Module 6.pdf

Cyber Security [105713] – Notes
Module 6
Security in Evolving Technology: Biometrics, Mobile Computing and Hardening on android and ios, IOT
Security, Web server configuration and Security. Introduction, Basic security for HTTP Applications and
Services, Basic Security for Web Services like SOAP, REST etc., Identity Management and Web Services,
Authorization Patterns, Security Considerations, Challenges.
Open Source/ Free/ Trial Tools: adb for android, xcode for ios, Implementation of REST/ SOAP web
services and Security implementations.
Security in Evolving Technology
Security is a critical concern in all areas of technology, and this is particularly true in rapidly
evolving fields. As new technologies are developed and implemented, there are always new
security risks and vulnerabilities that must be addressed. Here are some key considerations for
security in evolving technology:
Stay up-to-date: It's crucial to stay informed about the latest security threats and trends in your
industry. This includes reading industry publications, attending conferences, and networking with
other professionals. This will help you stay on top of emerging security risks and technologies.
Adopta proactiveapproach:Ratherthanwaiting forsecurity breaches tooccur,adopt a proactive
approach by implementing regular security audits and assessments. This will help you identify
potential vulnerabilities and implement the necessary security measures to prevent attacks.
Choose the right technology: When selecting new technology, be sure to carefully consider its
security implications. Choose technologies that have a strong track record of security, or work
with vendors who can provide robust security features and support.
Train your employees: Employees can be the weakest link in any security program. Make sure
that all employees are trained on best practices for security, including password hygiene, phishing
scams, and other security risks.
Implement robust security protocols: Finally, be sure to implement robust security protocols
across all systems and applications. This may include multi-factor authentication, encryption,
access controls, and monitoring and logging of all system activity.
Biometrics-
This can include fingerprints, facial recognition, iris scans, voice recognition, and more. Biometric
authentication is becoming increasingly popular in many areas, including mobile devices,banking
and finance, and government identification.
One of the key advantages of biometric authentication is its ability to provide strong, convenient,
and secure authentication. Biometric data is unique to each individual and difficult to replicate,
making it a powerful tool for authentication purposes. Biometric authentication can also
eliminate the need for passwords, which are often the weak link in traditional authentication
systems.
However, there are also some concerns around the use of biometrics, particularly around privacy

and security. Biometric data can be sensitive, and if it falls into the wrong hands, it can be used
for identity theft or other malicious purposes. There is also the risk of false positives and false
negatives in biometric authentication systems, which can result in denied access or unauthorized
access.
To address these concerns, it's important to implement robust security measures around
biometricdata.Thismay include encryption,accesscontrols,andmonitoring ofall system activity.
It's also important to have clear policies around the use and storage of biometric data, and to
obtain consent from individuals before collecting and using their biometric data.
Mobile Computing and Hardening on android and ios
Mobile computing has become an integral part of our lives, with smartphones and tablets
becoming the primary computing devices for many people. However, these devices are also
vulnerable to a range of security threats, including malware, phishing attacks, and unauthorized
access. To mitigate these risks, it's important to harden mobile devices, particularly on the
Android and iOS platforms.
Android:
 Keep the operating system and all applications up-to-date to ensure the latest security
patches are installed.
 Install apps only from trusted sources such as Google Play Store.
 Use antivirus software to scan for malware and protect against other security threats.
 Enable the device encryption feature to protect the device data in case of loss or theft.
 Disable developer mode and USB debugging when not in use to prevent unauthorized
access.
iOS:
 Keep the operating system and all applications up-to-date to ensure the latest security
patches are installed.
 Use strong passwords, Face ID, or Touch ID for device authentication.
 Use two-factor authentication for Apple ID and other important accounts.
 Enable the device encryption feature to protect the device data in case of loss or
theft. Limit app permissions and avoid jailbreaking the device, as these canincrease
security risks.
IOT Security-
The Internet of Things (IoT) the network of devices that are connected to the internet and can
communicate with each other. This includes devices such as smart home appliances, medical

