must be minimal think like a tweet, Simple Hierarchy, 3/4 projects min 6-10 max, Start strong and end strong, Keep all original images.

Web

I think at this stage I am going to use wordpress for the hand in of this unit however I think that perhaps when I have some more time I may look to use muse as this may give me a bit more flexibility to show my identity. Although Rich said I could do this just as successfully by using wordpress as well by showing images of my identity on the home page. 

CV

Look at incorporating identity, keep it simple again using hierarchy and using nice set type. We also got given a list of things to include in the CV. Think about paper stock this can be included in a spec.

For next week