ICT338: Samuel the system administrator has discovered malicious remote connection(s) activities while performing: Information Security Challenges in Smart Computing Assignment, SUSS, Singapore, Singapore

Question 1
Samuel the system administrator has discovered malicious remote connection(s) activities while performing a routine check on his company web server’s log. He had retrieved a Wireshark capture of the malicious network activities for further investigation. Apply the use of Wireshark and assess the given network traffic ICT338 2023 ECA Q1.pcap and answer all the questions below. Explanation and screenshots of the evidence from the Wireshark application must be provided together with the answers.
i. What is the web server’s IP address?
ii. What is the attacker’s IP address?
iii. What technique is attacker using to gain remote access to the victim server? Provide the transport layer protocol and port number used by the attacker for the malicious connection.
iv. What operating system and version is running on the web server?
v. What is the name of the malicious script used by the attacker?

Question 2
You are working on an IoT pilot project that involves collecting temperature and humidity data from a network of temperature and humidity sensors. There are three types of sensors. Temperature sensor type T-U1, temperature type T-E2, and humidity sensor type H-S1. Temperature sensor type T-U1 measures temperature to the nearest ºF, temperature sensor type T-E2 measures temperature to the nearest 0.1 ºC and humidity sensor H-S1 measures humidity levels to the nearest %. Each sensor sends a message to a central server in the format as shown in the following.

Question 2a
Write a regular expression that can be used to determine the validity of received messages.
Question 2b
Demonstrate the effectiveness of the proposed regular expression using
www.regex101.com or any other regular expression testing tools using appropriate test data. Include screenshots of your testing and provide explanation on the test results.
Question 2c
6 months after the project, it was reported that environmental data was stolen from the network while it is being transmitted from the sensors to the server. The management has decided that encryption of data-in-motion should be implemented. Recommend an encryption type (symmetric or asymmetric) and assess the merits of your recommendation.

Question 3
A ride sharing company called Ubber is planning to launch a smart ride sharing
application with an initial user base of 50,000 in Singapore. The eventual goal is to expand this application to the rest of Southeast Asia spanning 10 countries with a targeted user base of 50 million users.

Question 3a
With reference to the Figure Q3, appraise the key capabilities required and explain why these capabilities are required for the success of the ride sharing application

Question 3b
One month after the launch, the ride sharing application was hacked when hackers successfully stole the system administrator password via phishing. As a result, the personal details of users were stolen and released on the Internet onto a Google document by hackers. As this Google document was shared to the public with full permission, some of the users’ details were modified or deleted. Subsequently, this document was deleted by Google upon request by Ubber. Evaluate the impact of this hacking incident to Ubber using the CIA model.
Question 3c
Suggest FOUR (4) countermeasures to reduce the impact of future reoccurrence of similar hacking incident in Q3(b). Critique the effectiveness of the suggested countermeasures.

Question 4
Due to an expansion of Kalang Kabut (KK) Hospital, a cloud-based patient
management system (Figure Q4(a)) has been commissioned to replace the previous inhouse system based on a client-server architecture (Figure Q4(b)).

Question 4a
Based on the diagrams provided, critique FOUR (4) advantages of the cloud-based patient management system over the previous client-server-based system.