SlideShare a Scribd company logo
Wireless Security
and Mobile Devices
Chapter 12
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Objectives
Describe the different wireless systems in use today.
Detail WAP and its security implications.
Identify 802.11’s security issues and possible solutions.
Learn about the different types of wireless attacks.
Examine the elements needed for enterprise wireless
deployment.
Examine the security of mobile systems.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
2
Key Terms (1 of 4)
Beacon frames
Bluebugging
Bluejacking
Bluesnarfing
Bluetooth
Bluetooth DoS
Captive portal
Containerization
Custom firmware
Direct-sequence spread spectrum (DSSS)
Disassociation
Extensible Authentication Protocol (EAP)
EAP-FAST
EAP-TLS
EAP-TTLS
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Beacon frames – A series of frames used in WiFi (802.11) to
establish the presence of a wireless network device.
Bluebugging – The use of a Bluetooth-enabled device to
eavesdrop on another person’s conversation using that person’s
Bluetooth phone as a transmitter. The bluebug application
silently causes a Bluetooth device to make a phone call to
another device, causing the phone to act as a transmitter and
allowing the listener to eavesdrop on the victim’s conversation
in real time.
Bluejacking – The sending of unsolicited messages over
Bluetooth to Bluetooth-enabled devices such as mobile phones,
tablets, or laptop computers.
Bluesnarfing – The unauthorized access of information from a
Bluetooth-enabled device through a Bluetooth connection, often
between phones, desktops, laptops, and tablets.
Bluetooth DOS – The use of Bluetooth technology to perform a
denial-of-service attack against another device. In this attack,
an attacker repeatedly requests pairing with the victim device.
This type of attack does not divulge information or permit
access, but is a nuisance. And, more importantly, if done
repeatedly it can drain a device’s battery, or prevent other
operations from occurring on the victim’s device.
Captive portal – A website used to validate credentials before
allowing access to a network connection.
Containerization – Dividing a device into a series of containers,
with one container holding work-related materials and the other
personal materials.
Custom firmware - Firmware for a device that has been altered
from the original factory settings.
Direct-sequence spread spectrum (DSSS) – A method of
distributing a communication over multiple frequencies to avoid
interference and detection.
Disassociation – An attack against a wireless system designed
to disassociate a host from the wireless access point, and from
the wireless network. Disassociation attacks stem from the
deauthentication frame that is in the IEEE 802.11 (Wi-Fi)
standard.
Extensible Authentication Protocol (EAP) – A protocol defined
in RFC 2284 (obsoleted by 3748). The framework is used to
secure the authentication process, not an actual encryption
method. Many variants exist.
EAP-FAST – EAP–Flexible Authentication via Secure
Tunneling is described in RFC-4851 and proposed by Cisco to
be a replacement for LEAP, a previous Cisco version of EAP. It
offers a lightweight, tunneling protocol to enable
authentication. The distinguishing characteristic is the passing
of a Protected Access Credential (PAC) that’s used to establish
a TLS tunnel through which client credentials are verified.
EAP-TLS – An IETF open standard (RFC 5216) that uses the
Transport Layer Security (TLS) protocol to secure the
authentication process. This is still considered one of the most
secure implementations, primarily because common
implementations employ client-side certificates.
EAP-TTLS – An extension of TLS called Tunneled TLS. In
EAP-TTLS, the authentication process is protected by the tunnel
from man-in-the-middle attacks, and although client certificates
can be used, they are not required, making this easier to set up
than EAP-TLS for clients without certificates.
3
Key Terms (2 of 4)
Evil twin
Firmware OTA updates
Geo-tagging
IEEE 802.1X
Infrared (IR)
Initialization vector (IV)
Jailbreaking
Jamming
MAC filtering
MIMO
Mobile device management (MDM)
Multimedia Messaging Service (MMS)
Near field communication (NFC)
Orthogonal frequency division multiplexing (OFDM)
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Evil twin – A wireless attack performed using a second, rogue
wireless access point designed to mimic a real access point.
Firmware OTA updates - A solution of updating mobile device

Recommended for you

Wi fi technology
Wi fi technologyWi fi technology
Wi fi technology

This document provides an overview of Wi-Fi technology, including its standards, network elements, configurations, applications, security threats and advantages/disadvantages. It discusses the IEEE 802.11b, 802.11a and 802.11g wireless standards and how they operate at different speeds and frequencies. It describes the basic components of a Wi-Fi network including access points and Wi-Fi cards. It also summarizes different Wi-Fi network topologies and security threats like eavesdropping, man-in-the-middle attacks and denial-of-service.

Wlan security
Wlan securityWlan security
Wlan security

This document discusses wireless LAN security. It describes various wireless LAN technologies and standards. It then discusses some common security issues with wireless LANs like war driving, eavesdropping, denial of service attacks, and rogue access points. It provides solutions for each security issue, such as using encryption, VPNs, firewalls, and tools to detect rogue access points.

Iot(security)
Iot(security)Iot(security)
Iot(security)

the ppt describes about the basics of iot,its applications, security challenges , hacks and the solutions to the security challenges

firmware without bringing the device to a central location or
connection for updating.
Geo-tagging – The metadata that contains location-specific
information that is attached to other data elements.
IEEE 802.1X – An IEEE standard for performing authentication
over networks.
Infrared (IR) – A band of electromagnetic energy just beyond
the red end of the visible color spectrum.
Initialization vector (IV) – A data value used to seed a
cryptographic algorithm, providing for a measure of
randomness.
Jailbreaking – The process of breaking OS security features
designed to limit interactions with the OS itself. Commonly
performed on mobile phones to unlock features or break locks to
carriers.
Jamming – A form of denial of service, specifically against the
radio spectrum aspect of wireless. Just as other DoS attacks can
manipulate things behind the scenes, so can jamming on a
wireless AP, enabling things such as attachment to a rogue AP.
MAC filtering – The use of layer 2 MAC addresses to filter
traffic to only authorized NIC cards.
MIMO – A set of multiple-input and multiple-output antenna
technologies where the available antennas are spread over a
multitude of independent access points each having one or
multiple antennas.
Mobile device management (MDM) – A marketing term for a
collective set of commonly employed protection elements
associated with mobile devices.
Multimedia Messaging Service (MMS) – A standard protocol
used to send messages, including multimedia content to and
from mobile devices over a cellular network.
Near field communication (NFC) – A set of standards and
protocols for establishing a communication link over very short
distances. Used in mobile devices.
Orthogonal frequency division multiplexing (OFDM) –
Multiplexes, or separates, the data to be transmitted into smaller
chunks and then transmits the chunks on several subchannels.
This use of subchannels is what the “frequency division”
portion of the name refers to. Both of these techniques,
multiplexing and frequency division, are used to avoid
interference. Orthogonal refers to the manner in which the
subchannels are assigned, principally to avoid crosstalk, or
interference with your own channels.
4
Key Terms (3 of 4)
PEAP
Radio Frequency Identification (RFID)
RC4 stream cipher
Remote wiping
Replay attack
Rogue access point
Rooting
Screen locking
Service set identifier (SSID)
Short Message Service (SMS)
Sideloading
Site survey
Storage segmentation
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
PEAP – Protected EAP, was developed to protect the EAP
communication by encapsulating it with TLS. This is an open
standard developed jointly by Cisco, Microsoft, and RSA. EAP
was designed assuming a secure communication channel. PEAP
provides that protection as part of the protocol via a TLS
tunnel. PEAP is widely supported by vendors for use over
wireless networks.
Radio Frequency Identification (RFID) – RFID tags are used in
a wide range of use cases. From tracking devices to tracking
keys, the unique serialization of these remotely sensible devices
has made them useful in a wide range of applications. RFID tags
come in several different forms and can be classified as either
active or passive.
RC4 stream cipher – A stream cipher used in TLS and WEP.
Remote wiping – An action that typically removes data stored
on the device and resets the device to factory settings.
Replay attack – An attack that occurs when the attacker
captures a portion of a communication between two parties and
retransmits it at a later time.
Rogue access point – An unauthorized access point inserted into
a network allowing unauthorized wireless access.
Rooting – A process whereby OS controls are bypassed. This is
the term frequently used for Android devices.
Screen locking – A phone’s capability whereby one must enter a
passcode or PIN to unlock the device. It is highly recommended
that screen locks be enforced for all mobile devices.
Service set identifier (SSID) – Identifies a specific 802.11
wireless network. It transmits information about the access
point to which the wireless client is connecting.
Short Message Service (SMS) – A standard protocol used to
send messages to and from mobile devices over a cellular
network. SMS is limited to short text-only messages of less than
160 characters and is carried over the signaling path of the
cellular network when signaling data is not being sent.
Sideloading – The process of adding apps to a mobile device
without using the authorized store associated with the device.
Site survey – Involves several steps: mapping the floor plan,
testing for RF interference, testing for RF coverage, and
analysis of material via software.
Storage segmentation – A processes similar to containerization
in that it represents a logical separation of the storage in the
unit.
5
Key Terms (4 of 4)
Temporal Key Integrity Protocol (TKIP)
USB OTG (USB On-The-Go)
WAP gap
War-chalking
War dialing
War driving
Wi-Fi Protected Access 2 (WPA2)
WiMAX
Wired Equivalent Privacy (WEP)
Wireless Application Protocol (WAP)
Wireless Transport Layer Security (WTLS)
ZigBee
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Temporal Key Integrity Protocol (TKIP) – A security protocol
used in 802.11 wireless networks.
USB OTG (USB On-The-Go) – An extension of USB technology
that facilitates direct connection between USB OTG–enabled
mobile devices.
WAP gap – Refers to the confidentiality of information where
the two different networks meet on the WAP gateway.
War-chalking – The act of using chalk on sidewalks to mark
some of the wireless networks people have found.
War dialing – The process of dialing a list of phone numbers
looking for modem-connected computers.

Recommended for you

The Risks and Security Standards of WLAN Technologies: Bluetooth and Wireles...
The Risks and Security Standards of WLAN Technologies:  Bluetooth and Wireles...The Risks and Security Standards of WLAN Technologies:  Bluetooth and Wireles...
The Risks and Security Standards of WLAN Technologies: Bluetooth and Wireles...

This document discusses the risks and security standards of two wireless local area network technologies: Bluetooth and Wi-Fi. It provides an overview of how each technology works and its vulnerabilities. Both Bluetooth and Wi-Fi are susceptible to attacks like eavesdropping, man-in-the-middle attacks, and denial of service attacks. The document outlines security protocols and standards developed for each technology, including WEP, WPA, WPA2, and Bluetooth's pairing and encryption processes. It also describes different types of attacks targeting each technology like bluejacking, bluesnarfing, and WAPkitting. The goal of the document is to educate about the risks of these wireless technologies and how security standards aim to address vulnerabilities.

Wsn
WsnWsn
Wsn

Wireless sensor networks combine sensing, computation, and communication capabilities into small sensor nodes. A wireless sensor network is composed of multiple sensor nodes that are deployed to monitor physical or environmental conditions like temperature, sound, or pollution levels. These sensor nodes communicate wirelessly to pass sensed data to a central location. While wireless sensor networks provide cost-effective monitoring of remote or inaccessible areas, security measures must be implemented to protect the confidentiality, integrity, and availability of communications from various attacks.

sasikumar
Mobile Device Security
Mobile Device SecurityMobile Device Security
Mobile Device Security

Mobile device security presents challenges as confidential data is most vulnerable when stored on or transmitted to mobile devices. Key risks include stolen devices or information, unauthorized access to networks or applications, and virus propagation. Effective security requires securing devices, encrypting data, implementing access controls, securing wireless interfaces like Bluetooth and WLAN, and establishing perimeter defenses like VPNs. Enterprises also need centralized management of policies, configurations, and user compliance to securely support employee mobility.

mobilitysecurity
War driving – The act of driving around with a wireless locater
program recording the number of networks found and their
locations.
Wi-Fi Protected Access 2 (WPA2) – A protocol to secure
wireless communications using a subset of the 802.11i standard.
WiMAX – A wireless band that refers to the set of 802.16
wireless network standards ratified by the WiMAX Forum.
Wired Equivalent Privacy (WEP) – An 802.11 protocol that uses
a cipher to encrypt the data as it is transmitted through the air.
Wireless Application Protocol (WAP) – A lightweight protocol
designed for mobile devices.
Wireless Transport Layer Security (WTLS) – A lightweight
security protocol designed for WAP.
ZigBee – A low-power, personal area networking technology
described by the IEEE 802.15.4 series.
6
Introduction to Wireless Networking (1 of 3)
Wireless networking is the transmission of packetized data by
means of a physical topology that does not use direct physical
links.
Bluetooth is a short-range wireless protocol typically used on
small devices such as mobile phones.
Wireless is problematic from a security standpoint.
Wireless does away with the physical limitations.
If attacker gets close enough to signal’s source he can listen to
the access point and clients talking in order to capture all the
packets for examination.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
The IEEE 802.11 protocol has been standardized by the IEEE
for wireless local area networks (LANs). Three versions are
currently in production—802.11g, 802.11a, and 802.11n. The
latest standard is 802.11ac, but it provides backward
compatibility with 802.11g hardware. Cellular phone technology
has moved rapidly to embrace data transmission and the
Internet.
The Wireless Application Protocol (WAP) was one of the
pioneers of mobile data applications, but it has been overtaken
by a variety of protocols pushing us to fourth-generation (4G)
mobile networks.
Bluetooth is a short-range wireless protocol typically used on
small devices such as mobile phones. Early versions of these
phones also had Bluetooth on and discoverable as a default,
making the compromise of a nearby phone easy. Security
research has focused on finding problems with these devices
simply because the devices are so common.
7
Introduction to Wireless Networking (2 of 3)
There are several different wireless bands in common use today.
Wi-Fi series refers to the 802.11 Wireless LAN standards
certified by the Wi-Fi Alliance.
WiMAX refers to the set of 802.16 wireless network standards
ratified by the WiMAX Forum.
ZigBee is a low-power, personal area networking technology
described by the IEEE 802.15.4 series.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Tech Tip: There are several different wireless bands in common
use today, the most common of which is the Wi-Fi series,
referring to the 802.11 Wireless LAN standards certified by the
Wi-Fi Alliance. Another set of bands is WiMAX, which refers
to the set of 802.16 wireless network standards ratified by the
WiMAX Forum. Lastly, there is ZigBee, a lowpower, personal
area networking technology described by the IEEE 802.15.4
series.
8
Introduction to Wireless Networking (3 of 3)
Figure 12.1 Wireless transmission extending beyond the
facility’s walls
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
If an attacker can get close enough to the signal’s source as it is
being broadcast, he can at the very least listen to the access
point and clients talking to capture all the packets for
examination, as depicted in this figure.
Attackers can also try to modify the traffic being sent or try to
send their own traffic to disrupt the system. In this chapter, you
will learn about the different types of attacks that wireless
networks face.
9
Mobile Phones (1 of 2)
Today’s smartphones support multiple wireless data access
methods.
This includes 802.11, Bluetooth, and cellular.
The Wireless Application Protocol (WAP) attempted to satisfy
the needs for more data on mobile devices, but it is falling by
the wayside as the mobile network capabilities increase.
The need for more and more bandwidth has pushed carriers to
adopt a more IP-centric routing methodology.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
The need for more and more bandwidth has pushed carriers to
adopt a more IP-centric routing methodology with technologies
such as High Speed Packet Access (HSPA) and Evolution Data
Optimized (EVDO). Mobile phones have ruthlessly advanced
with new technologies and services, causing phones and the
carrier networks that support them to be described in
generations—1G, 2G, 3G, and 4G. 1G refers to the original
analog cellular standard, Advanced Mobile Phone System
(AMPS). 2G refers to the digital network that superseded it. 3G
is the system of mobile networks that followed, with many
different implementations carrying data at up to 400 Kbps. 4G
represents the current state of mobile phones with LTE being
the primary method. 4G allows carriers to offer a wider array of
services to the consumer, including broadband data service up
to 14.4 Mbps and video calling. 4G is also a move to an entirely
IP-based network for all services, running voice over IP (VoIP)
on your mobile phone and speeds up to 1 Gbps.
All of these “gee-whiz” features are nice, but how secure are
your bits and bytes going to be when they’re traveling across a
mobile carrier’s network? All the protocols mentioned have
their own security implementations—WAP applies its own
Wireless Transport Layer Security (WTLS) to attempt to secure

Recommended for you

Wireless Security Needs For Enterprises
Wireless Security Needs For EnterprisesWireless Security Needs For Enterprises
Wireless Security Needs For Enterprises

This document discusses improving wireless security for enterprise/corporate users compared to home users. It analyzes security threats like encryption attacks and outlines techniques like WEP, WPA, and WPA2. The key points are: 1) Wireless networks are vulnerable to attacks using tools like AirSnort but techniques like WPA2 with AES encryption provide stronger security. 2) Corporate networks require robust security as they contain sensitive customer data, while basic techniques like WEP may suffice for home networks. 3) The document recommends home users enable security settings and use WPA-PSK encryption to protect their wireless networks.