devices, and industrial control systems. While IoT has the potential to bring many benefits, it also presents
significant security challenges. Here are some key considerations for IoT security:
Device authentication: It's important to ensure that only authorized devices are able to communicate
with the network. This can be achieved through device authentication, which verifies the identity of the
device before allowing it to connect.
Encryption: All communication between devices should be encrypted to prevent unauthorized access to
sensitive data.
Firmware updates: It's important to keep all IoT devices up-to-date with the latest firmware updates, which
often include security patches to address vulnerabilities.
Access controls: Access to IoT devices and networks should be restricted to authorized users only. This
may include the use of passwords, two-factor authentication, and other access controls.
Monitoring: It's important to monitor all IoT devices and networks for signs of unauthorized access or
unusual activity. This can be achieved through network monitoring and device logs.
Vendor support: When selecting IoT devices, it's important to choose vendors that provide robust security
features and support. This may include regular firmware updates, security patches, and technical support.
We server configuration and security-
Web servers are critical components of web-based applications, and their configuration and security are
essential to the performance and security of these applications. Here are some key considerations for web
server configuration and security:
Secure protocols: Use secure protocols such as HTTPS to encrypt communication between the web server
and clients.
Access controls: Restrict access to the web server to authorized users only, and use strong authentication
mechanisms such as passwords, two-factor authentication, and public key infrastructure (PKI).
Firewall: Use a firewall to restrict access to the web server from the internet, and configure it to block
traffic from unauthorized sources.
Server hardening: Configure the server to only run necessary services and software, and disable
unnecessary services and ports to minimize the attack surface.
File permissions: Set file permissions to restrict access to files and directories to only authorized users,
and configure permissions to limit the actions that can be performed on files.
Regular updates: Keep the web server software and operating system up-to-date with the latest security
patches and updates to minimize vulnerabilities.
Monitoring: Regularly monitor the web server logs and other security-related events to detect and
respond to security incidents.
Backups:Regularly backup the web server and its data to ensure that it can be restored in case ofa security
incident or other disaster.
IoT security presents significant challenges, but by following best practices such as device authentication,
encryption, firmware updates, access controls, monitoring, and vendor support, organizations can help
mitigate these risks and ensure the security of their IoT networks and devices.
Introduction, Basic security for HTTP Applications and services-
HTTP (Hypertext TransferProtocol) is the protocolusedby webbrowsers and web servers to communicate

and transfer data over the internet. HTTP applications and services, such as web servers and web
applications, are critical components of modern internet-based services.
However, they are also frequent targets of cyberattacks due to their accessibility and popularity. Basic
security measures can help protect these applications and services from attacks.
Basic security for HTTP Applications and Services:
Use HTTPS: Use HTTPS instead of HTTP to encrypt communication between the web server and clients.
HTTPS helps protect against man-in-the-middle attacks and ensures data privacy and integrity.
Input validation: Validate all user input to prevent input-based attacks such as SQL injection and cross-
site scripting (XSS).
Authentication and Authorization: Use strong authentication mechanisms such as passwords, two-factor
authentication, and PKI, to verify the identity of users accessing the application or service. Use
authorization mechanisms to limit the actions that authorized users can perform.
Server hardening: Configure the server to only run necessary services and software, and disable
Regular updates: Keep the application or service software and operating system up-to-date with the
latest security patches and updates to minimize vulnerabilities.
Error handling: Implement proper error handling to avoid the exposure of sensitive information, such as
file paths and database schema, to attackers.
Access controls: Restrict access to the application or service to authorized users only, and use access
controls to limit the actions that authorized users can perform.
Monitoring: Regularly monitor the application or service logs and other security-related events to detect
and respond to security incidents.
Basic security measures for HTTP applications and services include using HTTPS, input
validation, authentication and authorization, server hardening, regular updates, error handling,
access controls, and monitoring. By following these practices, organizations can help ensure the
security of their HTTP applications and services and protect against cyberattacks.
Basic Security for Web Services like SOAP, REST
Web services such as SOAP (Simple Object Access Protocol) and REST (Representational State Transfer)
are widely used for exchanging data between applications and services. They use the HTTP protocol to
transfer data, making them vulnerable to various attacks such as injection attacks, session hijacking, and
denial of service (DoS) attacks. Basic security measures can help protect these web services from attacks.
Basic Security for SOAP and REST:
 Use HTTPS: Use HTTPS instead of HTTP to encrypt communication between the web service
and clients. HTTPS helps protect against man-in-the-middle attacks and ensures data privacy
and integrity.
 Authentication and Authorization: Use strong authentication mechanisms such as passwords,
two-factor authentication, and PKI, to verify the identity of users accessing the web service. Use
authorization mechanisms to limit the actions that authorized users can perform.
 Input validation: Validate all user input to prevent input-based attacks such as SQL injection
and cross-site scripting (XSS).
 Server hardening: Configure the server to only run necessary services and software, and disable

