ITEC-852 Advanced System and Network Security Assignment 1


ITEC-852 Advanced System and Network Security
Assignment 1
Total marks: 30
Weighting: 10%
Deadline: Friday (Week 8), 04 October 2019 (11:59 pm).
Note: Submit the assignment via Turnitin (Include Student Name and ID in assignment).
This assignment has been designed to test your knowledge of the first six lectures in the class:
• Introduction to Cyber Security
• Threats, Attacks and Security Mechanisms
• Cryptography
• Security Protocols
• Authentication and Access Control
• Web and Data Privacy
• Assumptions (if any) must be stated clearly in your answers.
• There may not be one right answer for some of the questions. So, your explanations need to present
your case clearly. The explanations you provide do not have to be long; conciseness is preferred to
• It is recommended that you use Python for the programming components of the assignment. However,
you are free to use another programming language provided the question/answer/solution can be
naturally translated into a similar problem in that programming language.
For all questions in this assignment not only content but also presentation will affect your mark. You may
lose marks if there are considerable problems with the presentation, particularly with clarity. This means
that your answers to each question should be a coherent statement. You should ensure that spelling and
grammar mistakes of your submission are kept to a minimum.
For full marks, your answers should all be clear, coherent and correct. The following particular standards
will be applied in marking this assignment:
• Clarity:
– Ambiguous or poorly worded answers will receive a grade no more than a pass for the individual
• Correctness of approach taken and answer obtained:
– Incorrect answers with the correct logic or approach will not be necessarily penalised.
– Correct answers with incorrect logic or approach will receive no more than pass for the individual
– Incorrect answers with no explanation of the approach taken or with the incorrect approach will
receive a fail grade for the individual question.
The questions will be marked individually, the marks totalled, and a final grade assigned that is no more
than indicated by the total marks, and no more than allowed by the standards specified above and in the
unit outline.
• On line submission via Turnitin.
Assignments will be marked and returned online. There are no hardcopy submissions for written assignments.
Ensure you submit the correct file. The submission process shows you a complete preview of your entire
assignment after you have uploaded it but before you have submitted it. Carefully check through every
single page to ensure everything is there and the correct version has been uploaded, and only then press
Multiple submissions may be possible via Turnitin prior to the final due date and time of an assessment task
and originality reports may be made available to students to view and check their levels of similarity prior to
making a final submission. Students are encouraged to use these reports to ensure that they do not breach
the Academic Honesty Policy through high levels of similarity (plagiarism).
Teaching staff will use the report to judge whether plagiarism has occurred and whether penalties should
apply for breaches of the Academic Honesty Policy. Any similar text identified by Turnitin will be considered
carefully to see if it is indeed a breach of the Academic Honesty Policy.
Question 1 (6 marks)
A bank with 1,000 customers decides to use a different PIN entry method for cardless cash. It first assigns
random 4-digit PINs to each of the 1,000 customers such that no two customers have the same PIN. At the
ATM, each customer can authenticate simply by entering their PIN. The backend system can authenticate
the customer based on the unique random PIN. You have been hired as a security consultant by the bank
to analyze the security of this system.
(a) Assume John is one of the customers. What is the probability that an attacker can guess John’s PIN in
one try? (1 mark)
(b) What is the probability that an attacker can guess any customer’s PIN in one try? (1 mark)
(c) How many attempts are needed by an attacker to guess any customer’s PIN with probability at least
0.5? (3 marks)
(d) You suggest to the bank that the customer should also enter a unique username. What issue does this
mitigate? How is requiring a bank card in addition to entering a PIN different? (1 mark)
Question 2 (7 marks)
Suppose you are coding an interactive program in Python to help kids learn mathematics. Using the
input and eval function in Python you allow users to enter addition and multiplication expressions. More
specifically, your program defines a variable y = 1, and then you allow users to enter expressions like y + 2
and y*3. The program then evaluates these expressions and prints the updated value of y.
(a) Write the above program and show how you can (mis)use it to print your name 10 times. (3 marks)
(b) Could this vulnerability be exploited to run other (may be malicious) Python code? (1 mark)
(c) How would you remove this vulnerability in the program? Hint: You do not need to use the same
functions (e.g., eval). (3 marks)
Question 3 (6 marks)
The birthday paradox states that if we generate random binary strings of length n, then we expect to find
a collision in approximately √
n attempts.
(a) Suppose n = 16. Write a program that counts and outputs the number of strings generated before a
collision is found. Your program keeps a counter, generates random binary strings of length 16, stores them,
and outputs the counter value once a collision is found. You should run a Monte Carlos simulation (e.g.,
repeat the program say a 1000 times and find the average). What is the average number of attempts before
a collision is found? Please produce your code as well. (5 marks)
(b) Explain what does this mean for the digest size in hash functions? (1 mark)
Question 4 (2 marks)
In the lecture slides (week 4) on Kerberos, explain why B needs to check if the time stamp tA is fresh, i.e.,
within a small time interval around B0
s local time, when B is already checking if time stamp tA is in the
validity period l? (2 marks)
Question 5 (3 marks)
Suppose an organization has the following roles: director (D), group leader (G), team leader operations
(TO), team leader technical (TT), and employee (E). We also have security labels for information which
we denote with the same letters, i.e., D, G, TO, TT, E. You have been tasked to implement the following
security policy:
• Each role has access to information which is assigned the same security label, e.g., employee has access
to information labelled E.
• The employee has only access to information labelled E.
• Each of the two team leaders have further access to information labelled E.
• The group leader has further access to information labelled in the set {TO, TT, E}.
• The director has further access to information labelled in the set {G, TO, TT, E}.
• Any combination of roles, i.e., subset, has access to information labelled by the same subset. For
example, the subset of roles {E, TO} has access to information labelled {E, TO}.
• The subset of the two team leaders can have access to information labelled G (Hint: Think of upper
Draw a lattice diagram for the above security policy. (3 marks)
Question 6 (6 marks)
Suppose a user study was carried out on 100 people to check the incidence of a rare disease. Jane was one
of the participants. The result of the study showed that 90 out of the 100 people had the disease. Jane was
one of the 10 who did not have the disease. The center who carried out the study made the stats public:
“100 people participated in a study. 90 had disease.” Jane’s nosy neighbour Eve came to know that Jane
was part of the study, and is curious to know if Jane has the disease or not. A few days later, there is a
data breach disclosing the names of 99 participants together with the label indicating whether they had the
disease or not. Luckily, Jane’s name was not in the data breach (the data entry person forgot to enter her
(a) Explain how Eve can find out if Jane has the disease or not. (1 mark)
(b) Suppose instead of publishing the true count 90, the study applied differential privacy on the number of
people with disease by publishing a
0 = 90+Lap(1), where Lap(·) denotes a Laplace random variable of mean
0 and scale 1. Using the numpy.random.laplace(0, 1) from the Python library numpy, show 10 example
outputs of a
. (2 marks)
(c) Noting that the number 100 (the number of study participants) is still public information, explain how
does the above mechanism protect Jane’s privacy even after the data breach. (3 marks)

The post ITEC-852 Advanced System and Network Security Assignment 1 appeared first on mynursinghomeworks.


Source link