Iot Security
Iot SecurityIot Security
Iot Security

The document discusses Internet of Things (IoT) security challenges and countermeasures. It begins with basics of IoT and sensors, then discusses how IoT connects to the internet. It outlines several approaches to securing IoT, including restricted access, encryption of network and data, managing default APIs, addressing human elements of security, and learning from past exploits. Specific threats like denial of service attacks, man-in-the-middle attacks, and brute force/dictionary attacks are examined. The document concludes that IoT security design must enable open yet secure infrastructure while respecting user privacy through individual policies.

securityiot
Fa13 7718-ch7 9-singh
Fa13 7718-ch7 9-singhFa13 7718-ch7 9-singh
Fa13 7718-ch7 9-singh

This document summarizes key concepts from chapters 7 and 9 on computer networks and cybercrime. It discusses fundamentals of networking including definitions of LANs and WANs. Advantages of networks include sharing resources while disadvantages include viruses and hacking. Networks are classified by types including PAN, LAN, MAN, WAN and HAN. The TCP/IP model and OSI model are explained through their layers. Examples of networking components, internet connections, and securing wireless networks are provided. Cybercrime such as identity theft and computer viruses are discussed alongside social engineering techniques like phishing.

data transmissions, but WAP still has issues such as the “WAP
gap” (as discussed next). 3G networks have attempted to push a
large amount of security down the stack and rely on the
encryption designed into the wireless protocol.
10
Mobile Phones (2 of 2)
Early cell phones just allowed you to make calls.
Today’s phones allow you to carry computers in your pocket.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
When cellular phones first hit the market, security wasn’t an
issue—if you wanted to keep your phone safe, you’d simply
keep it physically secure and not loan it to people you didn’t
want making calls. Its only function was that of a telephone.
The advance of digital circuitry has added amazing power in
smaller and smaller devices, causing security to be an issue as
the software becomes more and more complicated. Today’s
small and inexpensive products have made the wireless market
grow by leaps and bounds, as traditional wireless devices such
as cellular phones and pagers have been replaced by tablets and
smartphones.
11
Wireless Application Protocol (1 of 5)
WAP was introduced to compensate for the relatively low
amount of computing power on handheld devices as well as the
generally poor network throughput of cellular networks.
Wireless Transport Layer Security (WTLS) encryption scheme
encrypts the plaintext data and then sends it over the airwaves
as ciphertext.
The originator and the recipient both have keys to decrypt the
data and reproduce the plaintext.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
12
Wireless Application Protocol (2 of 5)
WTLS uses a modified version of the Transport Layer Security
(TLS) protocol.
WTLS supports several bulk encryption algorithms.
WTLS implements integrity through the use of message
authentication codes (MACs).
The TLS protocol that WTLS is based on is designed around
Internet-based computers.
WTLS must cope with small amounts of memory and limited
processor capacity.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
13
Wireless Application Protocol (3 of 5)
The WTLS protocol is designed around more capable servers
than devices and can allow connections with little to no
security.
Clients with low memory or CPU capabilities cannot support
encryption which greatly reduces confidentiality.
Authentication is optional and omitting it leaves the connection
vulnerable to a man-in-the-middle–type attack.
General flaws in the protocol’s implementation exist.
Known security vulnerabilities include the chosen plaintext
attack, the PKCS #1 attack, and the alert message truncation
attack.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
14
Wireless Application Protocol (4 of 5)
The chosen-plaintext attack works on the principle of a
predictable initialization vector (IV).
Concern over the WAP gap involves confidentiality of
information where the two different networks meet the WAP
gateway.
WTLS acts as the security protocol for the WAP network, and
TLS is the standard for the Internet.
The WAP gateway has to perform translation from one
encryption standard to the other.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
15
Wireless Application Protocol (5 of 5)
Figure 12.2 The WAP gap shows an unencrypted space between
two enciphered connections.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Some concern over the so-called WAP gap involves
confidentiality of information where the two different networks
meet, the WAP gateway, as shown in this figure.
16
3G Mobile Networks
Several competing data transmission standards, such as HSPA
and EVDO, exist for 3G networks.
All standards include transport layer encryption protocols to
secure the voice traffic traveling across the wireless signal as
well as the data sent by the device.
KASUMI is the proposed 3G cryptographic standard.
This modified version of the MISTY1 algorithm uses 64-bit
blocks and 128-bit keys.
Multiple attacks have been launched against this cipher.

Recommended for you

Latest Developments in WirelessNetworking and Wireless Security
Latest Developments in WirelessNetworking and Wireless SecurityLatest Developments in WirelessNetworking and Wireless Security
Latest Developments in WirelessNetworking and Wireless Security

This document discusses recent developments in wireless networking and wireless security. It describes enhancements to wireless standards including 802.11ac which provides speeds up to 1 Gbps, 802.11n which provides speeds up to 600 Mbps, and research achieving speeds of 40 Gbps over 1 km. It also discusses DARPA's efforts to develop more resilient military wireless networks and Google's plans to expand wireless networks in developing areas. The document outlines various methods for securing wireless networks including using WPA2 encryption, changing default passwords, hiding the SSID, limiting DHCP assignments, and disabling remote administration.

802.11acwpa2802.11
Research Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and ScienceResearch Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and Science

Research Inventy : International Journal of Engineering and Science is published by the group of young academic and industrial researchers with 12 Issues per year. It is an online as well as print version open access journal that provides rapid publication (monthly) of articles in all areas of the subject such as: civil, mechanical, chemical, electronic and computer engineering as well as production and information technology. The Journal welcomes the submission of manuscripts that meet the general criteria of significance and scientific excellence. Papers will be published by rapid process within 20 days after acceptance and peer review process takes only 7 days. All articles published in Research Inventy will be peer-reviewed.

reviews: submissions of reviews and perspectives c
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...

The document discusses security attacks on wireless sensor networks, describing various types of attacks like jamming, impersonation, replay attacks, and denial of service attacks that can occur at different layers of the network. It analyzes key security objectives for wireless sensor networks like availability, authentication, integrity, and confidentiality. The document also outlines the architecture of wireless sensor networks, including the five layers of the OSI model and three cross-layer planes, and components of sensor nodes.

irjet
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Our cell phones are one of the most visible indicators of
advancing technology. Within recent memory, we were forced
to switch from old analog phones to digital models. The
networks have been upgraded to 3G, greatly enhancing speed
and lowering latency. This has reduced the need for lightweight
protocols to handle data transmission, and more standard
protocols such as IP can be used. The increased power and
memory of the handheld devices also reduce the need for
lighter-weight encryption protocols. This has caused the
protocols used for 3G mobile devices to build in their own
encryption protocols. Security will rely on these lower-level
protocols or standard application-level security protocols used
in normal IP traffic.
Multiple attacks have been launched against this cipher. While
the attacks tend to be impractical, this shows that application
layer security is needed for secure transmission of data on
mobile devices. WAP and WTLS can be used over the lower-
level protocols, but traditional TLS can also be used.
17
4G Mobile Networks
4G can support high-quality VoIP connections, video calls, and
real-time video streaming.
True 4G would require a firm to meet all of the technical
standards issued by the ITU, including specifications that apply
to the tower side of the system.
Most 4G deployments are continuations of technologies already
deployed—just newer evolutions of standards.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Just as the mobile network carriers were finishing the rollout of
3G services, 4G networks appeared on the horizon. The desire
for anywhere, anytime Internet connectivity at speeds near that
of a wired connection drives deployment of these next-
generation services. 4G can support high-quality VoIP
connections, video calls, and real-time video streaming. Just as
3G had some intermediaries that were considered 2.9G, LTE and
WiMAX networks are sometimes referred to as 3.5G, 3.75G, or
3.9G. The carriers are marketing these new networks as 4G,
although they do not adhere to the ITU standards for 4G speeds.
Some of the 4G requirements are:
Be based on an all-IP packet switched network
Offer high quality of service for next-generation multimedia
support
Smooth handovers across heterogeneous networks
Peak data rates of up to approximately 100 Mbps for high
mobility (mobile access)
Peak data rates of up to approximately 1 Gbps for low mobility
such as nomadic/local wireless access
Dynamically share and use the network resources to support
more simultaneous users per cell
Use scalable channel bandwidths of 5–20 MHz, optionally up to
40 MHz
Peak link spectral efficiency of 15-bps/Hz in the downlink, and
6.75-bps/Hz in the uplink
To achieve these and other technical elements requires specific
tower-side equipment as well as handset specifications.
Different carriers have chosen different sets of these to include
in their offerings, each building upon their existing networks
and existing technologies.
Most 4G deployments are continuations of technologies already
deployed—just newer evolutions of standards. This is how LTE,
LTE Advanced, WiMAX, and WiMAX 2 were born. LTE and
WiMAX series come from separate roots, and are not
interchangeable. Within the families, interoperability is possible
and is dependent upon carrier implementation.
18
SATCOM
SATCOM (Satellite Communications) is the use of terrestrial
transmitters and receivers and satellites in orbit to transfer the
signals.
SATCOM can be one way, as in satellite radio, but for most
communications two-way signals are needed.
In high-density urban areas
Cost and line-of-sight issues make SATCOM a costly option.
In rural areas or remote areas, or mobile areas such as at sea
SATCOM is one of the only options for communications.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
19
Bluetooth (1 of 3)
Bluetooth is a short-range (approx. 32 feet), low-power wireless
protocol transmitting in the 2.4 GHz band.
Bluetooth transmits data in Personal Area Networks (PANs)
through mobile phones, laptops, printers, and audio devices.
Version 1.2 allows speeds up to 721 Kbps and improves
resistance to interference over version 1.1.
Bluetooth 2.0 introduced enhanced data rate (EDR), which
allows the transmission of up to 3.0 Mbps.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Bluetooth was originally developed by Ericsson and known as
multi-communicator link; in 1998, Nokia, IBM, Intel, and
Toshiba joined Ericsson and adopted the Bluetooth name. This
consortium became known as the Bluetooth Special Interest
Group (SIG). The SIG now has more than 24,000 members and
drives the development of the technology and controls the
specification to ensure interoperability.
Most people are familiar with Bluetooth as it is part of many
mobile phones and headsets, such as those shown in Figure
12.3. This short-range, low-power wireless protocol transmits in
the 2.4 GHz band, the same band used for 802.11. The concept
for the short-range (approx. 32 feet) wireless protocol is to
transmit data in personal area networks (PANs).
Bluetooth transmits and receives data from a variety of devices,
the most common being mobile phones, laptops, printers, and
audio devices. The mobile phone has driven a lot of Bluetooth
growth and has even spread Bluetooth into new cars as a mobile
phone hands-free kit.
Bluetooth has gone through a few releases. Version 1.1 was the
first commercially successful version, with version 1.2 released
in 2007 and correcting some of the problems found in 1.1.

Recommended for you

Securing the Use of Wireless Fidelity (WiFi) in Libraries
Securing the Use of Wireless Fidelity (WiFi) in LibrariesSecuring the Use of Wireless Fidelity (WiFi) in Libraries
Securing the Use of Wireless Fidelity (WiFi) in Libraries

Lecture presented by Chito N. Angeles at PAARL's Conference on the theme "The Power of Convergence: Technology and Connectivity in the 21st Century Library and Information Services" held on Nov. 11-13, 2009 at St Paul College, Pasig City

wifi wireless networks local area networks wlan
1Table of Contents.docx
1Table of Contents.docx1Table of Contents.docx
1Table of Contents.docx

This document discusses challenges facing corporate IT customer service, using Equity Bank as an example. It identifies customer satisfaction as a major problem, as customers often feel their needs are not properly addressed. The author proposes improving customer care by understanding customer needs and addressing them promptly. A project plan is outlined to intervene, with the goal of benefiting customers long-term. Key execution steps include understanding customers, empowering agents with real-time information, and focusing on consistent agent experiences through business process management.

Ii2514901494
Ii2514901494Ii2514901494
Ii2514901494

This document discusses the Address Resolution Protocol (ARP) and its use in intrusion detection systems. It proposes a standardized 64-byte ARP protocol structure to more easily capture ARP packets from a network. The structure includes fields for frame information, destination and source addresses, ARP type details, and sender/target MAC and IP addresses. This standardized structure could be integrated into network monitoring to help detect intrusions without affecting normal data transfer processes. Overall, the document aims to optimize the ARP sequence for use in intrusion detection systems.

ijera(www.ijera.com)international journal of engin
Version 1.2 allows speeds up to 721 Kbps and improves
resistance to interference. Version 1.2 is backward-compatible
with version 1.1. With the rate of advancement and the life of
most tech items, Bluetooth 1 series is basically extinct.
Bluetooth 2.0 introduced enhanced data rate (EDR), which
allows the transmission of up to 3.0 Mbps. Bluetooth 3.0 has the
capability to use an 802.11 channel to achieve speeds up to 24
Mbps. The current version is the Bluetooth 4.0 standard with
support for three modes: classic, high speed, and low energy.
Bluetooth 4 introduces a new method to support collecting data
from devices that generate data at a very low rate. Some
devices, such as medical devices, may only collect and transmit
data at low rates. This feature, called Low Energy (LE), was
designed to aggregate data from various sensors, like heart rate
monitors, thermometers, and so forth, and carries the
commercial name Bluetooth Smart.
As Bluetooth became popular, people started trying to find
holes in it.
Bluetooth features easy configuration of devices to allow
communication, with no need for network addresses or ports.
Bluetooth uses pairing to establish a trust relationship between
devices. To establish that trust, the devices advertise
capabilities and require a passkey. To help maintain security,
most devices require the passkey to be entered into both
devices; this prevents a default passkey–type attack. The
Bluetooth’s protocol advertisement of services and pairing
properties is where some of the security issues start.
20
Bluetooth (2 of 3)
Figure 12.3 Headsets and cell phones are two of the most
popular types of Bluetooth-capable devices.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Most people are familiar with Bluetooth as it is part of many
mobile phones and headsets, such as those shown in this figure.
21
Bluetooth (3 of 3)
Bluetooth 3.0 has the capability to use an 802.11 channel to
achieve speeds up to 24 Mbps.
Bluetooth 4.0 standard with support for three modes: classic,
high speed, and low energy.
Bluetooth 4 introduces a new method to support collecting data
from devices that generate data at a very low rate.
Bluetooth features easy configuration of devices to allow
communication, with no need for network addresses or ports.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
22
Bluetooth Attacks
Bluetooth is open to connection and attack from outside the
intended sender and receiver.
Several different attack modes have been discovered that can be
used …
Authentication and
Remote Access
Chapter 11
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Objectives (1 of 2)
Identify the differences among user, group, and role
management.
Implement password and domain password policies.
Describe methods of account management (SSO, time of day,
logical token, account expiration).
Describe methods of access management (MAC, DAC, and
RBAC).
Discuss the methods and protocols for remote access to
networks.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
2
Objectives (2 of 2)
Identify authentication, authorization, and accounting (AAA)
protocols.
Explain authentication methods and the security implications in
their use.
Implement virtual private networks (VPNs) and their security
aspects.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
3
Key Terms (1 of 9)
AAA
Access control
Access control list (ACL)
Access control matrix
Accounting
Account expiration
Account maintenance
Account recertification
Administrator
Attribute-based access control (ABAC)
Authentication
Authentication server (AS)
Authorization
Basic authentication
Biometric factors
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.