 Regular updates: Keep the web service software and operating system up-to-date with the
latest security patches and updates to minimize vulnerabilities.
 Error handling: Implement proper error handling to avoid the exposure of sensitive
information, such as file paths and database schema, to attackers.
 Access controls: Restrict access to the web service to authorized users only, and use access
controls to limit the actions that authorized users can perform.
 Rate limiting: Implement rate limiting to prevent DoS attacks and limit the amount of traffic
that can be sent to the web service.
 Monitoring: Regularly monitor the web service logs and other security-related events to detect
and respond to security incidents.
Basic security measures for web services like SOAP and REST include using HTTPS, authentication and
authorization, input validation, server hardening, regular updates, error handling, access controls, rate
limiting, and monitoring. By following these practices, organizations can help ensure the security of their
web services and protect against cyberattacks.
Identity Management and Web services-
Identity management is the process of managing user identities and access to resources within an
organization. With the increasing use of web services, identity management has become a critical
component in ensuring the security of these services.
Web services use various protocols such as SOAP and REST to communicate and transfer data between
applications and services. Identity management can be used in conjunction with these protocols to ensure
secure access to web services.
Here are some best practices for identity management in web services:
Authentication: Use strong authentication mechanisms to verify the identity of users accessing the web
service. This can include passwords, two-factor authentication, and PKI.
Authorization: Use authorization mechanisms to limit the actions that authorized users can perform. This
can include role-based access control (RBAC) and attribute-based access control (ABAC).
Single Sign-On (SSO): Implement SSO to allow users to access multiple web services with a single set of
credentials. This can improve user experience and reduce the risk of credential- based attacks.
Federated Identity: Implement federated identity to enable users to access web services across different
organizations and domains using their own identities.
Identity and Access Management (IAM) Solutions: Implement IAM solutions to automate the
management of user identities and access to web services. This can include solutions such as identity
provisioning, access request and approval workflows, and policy-based access control.
Security Standards: Use security standards such as OAuth and OpenID Connect to ensure secure access
to web services.
Encryption: Use encryption to protect sensitive data transmitted between applications and services, and
to prevent unauthorized access to web services.
Identity management is crucial for ensuring the security of web services. Best practices for identity
management in web services include using strong authentication and authorization mechanisms,
implementing SSO and federated identity, using IAM solutions, adhering to security standards, and using
encryption.

Authorization Patterns-
Authorization patterns are used to implement access control for resources in an application or system.
They are used to determine whether a user or entity has the necessary permissions to perform a specific
action or access a specific resource. Authorization patterns can be implemented in various ways
depending on the application or system requirements.
Here are some common authorization patterns:
Role-Based Access Control (RBAC): RBAC is a popular authorization pattern that grants permissions based
on user roles. Users are assigned to roles, and roles are granted permissions to perform specific actions
or access specific resources. This simplifies the management of permissions as roles can be easily added
or removed.
Attribute-Based Access Control (ABAC): ABAC is an authorization pattern that grants permissions based
on attributes associated with the user or entity requesting access. For example, access may be granted
based on the user's location, job title, or department.
Rule-Based Access Control (RBAC): RBAC is an authorization pattern that grants permissions based on
predefined rules. Rules can be defined based on various criteria such as user roles, attributes, and
resource types.
Discretionary Access Control (DAC): DAC is an authorization pattern that grants permissions to the owner
of a resource to decide who can access it. This is commonly used in file systems, where file owners can
set permissions for other users or groups to access the file.
Mandatory Access Control (MAC): MAC is an authorization pattern that grants permissions based on
security labels assigned to resources and users. The security labels define the level of security clearance
required to access a resource.
Role-Based Access Control with Hierarchies (RBACH): RBACH is an extension of RBAC that includes
hierarchies within the roles. This allows for more granular control over permissions and can be useful in
organizations with complex structures.
Attribute-Based Access Control with Context (ABAC-CTX): ABAC-CTX is an extension of ABAC that
includes contextual information such as time of day, location, and device used. This allows for more fine-
grained control over permissions and can be useful in applications where access needs to be restricted
based on contextual information.
Authorization patterns are used to implement access control for resources in an application or system.
Common authorization patterns include RBAC, ABAC, RBAC with hierarchies, ABAC with context, DAC, and
MAC. The choice of authorization pattern will depend on the application or system requirements and the
level of granularity required for access control.
Security Considerations-
Security considerations are an essentialpart of developing any software or system. They involve identifying
potential security threats and vulnerabilities, and implementing measures to mitigate those risks. Here are
some important security considerations to keep in mind:
Authentication and Authorization: Implement strong authentication and authorization mechanisms to
ensure that only authorized users can access the system or data. This may include multi-factor
authentication, role-based access control, and encryption of sensitive data.
Input Validation: Validate all inputs to the system, including user inputs and data from external sources,
to prevent injection attacks such as SQL injection and cross-site scripting (XSS).