Recommended for you

Internet of things security "Hardware Security"
Internet of things security "Hardware Security"Internet of things security "Hardware Security"
Internet of things security "Hardware Security"

The Internet of Things (IoT) offers many industries significant new opportunities, but it also exposes them and their customers to a host of security issues. Securing the IoT requires new ways of thinking that can defend the enterprise and its customers against attackers and privacy abuses.

Presentation on Cyber Security
Presentation on Cyber SecurityPresentation on Cyber Security
Presentation on Cyber Security

This document provides an overview of cyber security fundamentals including definitions of key concepts like cryptography, symmetric and public key encryption, firewalls, virtualization, and radio-frequency identification (RFID). It defines cyber security as protecting computers and networks from unauthorized access through technologies and processes. Some key advantages are defending against attacks while allowing secure browsing and data protection. Cyber crimes include illegal access, data interference, and fraud. Symmetric encryption uses the same key for encryption and decryption while public key encryption uses separate public and private keys.

Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docxWitness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx

Witness to a Crime (Major Di1. As I mentioned in this week's lecture, "An Unbelievable Story of Rape" (Links to an external site.) won a Pulitzer Prize in 2016 for Explanatory Reporting. Its accompanying podcast "Anatomy of Doubt" (Links to an external site.) and the 8-part Netflix series Unbelievable (Links to an external site.) are both equally powerful. The story is used by some law enforcement agencies in their training. What did you learn from this powerful report? What would you like law enforcement officials to learn from it? How do you think this story relates to the #MeToo movement? 2. In "The Lynching of Jube Benson," what are some of the ways that the characters misinterpret the evidence?  Do you see parallels in this story to any contemporary events? .

AAA – Acronym for authentication, authorization, and
accounting (AAA). They are three common functions performed
upon system login. Authentication and authorization almost
always occur, with accounting being somewhat less common.
Access control – Mechanism or method used to determine what
access permissions subjects (such as users) have for specific
objects (such as files).
Access control list (ACL) – A list associated with an object
(such as a file) that identifies what level of access each subject
(such as a user) has—what they can do to the object (such as
read, write, or execute).
Access control matrix – A matrix that provides the simplest
framework for illustrating a process.
Accounting – The collection of billing and other detail records.
Account expiration – The setting of an ending time for an
account’s validity.
Account maintenance – The routine screening of all tributes for
an account.
Account recertifcation – The process of recertifying an account
periodically. The process of recertifcation ensures that only
users needing accounts have accounts in the system.
Administrator – A superuser account under the Windows
operating system.
Attribute-based access control (ABAC) – An access control
model built around a set of rules built upon specific attributes.
Authentication – The process by which a subject’s (such as a
user’s) identity is verified.
Authentication server (AS) – A server used to perform
authentication tasks.
Authorization – The function of determining what is permitted
for an authorized user.
Basic authentication – The simplest technique used to manage
access control across HTTP. Basic authentication operates by
passing information encoded in Base64 form using standard
HTTP headers. This is a plaintext method without any pretense
of security.
Biometric factors – The measurements of certain biological
features to identify one specific person from other people.
These factors are based on parts of the human body that are
unique. The most well-known of these unique biological factors
is the fingerprint.
4
Key Terms (2 of 9)
Certificate
Challenge-Handshake Authentication Protocol (CHAP)
Client-to-server ticket
Common Access Card (CAC)
Credential Management
Crossover error rate
Digest authentication
Digital certificate
Directory
Discretionary access control (DAC)
Domain controller
Domain password policy
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Certificate – A method of establishing authenticity of specific
objects such as an individual’s public key or downloaded
software.
Challenge-Handshake Authentication Protocol (CHAP) – A
protocol used to provide authentication across a point-to-point
link using PPP. In this protocol, authentication after the link has
been established is not mandatory.
Client-to-server ticket – The second ticket used in the Kerberos
environment that is used to gain access to a server’s service in
the realm. The user presents a request and a client-to-server
ticket to the desired service and if the client-to-server ticket is
valid, service is granted to the client. Also called a service
ticket.
Common Access Card (CAC) – A smart card identification used
by the U.S. Department of Defense (DoD) for active duty
military, selected reserve personnel, DoD civilians, and eligible
contractors. It is used for carrying the credential data, in the
form of a certificate, for the cardholder used to determine
access to Federal facilities and information systems.
Credential management – Refers to the processes, services, and
software used to store, manage, and log the use of user
credentials. Credential management solutions are typically
aimed at assisting end users manage their growing set of
passwords.
Crossover error rate – The rate where both accept and reject
error rates are equal. This is the desired state for most efficient
operation, and it can be managed by manipulating the threshold
value used for matching. Also known as the equal error rate
(EER),
Digest authentication – A method used to negotiate credentials
across the Web. Digest authentication uses hash functions and a
nonce to improve security over basic authentication.
Digital certificate – A digital file that is sent as an attachment
to a message and is used to verify that the message did indeed
come from the entity it claims to have come from.
Directory – A data storage mechanism similar to a database, but
it has several distinct differences designed to provide efficient
data-retrieval services compared to standard database
mechanisms. A directory is designed and optimized for reading
data, offering very fast search and retrieval operations.
Discretionary access control (DAC) – An access control
mechanism in which the owner of an object (such as a file) can
decide which other subjects (such as other users) may have
access to the object, and what access (read, write, execute)
these objects can have.
Domain controller – A computer that responds to security
authentication requests, such as logging into a computer, for a
Windows domain.
Domain password policy – A password policy for a specific
domain.
5
Key Terms (3 of 9)
eXtensible Access Control Markup Language (XACML)
Extensible Authentication Protocol (EAP)
False acceptance rate
False negative
False positive
False rejection rate
Federated identity management
FTPS
Generic accounts
Group
Group policy object (GPO)
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
eXtensible Access Control Markup Language (XACML) – An
open standard XML-based language used to describe access
control.
Extensible Authentication Protocol (EAP) – A universal
authentication framework defined by RFC 3748 that is
frequently used in wireless networks and point-to-point

Recommended for you

WitnessesVarious sources require different methods of acquiring .docx
WitnessesVarious sources require different methods of acquiring .docxWitnessesVarious sources require different methods of acquiring .docx
WitnessesVarious sources require different methods of acquiring .docx

Witnesses Various sources require different methods of acquiring information. Create a 5-slide PowerPoint presentation answering the following questions. Be sure to follow APA format and style and use at least one reliable resource. Identify the methods of acquiring information from a complainant or witness.  Discuss various methods of obtaining information from reluctant or fearful victims or witnesses.  What is the primary function of hypnosis and what should investigators do with information obtained through hypnosis? Directions: Your 5-slide requirement is excluding your introduction and reference slides. Use 1 basic slide design and layout. Limit slides to between 6 and 8 lines of content. Use bullets for your main points. Use speaker notes to fully explain what is being discussed in the bullet points as though you are presenting to an audience. .

Without information and knowledge, meaningful participation in .docx
Without information and knowledge, meaningful participation in .docxWithout information and knowledge, meaningful participation in .docx
Without information and knowledge, meaningful participation in .docx

Without information and knowledge, meaningful  participation  in  politics  can be difficult. Does social isolation play a role? Is there is a limited network to support and encourage  political participation in your organization? . What are some limiting factors to participation in the political process. .

Without having any background knowledge on the situation of Gove.docx
Without having any background knowledge on the situation of Gove.docxWithout having any background knowledge on the situation of Gove.docx
Without having any background knowledge on the situation of Gove.docx

Without having any background knowledge on the situation of Governor Bob Riley and his efforts to implement a sweeping tax reform on the State of Alabama, there are some significant things that caught my attention within the video. The State of Alabama was already experiencing major deficit and a lower class population which was severely affected by the suffering education system in turn contributing to a population which would have difficulty moving up in class. It seems that there were not many options available to the State of Alabama; either a sweeping reform which would significantly increase taxes (though Riley assigned these hikes to the wealthy) or significant budget cuts which would affect some already suffering divisions funded by the budget. In an effort to persuade the voters to support and vote yes for his reform, Bob Riley fell back on political jockeying. He used religion to encourage people to follow the plan he was pushing for. Within his political messages he stated the Christian way to handle the deficit was to tax the wealthy because his Testament reveals that the rich should take care of the less fortunate. Is political jockeying an appropriate method in government? Should it be present in the development of state budgets, executive activity, or legislative activity? I think to an extent it may sometimes be acceptable. But the means that should be used to persuade voters on policies should be facts and statistical information which supports what will occur with a policy. And perhaps more of an explanation of a personal opinion. I think the efforts used in Riley’s scenario almost placed a guilt on others. The interesting thing about his political jockeying efforts is that the population that was being targeted to benefit the most were the ones who seem to have opposed his reform during the voting process. .

connections. Although EAP is not limited to wireless and can be
used for wired authentication, it is most often used in wireless
LANs.
False acceptance rate (FAR) – A measurement of the level of
false positives are going to be allowed in the system. Expressed
as probabilities, the false acceptance rate is the probability that
the system incorrectly identifies a match between the biometric
input and the stored template value. The FAR is calculated by
counting the number of unauthorized accesses granted, divided
by the total number of access attempts.
False negative – An instance when the system denies access to
someone who is actually authorized.
False positive – An instance where you receive a positive result
for a test, when you should have received a negative result.
Thus, a false positive result occurs when a biometric is scanned
and allows access to someone who is not authorized.
False rejection rate (FRR) – A measurement of what level of
false negatives, or rejections, are going to be allowed in the
system. If an authorized user is rejected by the system, this is a
false rejection.
Federated identity management – An agreement between
multiple enterprises that lets parties use the same identification
data to obtain access to the networks of all enterprises in the
group. This federation enables access to be managed across
multiple systems in common trust levels.
FTPS – The use of FTP over an SSL/TLS secured channel.
Generic accounts – Accounts without a named user behind them.
These can be employed for special purposes, such as running
services and batch processes, but because they cannot be
attributed to an individual, they should not have login
capability.
Group – A collection of users with some common criteria, such
as a need for access to a particular dataset or group of
applications.
Group policy object (GPO) – Stores the group policy settings in
a Microsoft Active Directory environment.
6
Key Terms (4 of 9)
Guest accounts
HMAC-based One-Time Password (HOTP)
Identification
IEEE 802.1X
Kerberos
Key distribution center (KDC)
Layer 2 Tunneling Protocol (L2TP)
Lightweight Directory Access Protocol (LDAP)
Mandatory access control (MAC)
Multifactor identification
Mutual authentication
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Guest accounts – Frequently used on corporate networks to
provide visitors’ access to the Internet and to some common
corporate resources, such as projectors, printers in conference
rooms, and so on. Again, these types of accounts are restricted
in their network capability to a defined set of machines, with a
defined set of access, much like a user from the Internet visiting
their publically facing web site.
HMAC-based One-Time Password (HOTP) – An algorithm that
can be used to authenticate a user in a system by using an
authentication server. (HMAC stands for Hash-based Message
Authentication Code.)
Identification – The process of determining identity as part of
identity management and access control. Usually performed
only once, when the user ID is assigned.
IEEE 802.1X – An authentication standard that supports port-
based authentication services between a user and an
authorization device, such as an edge router.
Kerberos – A network authentication protocol designed by MIT
for use in client/server environments.
Key distribution center (KDC) – A portion of the Kerberos
authentication system.
Layer 2 Tunneling Protocol (L2TP) – A Cisco switching
protocol that operates at the data link layer.
Lightweight Directory Access Protocol (LDAP) – An offshoot
of the Directory Access Protocol (DAP) that offers all of the
functionality most directories need and is easier and more
economical to implement. It is the protocol that is commonly
used to handle user authentication/authorization as well as
control access to Active Directory objects.
Mandatory access control (MAC) – An access control
mechanism in which the security mechanism controls access to
all objects (files), and individual subjects (processes or users)
cannot change that access.
Multifactor authentication – Simply the combination of two or
more types of authentication. Also known as multiple-factor
authentication.
Mutual authentication – Describes a process in which each side
of an electronic communication verifies the authenticity of the
other.
7
Key Terms (5 of 9)
OAuth (Open Authorization)
Offboarding
Onboarding
OpenID
OpenID Connect
Password Authentication Protocol (PAP)
Permissions
Personal identity verification (PIC)
Point-to-point protocol (PPP)
Point-to-Point Tunneling Protocol (PPTP)
Privilege management
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
OAuth (Open Authorization) – An open protocol that allows
secure token based authentication and authorization in a simple
and standard method from web, mobile, and desktop
applications, for authorization on the Internet.
Offboarding – Involves the bringing of personnel onto a project
or team. During onboarding, proper account relationships need
to be managed. New members can be put into the correct
groups.
Onboarding – Involves the taking personnel off a project or
team. When people are offboarded, they can be removed from
the groups they were added to when brought onto the project.
OpenID – OpenID is about proving who you are, the first step in
the Authentication-Authorization ladder used for authentication.
OpenID was created for federated authentication that lets a third
party authenticate your users for you, by using accounts the
users already have.
OpenID connect – A simple identity layer on top of the OAuth
2.0 protocol. OpenID Connect allows clients of all types
(mobile, JavaScript, and web based clients) to request and
receive information about authenticated sessions and end users.
Password Authentication Protocol (PAP) – A protocol that
involves a two-way handshake in which the username and

Recommended for you

Within this document you will find three primary categories of i.docx
Within this document you will find three primary categories of i.docxWithin this document you will find three primary categories of i.docx
Within this document you will find three primary categories of i.docx

Within this document you will find three primary categories of information. Complete each section as follows: Project Work Stream Status Overview: This is a brief overview of the overall status of the RFP response creation, along with the overall status color being: Green (all is good) Yellow (obstacles are in the way, but delivery time has not been affected yet) Red (delivery is going to be delayed, and action is needed immediately). Top Issues, Obstacles & Risks – Treat this as if you are communicating with your employer. Any problems, questions or concerns about the RFP project should be placed in this section. The instructor will be responding to these each week with your graded assignments. Key Activities / Accomplishment: Again, treat this as if you are communicating with your employer, but in this case, add the key activities and accomplishments for this week’s RFP response. .

Within the field of healthcare, there are three main viewpoints .docx
Within the field of healthcare, there are three main viewpoints .docxWithin the field of healthcare, there are three main viewpoints .docx
Within the field of healthcare, there are three main viewpoints .docx

Within the field of healthcare, there are three main viewpoints related to the use of financial information. They are the: 1. financial view 2. process view 3. clinical view 1) After reading the materials for the week, discuss the main areas of overlap within the three viewpoints. 2) Does this overlap create potential areas of conflict? 3) If so, as a manager, how would we proactively address these areas before they negatively impacted our department or organization? APA style 1 – 2 pages Citation of at least 4 recent studies (within 5 years) Be sure to cite your references accordingly. Reading the materials for the week From text book Gapenski, L. C., & Pink, G. H. (2015). Understanding healthcare financial management (7th ed.). Chicago: Association of University Programs in Health Administration and Health Administration Press. ISBN 9781567937060.: Financial View · The financial view is held by those who normally handle finance on a daily basis, such as auditors, accountants, and financial analysts. · Their strength lies in their ability to interpret data and spot problems before they become too critical. · One of the key weaknesses is that these individuals are often very good with the minute details but often have a difficult time with the big picture. Process View · The process view is normally held by those individuals who are responsible for the financial systems and typically comprise the information technology departments. · Their strength is the ability to take raw data and turn it into meaningful reports. · Their weakness lies in not having all information at once. Since there are normally multiple individuals working in this department, each individual may have various pieces of the financial puzzle, but few have the ability to see it all. Clinical View · The clinical view is normally held by those who are responsible for the day to day interactions of the patients and are usually the licensed healthcare professionals. · Their strength lies in their desire to ensure the best possible outcome for the patient and they generally serve as the patients’ advocate. · Their weakness may actually be the same as their strength. Many clinical individuals want to provide the best for their patients, regardless of cost. Therefore, they may have a difficult time balancing the needs of the patients with the needs of the organization. There are strengths and weaknesses to each viewpoint. Perhaps the ideal viewpoint would be where these three perspectives overlap. However, it is certainly not an easy task. Being able to see through each one of these lenses requires that the individual manager be in constant communication with other departments. While it may not be possible to fully integrate all three perspectives, being aware of them better prepares the manager to meet both patient and organizational objectives. (Glossary of Telemedicine and eHealth) · Teleconsultation: Consultation between a provider and specialist at dist.

Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docxWithin the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx

Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss how technological improvements have led to an increase in remote workers and ways to connect with remote team members. Do you believe leaders can use the same strategies to connect with remote workers as they would with an onsite team? Why, or why not? ANSWER THE ABOVE QUESTION AND REPLY TO MY CLASSMATE RESPONSE TO THE ABOVE QUESTIONS AND EXPLAIN WHY YOU AGREE? (A MINIMUM OF 125 WORDS or MORE) CLASSMATE’S POST In the podcast discussion about remote workers, the important points I understood was building a trustful and dependable relationship with the remote workers. Making a connection and continuing that connection at all times. I believe with the technology available today, teleconferencing, videoconferencing and real-time communications by phone, that leadership can build as meaningful a relationship with remote workers as with in house workers. Remote workers want their tasks communicated well to them and they want the tools they need to get their jobs done. They also want to know that their contribution to the organization is just as important as others. I have been in the position of a remote worker and understand the possible challenges. I appreciated leaders that would not only ask questions about the operational efforts but also about the personal and emotional needs of the remote workers. The success of the organization is dependent on all team members being connected and pulling together towards the same goal of exceeding the strategic vision of the business. .

password are sent across the link in cleartext. PAP
authentication does not provide any protection against playback
and line sniffing. PAP is now a deprecated standard.
Permissions – Authorized actions a subject can perform on an
object. See also access controls.
Personal identity verification (PIV) – A U.S. government smart
card that contains the credential data for the cardholder used to
determine access to federal facilities and information systems.
Point-to-Point Protocol (PPP) – An older, still widely used
protocol for establishing dial-in connections over serial lines or
Integrated Services Digital Network (ISDN) services. PPP has
several authentication mechanisms, including PAP, CHAP, and
the Extensible Authentication Protocol (EAP).
Point-to-Point Tunneling Protocol (PPTP) – The use of generic
routing encapsulation over PPP to create a methodology used
for virtual private networking.
Privilege management – The process of restricting a user’s
ability to interact with the computer system.
8
Key Terms (6 of 9)
Privileged accounts
Privileges
Remote access server (RAS)
Remote Authentication Dial-In User Service (RADIUS)
Remote Desktop Protocol (RDP)
Rights
Role
Role-based access control (RBAC)
Root
Rule-based access control
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Privileged accounts – Any accounts with greater than normal
user access. Privileged accounts are typically root or admin-
level accounts and represent risk in that they are unlimited in
their powers.
Privileges – Term meaning that you have the ability to “do
something” on a computer system such as create a directory,
delete a file, or run a program.
Remote access server (RAS) – A combination of hardware and
software used to enable remote access to a network.
Remote Authentication Dial-In User Service (RADIUS) – An
AAA protocol designed as a connectionless protocol that uses
the User Datagram Protocol (UDP) as its transport layer
protocol. Connection type issues, such as timeouts, are handled
by the RADIUS application instead of the transport layer.
RADIUS utilizes UDP port 1812 for authentication and
authorization and UDP port 1813 for accounting functions.
Remote Desktop Protocol (RDP) – A proprietary Microsoft
protocol designed to provide a graphical connection to another
computer.
Rights – These define the actions a user can perform on the
system itself, such as change the time, adjust auditing levels,
and so on. Rights are typically applied to operating system–
level tasks.
Role – Term used to describe a person’s job or function within
the organization.
Role-based access control (RBAC) – An access control
mechanism in which, instead of the users being assigned
specific access permissions for the objects associated with the
computer system or network, a set of roles that the user may
perform is assigned to each user.
Root – An account under Unix that is reserved for special
functions and typically have much more access and control over
the computer system than the average user account.
Rule-based access control – An access control mechanism based
on rules.
9
Key Terms (7 of 9)
Security Assertion Markup Language (SAML)
Secure token
Service accounts
SFTP
Single sign-on (SSO)
Shared accounts
Shibboleth
Smart card
Software tokens
Something you are
Something you do
Something you have
Something you know
Somewhere you are
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Security Assertion Markup Language (SAML) – A single sign-
on capability used for web applications to ensure user identities
can be shared and are protected.
Secure token – A service that is responsible for issuing,
validating, renewing, and cancelling these security tokens.
Service accounts – Accounts that are used to run processes that
do not require human intervention to start/stop/administer.
SFTP – SFTP refers to running FTP over SSH, as later versions
of SSH allow securing of channels such as the FTP control
channel. SFTP is also referred to as Secure FTP.
Single sign-on (SSO) – An authentication process by which the
user can enter a single user ID and password and then move
from application to application or resource to resource without
having to supply further authentication information.
Shared accounts – Go against the specific treatise that accounts
exist so that user activity can be tracked. They exist only to
provide a specific set of functionality, like in a PC running in
kiosk mode, with a browser limited to specific sites as an
information display. Sometimes the shared accounts are called
generic accounts.
Shibboleth – A service designed to enable single sign-on and
federated identity-based authentication and authorization across
networks.
Smart card – A card that can increase physical security because
they can carry cryptographic tokens that are too long to
remember and have too large a space to guess.
Software tokens – An access tokens that is implemented in
software.
Something you are – A one of the categories of authentication
factors. It specifically refers to biometrics, as the “you are”
indicates. One of the challenges with something-you-are
artifacts is they are typically hard to change, so once assigned
they become immutable. Another challenge with biometrics
involves the issues associated with measuring things on a
person.
Something you do – Another one of the categories of
authentication factors. It specifically refers to activities, as the
“you do” indicates. An example of this is a signature, because
the movement of the pen and the two dimensional output are
difficult for others to reproduce.
Something you have – Another one of the categories of
authentication factors. It specifically refers to tokens and other
items that a user can possess physically, as the “you have”

Recommended for you

Within the executive branch of the United States government, the p.docx
Within the executive branch of the United States government, the p.docxWithin the executive branch of the United States government, the p.docx
Within the executive branch of the United States government, the p.docx

Within the executive branch of the United States government, the president has powers that have an influence on public policy. In this assignment, you will be tasked with examining those powers. Assignment Guidelines: · Address the following in 750–1,000 words: o What type of powers does the president have that allow him or her to create and implement various public policies? § Provide 2–3 examples of these presidential powers. § Describe and explain the purpose of these powers. § Provide 2–3 examples of public policies that have been made using these presidential powers. o Have these powers and policies that you have provided evolved over time, or were they a result of a major event? Explain in detail. Be sure to reference all sources using proper APA style. (At least 2) .

Within the executive branch of the United States government, the pre.docx
Within the executive branch of the United States government, the pre.docxWithin the executive branch of the United States government, the pre.docx
Within the executive branch of the United States government, the pre.docx

Within the executive branch of the United States government, the president has powers that have an influence on public policy. In this assignment, you will be tasked with examining those powers. Assignment Guidelines: Address the following in 1,000-1.250 words: What type of powers does the president have that allow him or her to create and implement various public policies? Provide 2–3 examples of these presidential powers. Describe and explain the purpose of these powers. Provide 2–3 examples of public policies that have been made using these presidential powers. Have these powers and policies that you have provided evolved over time, or were they a result of a major event? Explain in detail. .

Within the last several years, Adobe Flash became the dominant forma.docx
Within the last several years, Adobe Flash became the dominant forma.docxWithin the last several years, Adobe Flash became the dominant forma.docx
Within the last several years, Adobe Flash became the dominant forma.docx

Within the last several years, Adobe Flash became the dominant format for embedding video on the Web because Adobe Flash Player was free and available on a variety of different platforms and operating systems. However in April 2010, Steve Jobs, CEO of Apple, explained that Apple would not support Flash on its mobile devices, including the iPhone, iPod, and iPad. Among the reasons cited, Jobs included his concerns that a) Flash was proprietary, a fact that inhibits the future development of multimedia on the Web; b) Flash was not secure or reliable and adversely affects the performance of mobile devices; c) Flash was a significant drain on battery life; and d) Flash was designed for PCs using a mouse interface and could not be adapted to the touch interface found on mobile devices. Rather than relying on Flash, Jobs advocated the continuing development of open standards for Web video including the rapid adoption of HTML5.    However, thousands of Web sites had made considerable investments in Flash and were not happy with the prospect of significantly retooling their sites. In response, in March 2011, Adobe released a tool to convert Flash files to HTML5-compatible formats so they run on Apple's mobile devices. Also, Flash is supported on several mobile operating systems, such as the Android platform for mobile devices.    Users running older browsers will not be able to use HTML5 video; so for complete cross-browser support, you'll make a Flash version of the Royal Wedding clip available to users. Maxine has created an Adobe Flash Player file named rwdance.swf containing both the video clip and the controls to run it. Does Jobs have a point?  Is it better for web developers to rely on one proprietary means of displaying video?  Is it best to have a standard?  If so, how should a standard be developed? If not, what's better about varied means? .

indicates.
Something you know – Another one of the categories of
authentication factors. It specifically refers to passwords, as the
“you know” indicates. The most common example of something
you know is a password.
Somewhere you are – Another one of the categories of
authentication factors. One of the more stringent elements is
your location, or somewhere you are. Location can be compared
to records to determine if you are really there, or even should be
there.
10
Key Terms (8 of 9)
Superuser
Terminal Access Controller Access Control System+
(TACACS+)
Ticket-granting server (TGS)
Ticket-granting ticket (TGT)
Time-based One-Time Password (TOTP)
Time-of-day restrictions
Token
Transitive truest
Tunneling
Usage auditing and review
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Superuser – Accounts that accounts are not typically assigned to
a specific individual and are restricted, accessed only when the
full capabilities of that account are required.
Terminal Access Controller Access Control System+
(TACACS+) – The current generation of the TACACS protocol
family. TACACS+ extended the attribute control and accounting
processes.
Ticket-granting server (TGS) – A portion of the Kerberos
authentication system.
Ticket-granting ticket (TGT) – The first ticket issued in the
Kerberos environment. The KDC verifies credentials and issues
a ticket-granting ticket (TGT) which the user presents for
service to the KDC.
Time-based One-Time Password (TOTP) – An algorithm that is
a specific implementation of an HOTP that uses a secret key
with a current time stamp to generate a one-time password.
Time-of-day restrictions – Specify restrictions that limit when a
user can log in, when certain resources can be accessed, and so
on. Time-of-day restrictions are usually specified for individual
accounts.
Token – A hardware device that can be used in a challenge-
response authentication process.
Transitive trust – A relationship where the trust relationship
extended to one domain will be extended to any other domain
trusted by that domain.
Tunneling – The encapsulation of one packet within another,
which allows you to hide the original packet from view or
change the nature of the network transport. This can be done for
both security and practical reasons.
Usage auditing and review – An examination of logs to
determine user activity. Reviewing access control logs for root
level accounts is an important element of securing access
control methods.
11
Key Terms (9 of 9)
User
Username
Virtual private network (VPN)
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
User – A term that generally applies to any person accessing a
computer system. In privilege management, a user is a single
individual, such as ���John Forthright” or “Sally Jenkins.” This is
generally the lowest level addressed by privilege management
and the most common area for addressing access, rights, and
capabilities.
Username – A unique alphanumeric identifier that a user will
use to identify himself or herself when logging into or accessing
the system.
Virtual private network (VPN) – An encrypted network
connection across another network, offering a private
communication channel across a public medium.
12
Introduction
Privileges mean you have the ability to “do something” on a
computer.
Privilege management is the process of restricting a user’s
ability to interact with the computer system.
Remote access enables users outside a network to have network
access and privileges as if they were inside the network.
Authentication is the process of establishing a user’s identity to
enable the granting of permissions.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
Essentially, everything a user can do to or with a computer
system falls into the realm of privilege management. Privilege
management occurs at many different points within an operating
system or even within applications running on a particular
operating system.
Remote access is another key issue for multiuser systems in
today’s world of connected computers. Isolated computers, not
connected to networks or the Internet, are rare items these days.
To establish network connections, a variety of methods are
used, the choice of which depends on network type, the
hardware and software employed, and any security
requirements.
13
User, Group, and Role Management
To effectively manage privileges, a mechanism for separating
people into distinct entities (users) is required.
It is convenient and efficient to be able to lump users together
when granting many different people (groups) access to a
resource at the same time.
It is useful to be able to grant or restrict access based on a
person’s job or function within the organization (role).
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.

Recommended for you

Within the criminal justice system, the classification of the crime .docx
Within the criminal justice system, the classification of the crime .docxWithin the criminal justice system, the classification of the crime .docx
Within the criminal justice system, the classification of the crime .docx

Within the criminal justice system, the classification of the crime and the classification of the offender will, in large part, determine the available pathways for the offender to return to the community. Individuals who have committed violent crimes are less likely to be allowed probation as an alternative to incarceration, whereas first-time offenders are likely to be seen as better candidates for community treatment programs. The Assignment (2–3 pages): Consider an offender group relevant to your current or future profession, including needs and concerns for this group. Ex. Sex offenders, abusive/neglectful parents, etc. Analyze the community placement pathways available for offenders in your community (city/county/state). Explain what they are, how they work, and the strengths and limitations of each. Evaluate the Interactive Community in terms of resources and pathways for the offender population you selected. Explain what is done well and what could be improved regarding the resources available. Be specific and include references to any relevant resources from the week. FUTURE PROFESSION: JUVENILE SOCIAL WORKER .