Secure Communication: Use secure communication protocols such as HTTPS, SSL/TLS, and SSH to protect
data transmitted over networks and prevent eavesdropping, tampering, and other attacks.
Data Protection: Implement appropriate data protection mechanisms such as encryption, hashing, and
obfuscation to protect sensitive data at rest and in transit.
Security Testing: Conduct regular security testing, including penetration testing and vulnerability
scanning, to identify and address potential security issues.
Updates and Patches: Keep the software and system up-to-date with the latest security patches and
updates to address known vulnerabilities and bugs.
Access Control: Implement strong access controls to restrict access to sensitive resources and data to
authorized personnel only.
Logging and Monitoring: Implement logging and monitoring mechanisms to track user activities and
detect potential security incidents.
Disaster Recovery and Business Continuity: Implement disaster recovery and business continuity plans to
ensure that the system can recover from security incidents and maintain operations in the event of a
disaster.
Security considerations are crucial in developing and maintaining secure software and systems. Best
practices include implementing strong authentication and authorization, input validation, secure
communication, data protection, security testing, updates and patches, access control, logging and
monitoring, and disaster recovery and business continuity plans.
Challenges-
There are several challenges associated with implementing and maintaining security in software and
systems. Here are some of the most common challenges:
Complexity:As systems become more complex, it becomes more difficult to identify and mitigatepotential
security risks. Complex systems may have multiple layers of hardware and software, and interactions
between these layers can create vulnerabilities that are difficult to detect and address.
Rapid Development: The pressure to develop software quickly can lead to security being overlooked or
deprioritized. Developers may not have the time or resources to thoroughly test forsecurity issues, leaving
the system vulnerable to attacks.
Lack of Awareness: Many developers and users may not be fully aware of the security risks associated
with their software or systems. This can lead to poor security practices and increased vulnerability to
attacks.
Constantly Evolving Threats: Security threats are constantly evolving, and attackers are constantly
developing new techniques to exploit vulnerabilities. This means that software and systems must be
constantly updated and maintained to keep up with the latest threats.
User Behavior: User behavior can also create security challenges, as users may inadvertently introduce
vulnerabilities through their actions. For example, users may click on phishing links, use weak passwords,
or share sensitive information via insecure channels.
Legacy Systems: Legacy systems can also present security challenges, as they may be built on outdated
technology and lack the latest security features. Upgrading or replacing these systems can be difficult and
costly, but leaving them in place can create security risks.
Compliance: Many industries and regulatory bodies have strict security compliance requirements that

must be met. Ensuring compliance can be challenging, as it may require significant resources and may be
subject to changing regulations.
In implementing and maintaining security in software and systems can be challenging due to the
complexity of systems, the pressure to develop software quickly, a lack of awareness of security risks,
evolving threats, user behavior, legacy systems, and compliance requirements. It is important to address
these challenges proactively and implement best practices for security to mitigate potential risks.
Open Source/Free/Trial Tools:
Adb for android-
ADB (Android Debug Bridge) is a command-line tool that is part of the Android SDK (Software
Development Kit). ADB allows developers to interact with an Android device over a USB connection,
enabling them to install, debug, and test applications directly on the device.
Here are some common uses of ADB for Android:
Installing Applications: Developers can use ADB to install applications on an Android device directly from
their computer.
Debugging Applications: Developers can use ADB to debug applications running on an Android device,
allowing them to identify and fix bugs.
Accessing theAndroidShell: ADB provides access tothe Androidshell,which allows developers to execute
commands on the device.
Copying Files: ADB can be used to copy files between a computer and an Android device, making it easy
to transfer data between the two.
Taking Screenshots: ADB can be used to take screenshots of an Android device, which can be helpful for
debugging and testing.
It's important to note that ADB can also be a security risk if not used properly. By default, ADB is enabled
on Android devices, which means that anyone with physical access to the device can use ADB to access
its data and control its functions. Therefore, it's important to disable ADB when not in use and only enable
it for authorized users. Additionally, it's important to only use ADB commands from trusted sources to
avoid installing malware or other malicious software on the device.
xcode for ios-
Xcode is an integrated development environment (IDE) for iOS and macOS app development. It is
developed by Apple and includes a suite of tools for building, testing, and deploying iOS apps.
Here are some key features of Xcode for iOS:
Interface Builder: Xcode includes a graphical interface builder that allows developers to visually design
user interfaces for their iOS apps.
Code Editor: Xcode's code editor includes features such as syntax highlighting, code completion, and
code folding to help developers write code more efficiently.
Simulator: Xcode includes a simulator that allows developers to test their iOS apps on a virtual device
without needing an actual iPhone or iPad.
Debugger: Xcode includes a powerful debugger that allows developers to identify and fix bugs in their