Within Chapter 8 there is a section discussing Robert Mertons Strai.docx
Within Chapter 8 there is a section discussing Robert Mertons Strai.docxWithin Chapter 8 there is a section discussing Robert Mertons Strai.docx
Within Chapter 8 there is a section discussing Robert Mertons Strai.docx

Within Chapter 8 there is a section discussing Robert Merton's Strain Theory of Deviance.  This theory basically argues that when individuals feel pressure and/or strain to attain certain cultural goals they may resort to different forms of deviance to alleviate the pressure and achieve specific social goals. Utilizing Merton's theory identify you will need to identify an individual or social group that is well known in the public sphere.  You will be utilizing one of his subcategories of deviant behavior (innovator, ritualist, rebel, or retreatist).  You will need to explain and specify which category this individual best fits into and why using their own behavior and track record as your examples. For example, you may choose a professional athlete (Lebron James), artist(?) (Justin Bieber), or social group such as the Amish.  Please be specific with the examples and how they fit into the category. .

Within the context of Smart Cities, many regions are employing e-tec.docx
Within the context of Smart Cities, many regions are employing e-tec.docxWithin the context of Smart Cities, many regions are employing e-tec.docx
Within the context of Smart Cities, many regions are employing e-tec.docx

Within the context of Smart Cities, many regions are employing e-technologies to enhance public service. Today’s cities and towns reveal improvements to providing public services because of e-government capabilities. Select a town or city located in the United States, and write an investigative summary detailing at least one e-government application that has improved public service provided to the citizenry. Refer to the unit study guide for application ideas that include wireless technology services or mobile apps used on smartphones to enhance public services.  Your paper should logically identify the following items:  1) who the service impacts (lists all stakeholders and beneficiaries),  2) what the technology offers (identify what the capabilities the service provides),  3) where the service is located,  4) when the capability or service began,  5) why the technology enhances or improves services, and  6) what the cost estimates were to initiate and/or maintain these capabilities.  Your assignment must be a minimum of two pages in length and follow APA style. Be sure to include a title page containing the title of the assignment, your name, and the name of the university. The title page and the reference page are not included in the required assignment page length. .

While you can manage privileges on the basis of users alone,
managing user, group, and role assignments together is far more
convenient and efficient.
14
User (1 of 4)
The term user generally applies to any person accessing a
computer system.
In privilege management, a user is a single individual.
A username is a unique alphanumeric identifier the user will use
to identify himself or herself when logging into or accessing the
system.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
The concept of a user is generally the lowest level addressed by
privilege management and the most common area for addressing
access, rights, and capabilities.
When developing a scheme for selecting usernames, you should
keep in mind that usernames must be unique to each user, but
they must also be fairly easy for the user to remember and use.
With some notable exceptions, in general a user who wants to
access a computer system must first have a username created for
him on the system he wishes to use. This is usually done by a
system administrator, security administrator, or other privileged
user, and this is the first step in privilege management—a user
should not be allowed to create their own account.
15
User (2 of 4)
Rights define the actions a user can perform on the system
itself.
Permissions control what the user is allowed to do with objects
on the system.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
16
User (3 of 4)
“Special” user accounts are reserved for special functions and
typically have much more access and control.
The administrator account under Windows and the root account
under UNIX
Both known as the superuser
Must be protected with strong passwords
The system account used by Windows operating systems
Granted full control to all files on an NTFS volume by default
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
17
User (4 of 4)
Figure 11.1 Users tab on a Windows Server 2008 system
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
This figure shows the Users management tab of the Computer
Management utility on a Windows Server 2008 system. Note
that several user accounts have been created on this system,
each identified by a unique username.
18
Shared and generic accounts/credentials
Shared accounts go against the specific treatise that accounts
exist so that user activity can be tracked.
Shared accounts are called generic accounts
Shared accounts exist only to provide a specific set of
functionality
Example: PC running in kiosk mode, with a browser limited to
specific sites as an information display
Tracing the activity to a user is not particularly useful.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
19
Guest accounts
Guest accounts are frequently used on corporate networks
Provide visitors’ access to the Internet
Provide common corporate resources
Accounts are restricted in their network capability to a defined
set of machines with a defined set of access
Logging and tracing activity have little to no use
Overhead of establishing an account does not make sense
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
20
Service accounts
Service accounts are used to run processes that do not require
human intervention to start/stop/administer.
Windows systems may not allow them to log into the system.
Limits attack vectors that can be applied to these accounts
Can apply time restrictions for accounts that run batch jobs at
night and then monitor when they run.
Service accounts that run in an elevated privilege mode should
receive extra monitoring and scrutiny.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
21

Recommended for you

Within Sociology as well as in social psychology, it is noted th.docx
Within Sociology as well as in social psychology, it is noted th.docxWithin Sociology as well as in social psychology, it is noted th.docx
Within Sociology as well as in social psychology, it is noted th.docx

Within Sociology as well as in social psychology, it is noted that an in-group basically is a social group whereby an individual gets to identify themselves as a member psychologically. On the other hand, an Out-group basically is defined as a social group which a person is not able to identify with. For instance, individuals are in a position of identifying themselves with same peer group, a political party, community, family, religion, sports team nation or even gender. It is evident that with the membership that is psychological regarding social groups in addition to classifications happens to be linked to a phenomenon that is of a wide range. There is the presence of stereotypes within interactions in between various social groups in addition to gender stereotypes being considered as prevalent. (Buss, 2015). In-group It is known that the automatic in-group bias of women is evidently stronger as compared to that of men. This is because only women are in a position of showing balance that is cognitive across in-group identity, self-esteem as well as bias. This is an indication that men do not have any mechanism in place for bolstering preference for own group automatically. There is bias that is pro-female to a point the individuals tend to favor their own mothers as compared to their fathers, there is also the association of the gender that is male with violence which is an indication that bonding that is maternal as well as intimidation of male have an influence on the gender attitudes. (De La Cerda and Warnell, 2020). Out-group Additionally, within in-group bias as well as Out-group bias, it happens that the men who are experiences sexually, have an attitude that is more positive in addition to favoring women implicitly. In addition, through the adoption of an approach that is evolutionary to the race bias psychology, it is possible to posit that conflict that is between intergroup which has been perpetrated by aggressors who are men all through the evolutionary history of human, has played a role in shaping the modern types psychology in relation to Out-group bias whereby, the psychology is a reflection of the unique adaptive challenges differing in between women as well as men when trying to cope with the aggressors who are male from the out-groups. In conclusion there tends to be very minimal differences in between women as well as men as the conformity they tend to exhibit, in addition, these differences are said to be impacted by the social circumstances where the conformity happens to take place through the differences in gender. On an average basis, women in addition to men have levels that are different in relation to self-concern in addition to different concern. Men basically on averagely, are said to have more focus on their appearance of having a status that is high in addition to having the capacity to illustrate the status through independent acting from other people’s perceptions. (Harvard, et.al, 2021).             .

within 250-300 words please describe, using reference(s) APA formatt.docx
within 250-300 words please describe, using reference(s) APA formatt.docxwithin 250-300 words please describe, using reference(s) APA formatt.docx
within 250-300 words please describe, using reference(s) APA formatt.docx

within 250-300 words please describe, using reference(s) APA formatting  Describe at least three different neuroscience research techniques. What are the strengths and limitations of each technique, and what kind of research questions can these techniques help us answer? I've provided readings/links in the attachments for usage of referencing. .

With which of the following statements would Thoreau most likely agr.docx
With which of the following statements would Thoreau most likely agr.docxWith which of the following statements would Thoreau most likely agr.docx
With which of the following statements would Thoreau most likely agr.docx

With which of the following statements would Thoreau most likely agree? a. Most people’s lives are too simple. b. Most people forfeit their lives by doing what society tells them to do. c. The chief purpose of everyone’s life should be to glorify God. d. People need to learn to compromise to get along .

Privileged accounts
Privileged accounts have greater than normal user access.
Privileged accounts are typically root or admin-level accounts
and represent risk in that they are unlimited in their powers.
Require regular real-time monitoring, if at all possible, and
should always be monitored when operating remotely.
There may be reasons why system administrators are acting via
a remote session, but when they are, the purposes should be
known and approved.
Principles of Computer Security, Fifth Edition
Copyright © 2018 by McGraw-Hill Education. All rights
reserved.
22
Group (1 of 3)
Under privilege management, a group is a collection of users
with some common criteria, such as a need for access to a
particular dataset or group …
Chapter 11:
Managing Organizational Change and Crises
Introduction
In this ever-changing global economy, organizational change is
inevitable
Productively managing change by drawing on the strengths of
an organization keeps them healthy and able to adapt to the
environment
Organizational Change
Case Study: Merger Mayhem
New Zest Manufacturing CEO Jeremy called a special meeting
of management
Rumors of a potential merger and branch closings made the
atmosphere tense
Jeremy was known for “doing more with less” so downsizing
was a top concern for the managers
Why people are afraid of changes?
What problems may arise by downsizing?
• Is there any good suggestions to ease the conflict by
downsizing?
Downsizing
A common yet often-overlooked change in organizations, with
unintended costs
Employees who survive the layoffs often:
Voluntarily leave the company for better options
View the organization as unstable
Experience enhanced workloads, leading to burnout
Organizations often struggle to hire new talent and lose
employees with organizational knowledge
Several key steps should be followed before making the
decision to downsize
Critical Thinking Questions - Downsizing
How does the term “survivor” help us to understand the
experiences of individuals after a downsizing has occurred?
Identifying the Change Process
Tim Brown (2009) suggests the thought process should go
something like this:
Begin at the beginning
Take a human-centered approach
Fail early; fail often
Get professional help
Share the inspiration
Blend big and small projects
Budget to the pace of innovation
Laying the Foundation for Change
When organizations face change, how that change is framed can
have a tremendous impact on whether employees buy into the
change
Laying the proper foundation is vital for creating a sense of
commitment to the change
Employees will be more likely to be committed to the change if
they are able to move beyond simple adaptation and acceptance
to understanding and a sense of control
Implementing Change
Organizations implementing change that have the attitude that
everyone is on the team and has the potential to contribute ideas
will often find that employees “in the trenches” will have
knowledge and insight based on observation and experience that
just might improve the process
Relying on the employees doing the job to offer suggestions is
likely to improve the process as well as create a greater sense of
commitment on the part of the employee
Evaluating Change Outcomes
Organizations can reevaluate and change again if it isn’t
working
Just because an organization has changed something, perhaps
even based on extensive research, doesn’t mean that the
organization has to accept the results of that change
Evaluation is vital
Organizational Learning
A successful organization is a learning organization
For the organization to learn, though, there must be an attitude
that recognizes the value of all team members – from the
custodial staff to the CEO
Just as important, there needs to be an effective system of
communication
The type of communication may take different forms, depending
on the culture of the organization, but there must be a system in
place
In addition, the attitude of the organization should be one that
fosters creative thinking at all levels
Critical Thinking Questions – Change
How might an organization’s culture influence change
processes?
Can you think of examples of types of organizations that seem
to be “learning organizations”?

Recommended for you

With the volatile environmental conditions surrounding CSC’s data ce.docx
With the volatile environmental conditions surrounding CSC’s data ce.docxWith the volatile environmental conditions surrounding CSC’s data ce.docx
With the volatile environmental conditions surrounding CSC’s data ce.docx

With the volatile environmental conditions surrounding CSC’s data centers, Katie Pena (Business Continuity Director) and James Miller (Disaster Recovery Manager) is expected to present a one-slider to the members of the Executive Committee (i.e.: C-suite) to promote discussion / insights around the planned business continuity and disaster recovery approaches. Your task is to provide Katie and James with a single slide depicting the following:   The key benefits of business continuity and disaster recovery approaches for protecting CSC’s data centers.   Some anticipated challenges that maybe faced when managing and sustaining business continuity and disaster recovery. .

With the rapid development of the Internet, a big data era chara.docx
With the rapid development of the Internet, a big data era chara.docxWith the rapid development of the Internet, a big data era chara.docx
With the rapid development of the Internet, a big data era chara.docx

With the rapid development of the Internet, a big data era characterized by information explosion is coming. Public security relies on predictive policing to improve its work efficiency. Predictive policing based on large data analysis, it predicts which area of a city is most likely to occurs crimes and where criminals are most likely to be found. Privacy and civil rights must be seriously considered the problems of predictive policing, especially those who are predicted as offenders or victims. In the fiction short story “The Minority Report” by Philip K. Dick, describing Washington in 2054, the judicial system has been able to predict crime through psychological technology, system helps arrest the before he commits the crime. Dick shows his concern about predictive policing, which has been consistently developed; however, the main problem with predictive policing is its reliability. Although this is only a science fiction vision of the future, PredPol has made it a reality to some extent. Recently, the Los Angeles Police Department announced an expansion of the use of crime prediction software to speculate when and where crime is most likely to occur. Dick’s concern supports modern criticism of predictive policing and technology that crime prediction models are based on flawed statistics that reflect inherent prejudices in the criminal justice system. Dick’s concern about predictive policing were that it is not accurate and contain lots of flaw. John Anderton, one of the elites of the pre-crime team, was accused of murdering a man he didn't know. In the process of his death and pursuit, Anderton learned that it was the three “PreCogs” who had the power to decide whether a person's guilt was ultimately established. If two of them are found guilty and the other disagrees, the last one is in the minority, whose opinion is called Minority Report. In story, Anderton states, "If the system can survive only by imprisoning innocent people, then it deserves to be destroyed. My personal safety is important because I'm a human being. And furthermore-"(Anderton, 114) By using the word “innocent,” Dick shows the potential unreliability of the predict technology. After reconsidered the meaning of pre-crime system, Anderton realized that what he has believed was successful is all built on the suffering of the people and threatening their lives. Dick emphasizes that the predictive technology should seek a balance between protecting individual privacy and safety. This action makes the argument of whether the society should trust the predictive policing system. In the end, Anderton did not kill the person who appeared in the Precogs’ prediction. However, the matter is that it's not possible to penalize someone before he commits a criminal offense simply because he's judged to own a motive. The not accuracy and flaws contain in predictive policing that Dick’s concern has still value in the modern society… (missing second part of the prompt which is Analyze.

With the successful election of America’s first biracial president f.docx
With the successful election of America’s first biracial president f.docxWith the successful election of America’s first biracial president f.docx
With the successful election of America’s first biracial president f.docx

This document discusses whether Jane Elliott's 1968 third-grade classroom lesson on discrimination is still necessary today given America elected its first biracial president for two terms. It also discusses if every school system should teach Elliott's lesson or a similar one focusing on oppression to all students.

Crisis and Change
Case Study: Takata Airbags
Multiple deaths occurred as a result of problematic Takata
airbags in Toyota vehicles
Multiple rounds of recalls culminated in 31 million recalls in
eight years, including those from other manufacturers
How an organization communicates in a crisis can be a life-and-
death matter
What should Takata have done?
What ethical concerns do you have about this crisis?
Organizational Crisis
“A low-probability, high-impact event that threatens the
viability of the organization and is characterized by ambiguity
of cause, effect, and means of resolution, as well as by a belief
that decisions must be made swiftly” (Pearson & Clair, 1998, p.
60)
Organizations typically either try to keep crisis from occurring
in the first place, or try to soften the impact when crisis does
occur
Five stages of crisis include signal detection,
preparation/prevention, containment/damage litigation,
recovery, and learning
Crisis Communication Plan
Plans should be proactive, specifically:
Identify a crisis team
Develop key messages for internal and external publics
Designate a spokesperson and backup
Have a system to monitor communication about the organization
Have a postcrisis review plan
In addition to correcting the issue, crisis communication should
also reduce tension, be ethical, control information flow, and
manage the recovery
Crisis Communication and Image
Image can be impacted positively or negatively as a result of a
crisis
The way a mistake is resolved, and what the organization learns
in the process, is important
Examples:
BP Deepwater Horizon oil spill
JetBlue
Crisis Communication Should Be Dynamic
Leaders must adapt communication to the changing environment
and stakeholder concerns
Leaders must continually assess the situation, environment, and
changing variables is necessary
Leaders must remain consistent in organizational values
Context Matters
For-Profit Organizations
Longer processing times can create both negative and positive
crisis situations for larger corporations
Family Entrepreneurship
Less time required to deal with change and crisis, but potential
for big differences for the organization
Nonprofit Organizations
Very specific missions create potential change challenges
Government Sector
Resistance to change may take a more political form
Chapter 10:
Managing Conflict
Introduction
Workplace conflicts are often not productive
Take time away from one’s job
Take time away from providing customer service
Strained emotion often lingers
Conflict can lead to innovation and creativity
Conflict must be managed – not ignored
Conflict Defined
An expressed struggle between at least two interdependent
parties, who perceive incompatible goals, scarce rewards or
resources or expectations that are not being met, and
interference from the other party or parties in achieving their
goals
Conflict vs. Difference of Opinion
Interdependent parties
Incompatible goals
Interference
If we perceive something, we will often act as if it is true
Managing Conflict
Dimensions of Conflict
History: experiences with the party or other conflicts
Source: can be the other person or something less personal
Perceptions: assumptions and prejudices often make us think
something is true even if it is not
Emotions: controlling emotions in a positive manner can lead to
positive conflict resolution
Behavior: good, controlled behavior can move us toward
positive results
Effective vs. Dysfunctional Responses
Differentiation: “Parties raise the conflict issues and spend
sufficient time and energy clarifying positions, pursuing the
reasons behind those positions, and acknowledging their
differences stage determines differences” (Stutman, 2009, p. 14)
Opportunities to develop understanding during this stage
Case Study: Zest Manufacturing Wars
A small group of managers met for their weekly meeting, and
conflict arose
Two managers were at odds because both failed to ask for
rationale and allowed their emotions to flare
A third manager facilitated a conversation to help both parties
see how to resolve the conflict
Perception was key; both managers perceived that the other was
questioning their ability to do their job
Have their been times when emotion influenced your perception
of something? Did it help or hurt?

Recommended for you

With this activity you will develop your analysis of a TED talk .docx
With this activity you will develop your analysis of a TED talk .docxWith this activity you will develop your analysis of a TED talk .docx
With this activity you will develop your analysis of a TED talk .docx

This document provides instructions for analyzing a TED talk presentation. Students are to: 1) Select a TED talk video between 3-18 minutes and watch it multiple times. 2) Review chapters 10-12 from their textbook on presentation analysis. 3) Analyze the TED talk using an outline that examines the presenter's purpose, delivery style, organization techniques, language use, and other presentation strategies. 4) Develop a thorough analysis using the outline and respond to the analyses of at least two other students.

How to Add Colour Kanban Records in Odoo 17 Notebook
How to Add Colour Kanban Records in Odoo 17 NotebookHow to Add Colour Kanban Records in Odoo 17 Notebook
How to Add Colour Kanban Records in Odoo 17 Notebook

In Odoo 17, you can enhance the visual appearance of your Kanban view by adding color-coded records using the Notebook feature. This allows you to categorize and distinguish between different types of records based on specific criteria. By adding colors, you can quickly identify and prioritize tasks or items, improving organization and efficiency within your workflow.

odoo 17 notebookodoo 17how to add colour kanban
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptxBRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx

BRIGADA ESKWELA OPENING PROGRAM

brigada
Conflict Within the Organization
Personality conflicts: arise out of differences in the collection
of qualities that make people who they are but that also don’t
meet our expectations
Role confusion: lack of clarity over expectations of our position
or fulfilling our job duties
Intragroup conflict: conflict within a group
Intergroup conflict: conflict between two or more groups
Intraorganizational conflict: conflict within an organization
Critical Thinking Questions - Conflict
Why does conflict often escalate so quickly?
In today’s modern society, what other potential sources of
conflict within organization can you think of?
Styles of Dealing with Conflict
Avoiding
Those who prefer avoidance recognize a conflict exists, but tend
to want to withdraw from, ignore, or suppress it
Low concern for satisfying concerns of themselves or others
Can be useful when issues are trivial, there is no chance of
satisfying your concerns, or disruption outweighs benefits of
resolution
Competing
Individuals who use competition place their own concerns as
more important than the concerns of others
“I win, you lose” approach
Can work when quick action is necessary
Can spur creativity and innovation
Can lead to one-sidedness and harmful for building trust
Accommodation
The opposite of competing
Putting one’s needs and concerns aside in order to focus on
concerns and needs of others
Useful when one is wrong about an issue, or an issue is far more
important to others, maintaining cooperation as a goal
Compromise
Often considered the best strategy because it is in the middle of
the grid
Both parties get something without excessive disruption
Balance of loss and gain can be useful and seen as fair
Often leaves both parties feeling dissatisfied
Collaboration
Ideal because of a high concern for needs of all parties involved
Win-win result is the goal
Collaborative people help to solve problems by being creative
and looking for joint gains
Trust is an important component of collaborative processes
Strategic Objectives
We need to consider the importance of the relationship as well
as our goals and desires as we decide which tactic to use
Managing conflict requires the ability to recognize the tactics of
others and adjust our own tactics to complement and/or counter
the other party in an effort to achieve the final goal
Organizational Conflict and Power
Power can determine:
How conflict gets resolved
What goals a group will pursue
How a group’s resources will be distributed
Many conflicts have asymmetrical power
Forms of Power
Formal power is based on an individual’s position in an
organization:
Coercive power
Reward power
Legitimate power
Personal power is derived from one’s unique characteristics:
Expert power
Referent power
Critical Thinking Questions - Power
Consider conflicts in which you have been involved where
power has been used by either yourself or the other party
Was power used in a productive way?
How did the parties to the conflict feel after power was used?
Third Party Intervention
• In the following three special types of organizational
conflicts, it is necessary to bring in a third party.
Whistle-blowing, sexual harassment, discrimination
• To deal with conflicts via third party intervention:
Negotiation
Mediator
Arbitration (conventional interest arbitration, final offer
arbitration)
Judicial approach
Case Study- Email Fiasco
Phil is unhappy with the hiring of new manager Marshall, and
the promotion of Trish
Marshall suggested changing the inventory process, and Trish
supported it while Phil did not
Marshall sent an email to the entire company that derided both
Trish and Phil
What types of conflict exist in this case?
What other issues contributed to this conflict situation?
Conflict Outside: Dealing with an Angry Public
When conflict has moved outside the organization and we are
dealing with a potentially angry public, remember there are
some key variables to consider in our response:
What are the facts of the situation?
What emotions are driving the publics’ perception?
What are the contextual variables that create and sustain the
crisis?
What are/should be the organizational actions taken in response
to the critical event(s)?
Organizations must recognize the various emotions involved
and seek to “step into the shoes” of others and understand their
varying perspectives

Recommended for you

How to Show Sample Data in Tree and Kanban View in Odoo 17
How to Show Sample Data in Tree and Kanban View in Odoo 17How to Show Sample Data in Tree and Kanban View in Odoo 17
How to Show Sample Data in Tree and Kanban View in Odoo 17

In Odoo 17, sample data serves as a valuable resource for users seeking to familiarize themselves with the functionalities and capabilities of the software prior to integrating their own information. In this slide we are going to discuss about how to show sample data to a tree view and a kanban view.

odoo 17how to show sample datatree and kanban view
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdfThe Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf

we may assume that God created the cosmos to be his great temple, in which he rested after his creative work. Nevertheless, his special revelatory presence did not fill the entire earth yet, since it was his intention that his human vice-regent, whom he installed in the garden sanctuary, would extend worldwide the boundaries of that sanctuary and of God’s presence. Adam, of course, disobeyed this mandate, so that humanity no longer enjoyed God’s presence in the little localized garden. Consequently, the entire earth became infected with sin and idolatry in a way it had not been previously before the fall, while yet in its still imperfect newly created state. Therefore, the various expressions about God being unable to inhabit earthly structures are best understood, at least in part, by realizing that the old order and sanctuary have been tainted with sin and must be cleansed and recreated before God’s Shekinah presence, formerly limited to heaven and the holy of holies, can dwell universally throughout creation

shekinah sanctuary sabbath
Split Shifts From Gantt View in the Odoo 17
Split Shifts From Gantt View in the  Odoo 17Split Shifts From Gantt View in the  Odoo 17
Split Shifts From Gantt View in the Odoo 17

Odoo allows users to split long shifts into multiple segments directly from the Gantt view.Each segment retains details of the original shift, such as employee assignment, start time, end time, and specific tasks or descriptions.

gantt viewodoo 17gantt view in odoo
Context Matters
For-Profit Organizations
Dealing with conflict takes time, which can be both positive and
negative
Family Entrepreneurship
Conflict can be dealt with more quickly but can also infect an
entire organization faster
Nonprofit Organizations
Presence of volunteers complicates conflict processes
Government Sector
Unique rules and guidelines may produce additional
interorganizational conflicts

More Related Content

Similar to Wireless Security and Mobile DevicesChapter 12Princi.docx

Firewall protection
Firewall protectionFirewall protection
Firewall protection
VC Infotech
 
Firewall
Firewall Firewall
Wireless security
Wireless securityWireless security
Wireless security
Salma Elhag
 
Wi fi technology
Wi fi technologyWi fi technology
Wi fi technology
Faiq Ali Sayed
 
Wlan security
Wlan securityWlan security
Wlan security
Upasona Roy
 
Iot(security)
Iot(security)Iot(security)
Iot(security)
Shreya Pohekar
 
The Risks and Security Standards of WLAN Technologies: Bluetooth and Wireles...
The Risks and Security Standards of WLAN Technologies:  Bluetooth and Wireles...The Risks and Security Standards of WLAN Technologies:  Bluetooth and Wireles...
The Risks and Security Standards of WLAN Technologies: Bluetooth and Wireles...
Lindsey Landolfi
 
Wsn
WsnWsn
Mobile Device Security
Mobile Device SecurityMobile Device Security
Mobile Device Security
John Rhoton
 
Wireless Security Needs For Enterprises
Wireless Security Needs For EnterprisesWireless Security Needs For Enterprises
Wireless Security Needs For Enterprises
shrutisreddy
 
Iot Security
Iot SecurityIot Security
Iot Security
MAITREYA MISRA
 
Fa13 7718-ch7 9-singh
Fa13 7718-ch7 9-singhFa13 7718-ch7 9-singh
Fa13 7718-ch7 9-singh
Mary-Jo Apigo
 
Latest Developments in WirelessNetworking and Wireless Security
Latest Developments in WirelessNetworking and Wireless SecurityLatest Developments in WirelessNetworking and Wireless Security
Latest Developments in WirelessNetworking and Wireless Security
IOSR Journals
 
Research Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and ScienceResearch Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and Science
inventy
 
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
IRJET Journal
 
Securing the Use of Wireless Fidelity (WiFi) in Libraries
Securing the Use of Wireless Fidelity (WiFi) in LibrariesSecuring the Use of Wireless Fidelity (WiFi) in Libraries
Securing the Use of Wireless Fidelity (WiFi) in Libraries
Philippine Association of Academic/Research Librarians
 
1Table of Contents.docx
1Table of Contents.docx1Table of Contents.docx
1Table of Contents.docx
felicidaddinwoodie
 
Ii2514901494
Ii2514901494Ii2514901494
Ii2514901494
IJERA Editor
 
Internet of things security "Hardware Security"
Internet of things security "Hardware Security"Internet of things security "Hardware Security"
Internet of things security "Hardware Security"
Ahmed Mohamed Mahmoud
 
Presentation on Cyber Security
Presentation on Cyber SecurityPresentation on Cyber Security
Presentation on Cyber Security
Anand Kater
 

Similar to Wireless Security and Mobile DevicesChapter 12Princi.docx (20)

Firewall protection
Firewall protectionFirewall protection
Firewall protection
 
Firewall
Firewall Firewall
Firewall
 
Wireless security
Wireless securityWireless security
Wireless security
 
Wi fi technology
Wi fi technologyWi fi technology
Wi fi technology
 
Wlan security
Wlan securityWlan security
Wlan security
 
Iot(security)
Iot(security)Iot(security)
Iot(security)
 
The Risks and Security Standards of WLAN Technologies: Bluetooth and Wireles...
The Risks and Security Standards of WLAN Technologies:  Bluetooth and Wireles...The Risks and Security Standards of WLAN Technologies:  Bluetooth and Wireles...
The Risks and Security Standards of WLAN Technologies: Bluetooth and Wireles...
 
Wsn
WsnWsn
Wsn
 
Mobile Device Security
Mobile Device SecurityMobile Device Security
Mobile Device Security
 
Wireless Security Needs For Enterprises
Wireless Security Needs For EnterprisesWireless Security Needs For Enterprises
Wireless Security Needs For Enterprises
 
Iot Security
Iot SecurityIot Security
Iot Security
 
Fa13 7718-ch7 9-singh
Fa13 7718-ch7 9-singhFa13 7718-ch7 9-singh
Fa13 7718-ch7 9-singh
 
Latest Developments in WirelessNetworking and Wireless Security
Latest Developments in WirelessNetworking and Wireless SecurityLatest Developments in WirelessNetworking and Wireless Security
Latest Developments in WirelessNetworking and Wireless Security
 
Research Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and ScienceResearch Inventy : International Journal of Engineering and Science
Research Inventy : International Journal of Engineering and Science
 
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
Wireless Sensor Network: Internet Model Layer Based Security Attacks and thei...
 