iOS apps.
Instruments: Xcode includes a suite of performance analysis tools called Instruments that help developers
identify performance issues in their iOS apps.
Source Control: Xcode includes built-in support for source control, making it easy for developers to
manage versions of their code and collaborate with others.
App Distribution: Xcode includes tools for deploying iOS apps to the App Store or to devices for testing
and development purposes.
Overall, Xcode is a powerful tool for iOS app development that includes a wide range of features to help
developers build, test, and deploy high-quality iOS apps.
Implementation of REST/ SOAP web services and Security Implementation.
To implement RESTful web services, developers typically follow a set of best practices that include the
following steps:
Define resources: Identify the resources that the API will expose, such as users, products, or orders.
Define HTTP methods: For each resource, define the HTTP methods that will be used to perform
operations on the resource, such as GET, POST, PUT, and DELETE.
Define resource URIs: Define the URI for each resource, which is the URL that clients will use to access
the resource. The URI should follow a consistent and meaningful structure.
Implement endpoints: Implement the endpoints for each resource and HTTP method. These endpoints
should perform the appropriate actions on the resource and return the appropriate response codes and
content.
Use HTTP status codes: Use HTTP status codes to indicate the outcome of each API request. This includes
200 OK for successful requests, 400 Bad Request for malformed requests, and 404 Not Found for requests
for nonexistent resources.
Use standard response formats: Use standard response formats, such as JSON or XML, to make the API
consistent and easy to use.
Document the API: Document the API to make it easy for developers to use and understand. This
documentation should include information on how to use the API, the available resources and methods,
and any authentication or security requirements.
In addition to these steps, developers should also consider security measures such as authentication and
encryption to protect the API and its users.
Overall, by following these best practices, developers can create RESTful web services that are scalable,
reliable, and easy to use.
SOAP web services
SOAP (Simple Object Access Protocol) web services are a type of web service that uses the SOAP protocol
to exchange structured data between applications over the internet. SOAP is an XML-based protocol that
uses HTTP or other transport protocols to transmit messages between applications.
SOAP web services have the following characteristics:
Standardized protocol: SOAP is a standardized protocol, which means that it can be used by any
application that supports it.

Supports different data formats: SOAP supports different data formats, including XML, JSON, and binary
data.
Language- and platform-independent: SOAP is language- and platform-independent, which means that
applications written in different languages and running on different platforms can communicate with each
other using SOAP.
Supports message-level security: SOAP supports message-level security mechanisms such as XML
Encryption and XML Signature to ensure the integrity and confidentiality of messages.
Supports RPC-style and document-style messages: SOAP supports two message styles: RPC (Remote
Procedure Call) and document-style messages.
Requires a WSDL file: SOAP web services require a WSDL (Web Services Description Language) file that
describes the interface of the web service.
Can be used with other web service standards: SOAP can be used with other web service standards such
as WS-Addressing and WS-Security.
SOAP web services are widely used in enterprise environments because of their standardized protocol
and support for message-level security mechanisms. However, they can be more complex to implement
and use than other types of web services such as RESTful web services.
Security Implementation-
To implement security for SOAP web services, developers can follow these best practices:
Use secure transport: SOAP messages should be transmitted over a secure transport layer such as SSL/TLS
to prevent eavesdropping and tampering.
Use message-level security: Developers should use message-level security mechanisms such as XML
Encryption and XML Signature to ensure the integrity and confidentiality of SOAP messages.
Implement authentication: Developers should implement authentication mechanisms to ensure that
only authorized users can access the web service. This can be done using basic authentication, token-
based authentication, or SAML (Security Assertion Markup Language).
Implement authorization: Developers should implement authorization mechanisms to ensure that users
can only access the resources they are authorized to access. This can be done using role-based access
control or attribute-based access control.
Validate input: Developers should validate all input parameters to prevent attacks such as SQL injection
or cross-site scripting (XSS).
Implement auditing and logging: Developers should implement auditing and logging
mechanisms to track web service usage and identify any suspicious activity.
Use a WSDL-first approach: Developers should use a WSDL-first approach when implementing SOAP web
services. This involves designing the WSDL file before writing any code, which can help ensure that the web
service is properly secured and that the interface is well-defined.
These best practices, developers can ensure that their SOAP web services are secure, reliable, and can be
used to build robust and scalable applications.

Module 6.pdf

Recommended

Recommended

More Related Content

Similar to Module 6.pdf

Similar to Module 6.pdf (20)

More from Sitamarhi Institute of Technology

More from Sitamarhi Institute of Technology (20)

Recently uploaded

Recently uploaded (20)

Module 6.pdf