Securing the Use of Wireless Fidelity (WiFi) in Libraries
Securing the Use of Wireless Fidelity (WiFi) in LibrariesSecuring the Use of Wireless Fidelity (WiFi) in Libraries
Securing the Use of Wireless Fidelity (WiFi) in Libraries
 
1Table of Contents.docx
1Table of Contents.docx1Table of Contents.docx
1Table of Contents.docx
 
Ii2514901494
Ii2514901494Ii2514901494
Ii2514901494
 
Internet of things security "Hardware Security"
Internet of things security "Hardware Security"Internet of things security "Hardware Security"
Internet of things security "Hardware Security"
 
Presentation on Cyber Security
Presentation on Cyber SecurityPresentation on Cyber Security
Presentation on Cyber Security
 

More from adolphoyonker

Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docxWitness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
adolphoyonker
 
WitnessesVarious sources require different methods of acquiring .docx
WitnessesVarious sources require different methods of acquiring .docxWitnessesVarious sources require different methods of acquiring .docx
WitnessesVarious sources require different methods of acquiring .docx
adolphoyonker
 
Without information and knowledge, meaningful participation in .docx
Without information and knowledge, meaningful participation in .docxWithout information and knowledge, meaningful participation in .docx
Without information and knowledge, meaningful participation in .docx
adolphoyonker
 
Without having any background knowledge on the situation of Gove.docx
Without having any background knowledge on the situation of Gove.docxWithout having any background knowledge on the situation of Gove.docx
Without having any background knowledge on the situation of Gove.docx
adolphoyonker
 
Within this document you will find three primary categories of i.docx
Within this document you will find three primary categories of i.docxWithin this document you will find three primary categories of i.docx
Within this document you will find three primary categories of i.docx
adolphoyonker
 
Within the field of healthcare, there are three main viewpoints .docx
Within the field of healthcare, there are three main viewpoints .docxWithin the field of healthcare, there are three main viewpoints .docx
Within the field of healthcare, there are three main viewpoints .docx
adolphoyonker
 
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docxWithin the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
adolphoyonker
 
Within the executive branch of the United States government, the p.docx
Within the executive branch of the United States government, the p.docxWithin the executive branch of the United States government, the p.docx
Within the executive branch of the United States government, the p.docx
adolphoyonker
 
Within the executive branch of the United States government, the pre.docx
Within the executive branch of the United States government, the pre.docxWithin the executive branch of the United States government, the pre.docx
Within the executive branch of the United States government, the pre.docx
adolphoyonker
 
Within the last several years, Adobe Flash became the dominant forma.docx
Within the last several years, Adobe Flash became the dominant forma.docxWithin the last several years, Adobe Flash became the dominant forma.docx
Within the last several years, Adobe Flash became the dominant forma.docx
adolphoyonker
 
Within the criminal justice system, the classification of the crime .docx
Within the criminal justice system, the classification of the crime .docxWithin the criminal justice system, the classification of the crime .docx
Within the criminal justice system, the classification of the crime .docx
adolphoyonker
 
Within Chapter 8 there is a section discussing Robert Mertons Strai.docx
Within Chapter 8 there is a section discussing Robert Mertons Strai.docxWithin Chapter 8 there is a section discussing Robert Mertons Strai.docx
Within Chapter 8 there is a section discussing Robert Mertons Strai.docx
adolphoyonker
 
Within the context of Smart Cities, many regions are employing e-tec.docx
Within the context of Smart Cities, many regions are employing e-tec.docxWithin the context of Smart Cities, many regions are employing e-tec.docx
Within the context of Smart Cities, many regions are employing e-tec.docx
adolphoyonker
 
Within Sociology as well as in social psychology, it is noted th.docx
Within Sociology as well as in social psychology, it is noted th.docxWithin Sociology as well as in social psychology, it is noted th.docx
Within Sociology as well as in social psychology, it is noted th.docx
adolphoyonker
 
within 250-300 words please describe, using reference(s) APA formatt.docx
within 250-300 words please describe, using reference(s) APA formatt.docxwithin 250-300 words please describe, using reference(s) APA formatt.docx
within 250-300 words please describe, using reference(s) APA formatt.docx
adolphoyonker
 
With which of the following statements would Thoreau most likely agr.docx
With which of the following statements would Thoreau most likely agr.docxWith which of the following statements would Thoreau most likely agr.docx
With which of the following statements would Thoreau most likely agr.docx
adolphoyonker
 
With the volatile environmental conditions surrounding CSC’s data ce.docx
With the volatile environmental conditions surrounding CSC’s data ce.docxWith the volatile environmental conditions surrounding CSC’s data ce.docx
With the volatile environmental conditions surrounding CSC’s data ce.docx
adolphoyonker
 
With the rapid development of the Internet, a big data era chara.docx
With the rapid development of the Internet, a big data era chara.docxWith the rapid development of the Internet, a big data era chara.docx
With the rapid development of the Internet, a big data era chara.docx
adolphoyonker
 
With the successful election of America’s first biracial president f.docx
With the successful election of America’s first biracial president f.docxWith the successful election of America’s first biracial president f.docx
With the successful election of America’s first biracial president f.docx
adolphoyonker
 
With this activity you will develop your analysis of a TED talk .docx
With this activity you will develop your analysis of a TED talk .docxWith this activity you will develop your analysis of a TED talk .docx
With this activity you will develop your analysis of a TED talk .docx
adolphoyonker
 

More from adolphoyonker (20)

Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docxWitness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
Witness to a Crime (Major Di1. As I mentioned in this weeks lecture.docx
 
WitnessesVarious sources require different methods of acquiring .docx
WitnessesVarious sources require different methods of acquiring .docxWitnessesVarious sources require different methods of acquiring .docx
WitnessesVarious sources require different methods of acquiring .docx
 
Without information and knowledge, meaningful participation in .docx
Without information and knowledge, meaningful participation in .docxWithout information and knowledge, meaningful participation in .docx
Without information and knowledge, meaningful participation in .docx
 
Without having any background knowledge on the situation of Gove.docx
Without having any background knowledge on the situation of Gove.docxWithout having any background knowledge on the situation of Gove.docx
Without having any background knowledge on the situation of Gove.docx
 
Within this document you will find three primary categories of i.docx
Within this document you will find three primary categories of i.docxWithin this document you will find three primary categories of i.docx
Within this document you will find three primary categories of i.docx
 
Within the field of healthcare, there are three main viewpoints .docx
Within the field of healthcare, there are three main viewpoints .docxWithin the field of healthcare, there are three main viewpoints .docx
Within the field of healthcare, there are three main viewpoints .docx
 
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docxWithin the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
Within the Unit I Podcast, Chantell, Dayna, and Dr. Rogers discuss h.docx
 
Within the executive branch of the United States government, the p.docx
Within the executive branch of the United States government, the p.docxWithin the executive branch of the United States government, the p.docx
Within the executive branch of the United States government, the p.docx
 
Within the executive branch of the United States government, the pre.docx
Within the executive branch of the United States government, the pre.docxWithin the executive branch of the United States government, the pre.docx
Within the executive branch of the United States government, the pre.docx
 
Within the last several years, Adobe Flash became the dominant forma.docx
Within the last several years, Adobe Flash became the dominant forma.docxWithin the last several years, Adobe Flash became the dominant forma.docx
Within the last several years, Adobe Flash became the dominant forma.docx
 
Within the criminal justice system, the classification of the crime .docx
Within the criminal justice system, the classification of the crime .docxWithin the criminal justice system, the classification of the crime .docx
Within the criminal justice system, the classification of the crime .docx
 
Within Chapter 8 there is a section discussing Robert Mertons Strai.docx
Within Chapter 8 there is a section discussing Robert Mertons Strai.docxWithin Chapter 8 there is a section discussing Robert Mertons Strai.docx
Within Chapter 8 there is a section discussing Robert Mertons Strai.docx
 
Within the context of Smart Cities, many regions are employing e-tec.docx
Within the context of Smart Cities, many regions are employing e-tec.docxWithin the context of Smart Cities, many regions are employing e-tec.docx
Within the context of Smart Cities, many regions are employing e-tec.docx
 
Within Sociology as well as in social psychology, it is noted th.docx
Within Sociology as well as in social psychology, it is noted th.docxWithin Sociology as well as in social psychology, it is noted th.docx
Within Sociology as well as in social psychology, it is noted th.docx
 
within 250-300 words please describe, using reference(s) APA formatt.docx
within 250-300 words please describe, using reference(s) APA formatt.docxwithin 250-300 words please describe, using reference(s) APA formatt.docx
within 250-300 words please describe, using reference(s) APA formatt.docx
 
With which of the following statements would Thoreau most likely agr.docx
With which of the following statements would Thoreau most likely agr.docxWith which of the following statements would Thoreau most likely agr.docx
With which of the following statements would Thoreau most likely agr.docx
 
With the volatile environmental conditions surrounding CSC’s data ce.docx
With the volatile environmental conditions surrounding CSC’s data ce.docxWith the volatile environmental conditions surrounding CSC’s data ce.docx
With the volatile environmental conditions surrounding CSC’s data ce.docx
 
With the rapid development of the Internet, a big data era chara.docx
With the rapid development of the Internet, a big data era chara.docxWith the rapid development of the Internet, a big data era chara.docx
With the rapid development of the Internet, a big data era chara.docx
 
With the successful election of America’s first biracial president f.docx
With the successful election of America’s first biracial president f.docxWith the successful election of America’s first biracial president f.docx
With the successful election of America’s first biracial president f.docx
 
With this activity you will develop your analysis of a TED talk .docx
With this activity you will develop your analysis of a TED talk .docxWith this activity you will develop your analysis of a TED talk .docx
With this activity you will develop your analysis of a TED talk .docx
 

Recently uploaded

How to Add Colour Kanban Records in Odoo 17 Notebook
How to Add Colour Kanban Records in Odoo 17 NotebookHow to Add Colour Kanban Records in Odoo 17 Notebook
How to Add Colour Kanban Records in Odoo 17 Notebook
Celine George
 
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptxBRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
kambal1234567890
 
How to Show Sample Data in Tree and Kanban View in Odoo 17
How to Show Sample Data in Tree and Kanban View in Odoo 17How to Show Sample Data in Tree and Kanban View in Odoo 17
How to Show Sample Data in Tree and Kanban View in Odoo 17
Celine George
 
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdfThe Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
JackieSparrow3
 
Split Shifts From Gantt View in the Odoo 17
Split Shifts From Gantt View in the  Odoo 17Split Shifts From Gantt View in the  Odoo 17
Split Shifts From Gantt View in the Odoo 17
Celine George
 
Delegation Inheritance in Odoo 17 and Its Use Cases
Delegation Inheritance in Odoo 17 and Its Use CasesDelegation Inheritance in Odoo 17 and Its Use Cases
Delegation Inheritance in Odoo 17 and Its Use Cases
Celine George
 
Webinar Innovative assessments for SOcial Emotional Skills
Webinar Innovative assessments for SOcial Emotional SkillsWebinar Innovative assessments for SOcial Emotional Skills
Webinar Innovative assessments for SOcial Emotional Skills
EduSkills OECD
 
How to Handle the Separate Discount Account on Invoice in Odoo 17
How to Handle the Separate Discount Account on Invoice in Odoo 17How to Handle the Separate Discount Account on Invoice in Odoo 17
How to Handle the Separate Discount Account on Invoice in Odoo 17
Celine George
 
Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...
Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...
Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...
Neny Isharyanti
 
Credit limit improvement system in odoo 17
Credit limit improvement system in odoo 17Credit limit improvement system in odoo 17
Credit limit improvement system in odoo 17
Celine George
 
AI_in_HR_Presentation Part 1 2024 0703.pdf
AI_in_HR_Presentation Part 1 2024 0703.pdfAI_in_HR_Presentation Part 1 2024 0703.pdf
AI_in_HR_Presentation Part 1 2024 0703.pdf
SrimanigandanMadurai
 
How to Store Data on the Odoo 17 Website
How to Store Data on the Odoo 17 WebsiteHow to Store Data on the Odoo 17 Website
How to Store Data on the Odoo 17 Website
Celine George
 
(T.L.E.) Agriculture: Essentials of Gardening
(T.L.E.) Agriculture: Essentials of Gardening(T.L.E.) Agriculture: Essentials of Gardening
(T.L.E.) Agriculture: Essentials of Gardening
MJDuyan
 
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
siemaillard
 
Howe Writing Center - Orientation Summer 2024
Howe Writing Center - Orientation Summer 2024Howe Writing Center - Orientation Summer 2024
Howe Writing Center - Orientation Summer 2024
Elizabeth Walsh
 
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Murugan Solaiyappan
 
The membership Module in the Odoo 17 ERP
The membership Module in the Odoo 17 ERPThe membership Module in the Odoo 17 ERP
The membership Module in the Odoo 17 ERP
Celine George
 
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
marianell3076
 
NLC English 7 Consolidation Lesson plan for teacher
NLC English 7 Consolidation Lesson plan for teacherNLC English 7 Consolidation Lesson plan for teacher
NLC English 7 Consolidation Lesson plan for teacher
AngelicaLubrica
 

Recently uploaded (20)

How to Add Colour Kanban Records in Odoo 17 Notebook
How to Add Colour Kanban Records in Odoo 17 NotebookHow to Add Colour Kanban Records in Odoo 17 Notebook
How to Add Colour Kanban Records in Odoo 17 Notebook
 
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptxBRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
BRIGADA ESKWELA OPENING PROGRAM KICK OFF.pptx
 
How to Show Sample Data in Tree and Kanban View in Odoo 17
How to Show Sample Data in Tree and Kanban View in Odoo 17How to Show Sample Data in Tree and Kanban View in Odoo 17
How to Show Sample Data in Tree and Kanban View in Odoo 17
 
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdfThe Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
The Jewish Trinity : Sabbath,Shekinah and Sanctuary 4.pdf
 
Split Shifts From Gantt View in the Odoo 17
Split Shifts From Gantt View in the  Odoo 17Split Shifts From Gantt View in the  Odoo 17
Split Shifts From Gantt View in the Odoo 17
 
Delegation Inheritance in Odoo 17 and Its Use Cases
Delegation Inheritance in Odoo 17 and Its Use CasesDelegation Inheritance in Odoo 17 and Its Use Cases
Delegation Inheritance in Odoo 17 and Its Use Cases
 
Webinar Innovative assessments for SOcial Emotional Skills
Webinar Innovative assessments for SOcial Emotional SkillsWebinar Innovative assessments for SOcial Emotional Skills
Webinar Innovative assessments for SOcial Emotional Skills
 
How to Handle the Separate Discount Account on Invoice in Odoo 17
How to Handle the Separate Discount Account on Invoice in Odoo 17How to Handle the Separate Discount Account on Invoice in Odoo 17
How to Handle the Separate Discount Account on Invoice in Odoo 17
 
Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...
Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...
Understanding and Interpreting Teachers’ TPACK for Teaching Multimodalities i...
 
Credit limit improvement system in odoo 17
Credit limit improvement system in odoo 17Credit limit improvement system in odoo 17
Credit limit improvement system in odoo 17
 
AI_in_HR_Presentation Part 1 2024 0703.pdf
AI_in_HR_Presentation Part 1 2024 0703.pdfAI_in_HR_Presentation Part 1 2024 0703.pdf
AI_in_HR_Presentation Part 1 2024 0703.pdf
 
How to Store Data on the Odoo 17 Website
How to Store Data on the Odoo 17 WebsiteHow to Store Data on the Odoo 17 Website
How to Store Data on the Odoo 17 Website
 
(T.L.E.) Agriculture: Essentials of Gardening
(T.L.E.) Agriculture: Essentials of Gardening(T.L.E.) Agriculture: Essentials of Gardening
(T.L.E.) Agriculture: Essentials of Gardening
 
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
 
Howe Writing Center - Orientation Summer 2024
Howe Writing Center - Orientation Summer 2024Howe Writing Center - Orientation Summer 2024
Howe Writing Center - Orientation Summer 2024
 
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
Lecture_Notes_Unit4_Chapter_8_9_10_RDBMS for the students affiliated by alaga...
 
“A NOSSA CA(U)SA”. .
“A NOSSA CA(U)SA”.                      .“A NOSSA CA(U)SA”.                      .
“A NOSSA CA(U)SA”. .
 
The membership Module in the Odoo 17 ERP
The membership Module in the Odoo 17 ERPThe membership Module in the Odoo 17 ERP
The membership Module in the Odoo 17 ERP
 
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
 
NLC English 7 Consolidation Lesson plan for teacher
NLC English 7 Consolidation Lesson plan for teacherNLC English 7 Consolidation Lesson plan for teacher
NLC English 7 Consolidation Lesson plan for teacher
 

Wireless Security and Mobile DevicesChapter 12Princi.docx

  • 1. Wireless Security and Mobile Devices Chapter 12 Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Objectives Describe the different wireless systems in use today. Detail WAP and its security implications. Identify 802.11’s security issues and possible solutions. Learn about the different types of wireless attacks. Examine the elements needed for enterprise wireless deployment. Examine the security of mobile systems. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 2 Key Terms (1 of 4) Beacon frames
  • 2. Bluebugging Bluejacking Bluesnarfing Bluetooth Bluetooth DoS Captive portal Containerization Custom firmware Direct-sequence spread spectrum (DSSS) Disassociation Extensible Authentication Protocol (EAP) EAP-FAST EAP-TLS EAP-TTLS Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Beacon frames – A series of frames used in WiFi (802.11) to establish the presence of a wireless network device. Bluebugging – The use of a Bluetooth-enabled device to eavesdrop on another person’s conversation using that person’s Bluetooth phone as a transmitter. The bluebug application silently causes a Bluetooth device to make a phone call to another device, causing the phone to act as a transmitter and allowing the listener to eavesdrop on the victim’s conversation in real time. Bluejacking – The sending of unsolicited messages over Bluetooth to Bluetooth-enabled devices such as mobile phones, tablets, or laptop computers. Bluesnarfing – The unauthorized access of information from a Bluetooth-enabled device through a Bluetooth connection, often
  • 3. between phones, desktops, laptops, and tablets. Bluetooth DOS – The use of Bluetooth technology to perform a denial-of-service attack against another device. In this attack, an attacker repeatedly requests pairing with the victim device. This type of attack does not divulge information or permit access, but is a nuisance. And, more importantly, if done repeatedly it can drain a device’s battery, or prevent other operations from occurring on the victim’s device. Captive portal – A website used to validate credentials before allowing access to a network connection. Containerization – Dividing a device into a series of containers, with one container holding work-related materials and the other personal materials. Custom firmware - Firmware for a device that has been altered from the original factory settings. Direct-sequence spread spectrum (DSSS) – A method of distributing a communication over multiple frequencies to avoid interference and detection. Disassociation – An attack against a wireless system designed to disassociate a host from the wireless access point, and from the wireless network. Disassociation attacks stem from the deauthentication frame that is in the IEEE 802.11 (Wi-Fi) standard. Extensible Authentication Protocol (EAP) – A protocol defined in RFC 2284 (obsoleted by 3748). The framework is used to secure the authentication process, not an actual encryption method. Many variants exist. EAP-FAST – EAP–Flexible Authentication via Secure Tunneling is described in RFC-4851 and proposed by Cisco to be a replacement for LEAP, a previous Cisco version of EAP. It offers a lightweight, tunneling protocol to enable authentication. The distinguishing characteristic is the passing of a Protected Access Credential (PAC) that’s used to establish a TLS tunnel through which client credentials are verified. EAP-TLS – An IETF open standard (RFC 5216) that uses the Transport Layer Security (TLS) protocol to secure the
  • 4. authentication process. This is still considered one of the most secure implementations, primarily because common implementations employ client-side certificates. EAP-TTLS – An extension of TLS called Tunneled TLS. In EAP-TTLS, the authentication process is protected by the tunnel from man-in-the-middle attacks, and although client certificates can be used, they are not required, making this easier to set up than EAP-TLS for clients without certificates. 3 Key Terms (2 of 4) Evil twin Firmware OTA updates Geo-tagging IEEE 802.1X Infrared (IR) Initialization vector (IV) Jailbreaking Jamming MAC filtering MIMO Mobile device management (MDM) Multimedia Messaging Service (MMS) Near field communication (NFC) Orthogonal frequency division multiplexing (OFDM) Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Evil twin – A wireless attack performed using a second, rogue wireless access point designed to mimic a real access point. Firmware OTA updates - A solution of updating mobile device
  • 5. firmware without bringing the device to a central location or connection for updating. Geo-tagging – The metadata that contains location-specific information that is attached to other data elements. IEEE 802.1X – An IEEE standard for performing authentication over networks. Infrared (IR) – A band of electromagnetic energy just beyond the red end of the visible color spectrum. Initialization vector (IV) – A data value used to seed a cryptographic algorithm, providing for a measure of randomness. Jailbreaking – The process of breaking OS security features designed to limit interactions with the OS itself. Commonly performed on mobile phones to unlock features or break locks to carriers. Jamming – A form of denial of service, specifically against the radio spectrum aspect of wireless. Just as other DoS attacks can manipulate things behind the scenes, so can jamming on a wireless AP, enabling things such as attachment to a rogue AP. MAC filtering – The use of layer 2 MAC addresses to filter traffic to only authorized NIC cards. MIMO – A set of multiple-input and multiple-output antenna technologies where the available antennas are spread over a multitude of independent access points each having one or multiple antennas. Mobile device management (MDM) – A marketing term for a collective set of commonly employed protection elements associated with mobile devices. Multimedia Messaging Service (MMS) – A standard protocol used to send messages, including multimedia content to and from mobile devices over a cellular network. Near field communication (NFC) – A set of standards and protocols for establishing a communication link over very short distances. Used in mobile devices. Orthogonal frequency division multiplexing (OFDM) – Multiplexes, or separates, the data to be transmitted into smaller
  • 6. chunks and then transmits the chunks on several subchannels. This use of subchannels is what the “frequency division” portion of the name refers to. Both of these techniques, multiplexing and frequency division, are used to avoid interference. Orthogonal refers to the manner in which the subchannels are assigned, principally to avoid crosstalk, or interference with your own channels. 4 Key Terms (3 of 4) PEAP Radio Frequency Identification (RFID) RC4 stream cipher Remote wiping Replay attack Rogue access point Rooting Screen locking Service set identifier (SSID) Short Message Service (SMS) Sideloading Site survey Storage segmentation Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. PEAP – Protected EAP, was developed to protect the EAP communication by encapsulating it with TLS. This is an open standard developed jointly by Cisco, Microsoft, and RSA. EAP was designed assuming a secure communication channel. PEAP
  • 7. provides that protection as part of the protocol via a TLS tunnel. PEAP is widely supported by vendors for use over wireless networks. Radio Frequency Identification (RFID) – RFID tags are used in a wide range of use cases. From tracking devices to tracking keys, the unique serialization of these remotely sensible devices has made them useful in a wide range of applications. RFID tags come in several different forms and can be classified as either active or passive. RC4 stream cipher – A stream cipher used in TLS and WEP. Remote wiping – An action that typically removes data stored on the device and resets the device to factory settings. Replay attack – An attack that occurs when the attacker captures a portion of a communication between two parties and retransmits it at a later time. Rogue access point – An unauthorized access point inserted into a network allowing unauthorized wireless access. Rooting – A process whereby OS controls are bypassed. This is the term frequently used for Android devices. Screen locking – A phone’s capability whereby one must enter a passcode or PIN to unlock the device. It is highly recommended that screen locks be enforced for all mobile devices. Service set identifier (SSID) – Identifies a specific 802.11 wireless network. It transmits information about the access point to which the wireless client is connecting. Short Message Service (SMS) – A standard protocol used to send messages to and from mobile devices over a cellular network. SMS is limited to short text-only messages of less than 160 characters and is carried over the signaling path of the cellular network when signaling data is not being sent. Sideloading – The process of adding apps to a mobile device without using the authorized store associated with the device. Site survey – Involves several steps: mapping the floor plan, testing for RF interference, testing for RF coverage, and analysis of material via software. Storage segmentation – A processes similar to containerization
  • 8. in that it represents a logical separation of the storage in the unit. 5 Key Terms (4 of 4) Temporal Key Integrity Protocol (TKIP) USB OTG (USB On-The-Go) WAP gap War-chalking War dialing War driving Wi-Fi Protected Access 2 (WPA2) WiMAX Wired Equivalent Privacy (WEP) Wireless Application Protocol (WAP) Wireless Transport Layer Security (WTLS) ZigBee Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Temporal Key Integrity Protocol (TKIP) – A security protocol used in 802.11 wireless networks. USB OTG (USB On-The-Go) – An extension of USB technology that facilitates direct connection between USB OTG–enabled mobile devices. WAP gap – Refers to the confidentiality of information where the two different networks meet on the WAP gateway. War-chalking – The act of using chalk on sidewalks to mark some of the wireless networks people have found. War dialing – The process of dialing a list of phone numbers looking for modem-connected computers.
  • 9. War driving – The act of driving around with a wireless locater program recording the number of networks found and their locations. Wi-Fi Protected Access 2 (WPA2) – A protocol to secure wireless communications using a subset of the 802.11i standard. WiMAX – A wireless band that refers to the set of 802.16 wireless network standards ratified by the WiMAX Forum. Wired Equivalent Privacy (WEP) – An 802.11 protocol that uses a cipher to encrypt the data as it is transmitted through the air. Wireless Application Protocol (WAP) – A lightweight protocol designed for mobile devices. Wireless Transport Layer Security (WTLS) – A lightweight security protocol designed for WAP. ZigBee – A low-power, personal area networking technology described by the IEEE 802.15.4 series. 6 Introduction to Wireless Networking (1 of 3) Wireless networking is the transmission of packetized data by means of a physical topology that does not use direct physical links. Bluetooth is a short-range wireless protocol typically used on small devices such as mobile phones. Wireless is problematic from a security standpoint. Wireless does away with the physical limitations. If attacker gets close enough to signal’s source he can listen to the access point and clients talking in order to capture all the packets for examination. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved.
  • 10. The IEEE 802.11 protocol has been standardized by the IEEE for wireless local area networks (LANs). Three versions are currently in production—802.11g, 802.11a, and 802.11n. The latest standard is 802.11ac, but it provides backward compatibility with 802.11g hardware. Cellular phone technology has moved rapidly to embrace data transmission and the Internet. The Wireless Application Protocol (WAP) was one of the pioneers of mobile data applications, but it has been overtaken by a variety of protocols pushing us to fourth-generation (4G) mobile networks. Bluetooth is a short-range wireless protocol typically used on small devices such as mobile phones. Early versions of these phones also had Bluetooth on and discoverable as a default, making the compromise of a nearby phone easy. Security research has focused on finding problems with these devices simply because the devices are so common. 7 Introduction to Wireless Networking (2 of 3) There are several different wireless bands in common use today. Wi-Fi series refers to the 802.11 Wireless LAN standards certified by the Wi-Fi Alliance. WiMAX refers to the set of 802.16 wireless network standards ratified by the WiMAX Forum. ZigBee is a low-power, personal area networking technology described by the IEEE 802.15.4 series. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved.
  • 11. Tech Tip: There are several different wireless bands in common use today, the most common of which is the Wi-Fi series, referring to the 802.11 Wireless LAN standards certified by the Wi-Fi Alliance. Another set of bands is WiMAX, which refers to the set of 802.16 wireless network standards ratified by the WiMAX Forum. Lastly, there is ZigBee, a lowpower, personal area networking technology described by the IEEE 802.15.4 series. 8 Introduction to Wireless Networking (3 of 3) Figure 12.1 Wireless transmission extending beyond the facility’s walls Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. If an attacker can get close enough to the signal’s source as it is being broadcast, he can at the very least listen to the access point and clients talking to capture all the packets for examination, as depicted in this figure. Attackers can also try to modify the traffic being sent or try to send their own traffic to disrupt the system. In this chapter, you will learn about the different types of attacks that wireless networks face. 9 Mobile Phones (1 of 2) Today’s smartphones support multiple wireless data access methods.
  • 12. This includes 802.11, Bluetooth, and cellular. The Wireless Application Protocol (WAP) attempted to satisfy the needs for more data on mobile devices, but it is falling by the wayside as the mobile network capabilities increase. The need for more and more bandwidth has pushed carriers to adopt a more IP-centric routing methodology. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. The need for more and more bandwidth has pushed carriers to adopt a more IP-centric routing methodology with technologies such as High Speed Packet Access (HSPA) and Evolution Data Optimized (EVDO). Mobile phones have ruthlessly advanced with new technologies and services, causing phones and the carrier networks that support them to be described in generations—1G, 2G, 3G, and 4G. 1G refers to the original analog cellular standard, Advanced Mobile Phone System (AMPS). 2G refers to the digital network that superseded it. 3G is the system of mobile networks that followed, with many different implementations carrying data at up to 400 Kbps. 4G represents the current state of mobile phones with LTE being the primary method. 4G allows carriers to offer a wider array of services to the consumer, including broadband data service up to 14.4 Mbps and video calling. 4G is also a move to an entirely IP-based network for all services, running voice over IP (VoIP) on your mobile phone and speeds up to 1 Gbps. All of these “gee-whiz” features are nice, but how secure are your bits and bytes going to be when they’re traveling across a mobile carrier’s network? All the protocols mentioned have their own security implementations—WAP applies its own Wireless Transport Layer Security (WTLS) to attempt to secure
  • 13. data transmissions, but WAP still has issues such as the “WAP gap” (as discussed next). 3G networks have attempted to push a large amount of security down the stack and rely on the encryption designed into the wireless protocol. 10 Mobile Phones (2 of 2) Early cell phones just allowed you to make calls. Today’s phones allow you to carry computers in your pocket. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. When cellular phones first hit the market, security wasn’t an issue—if you wanted to keep your phone safe, you’d simply keep it physically secure and not loan it to people you didn’t want making calls. Its only function was that of a telephone. The advance of digital circuitry has added amazing power in smaller and smaller devices, causing security to be an issue as the software becomes more and more complicated. Today’s small and inexpensive products have made the wireless market grow by leaps and bounds, as traditional wireless devices such as cellular phones and pagers have been replaced by tablets and smartphones. 11 Wireless Application Protocol (1 of 5) WAP was introduced to compensate for the relatively low amount of computing power on handheld devices as well as the
  • 14. generally poor network throughput of cellular networks. Wireless Transport Layer Security (WTLS) encryption scheme encrypts the plaintext data and then sends it over the airwaves as ciphertext. The originator and the recipient both have keys to decrypt the data and reproduce the plaintext. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 12 Wireless Application Protocol (2 of 5) WTLS uses a modified version of the Transport Layer Security (TLS) protocol. WTLS supports several bulk encryption algorithms. WTLS implements integrity through the use of message authentication codes (MACs). The TLS protocol that WTLS is based on is designed around Internet-based computers. WTLS must cope with small amounts of memory and limited processor capacity. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved.
  • 15. 13 Wireless Application Protocol (3 of 5) The WTLS protocol is designed around more capable servers than devices and can allow connections with little to no security. Clients with low memory or CPU capabilities cannot support encryption which greatly reduces confidentiality. Authentication is optional and omitting it leaves the connection vulnerable to a man-in-the-middle–type attack. General flaws in the protocol’s implementation exist. Known security vulnerabilities include the chosen plaintext attack, the PKCS #1 attack, and the alert message truncation attack. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 14 Wireless Application Protocol (4 of 5) The chosen-plaintext attack works on the principle of a predictable initialization vector (IV). Concern over the WAP gap involves confidentiality of information where the two different networks meet the WAP gateway. WTLS acts as the security protocol for the WAP network, and TLS is the standard for the Internet. The WAP gateway has to perform translation from one encryption standard to the other.
  • 16. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 15 Wireless Application Protocol (5 of 5) Figure 12.2 The WAP gap shows an unencrypted space between two enciphered connections. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Some concern over the so-called WAP gap involves confidentiality of information where the two different networks meet, the WAP gateway, as shown in this figure. 16 3G Mobile Networks Several competing data transmission standards, such as HSPA and EVDO, exist for 3G networks. All standards include transport layer encryption protocols to secure the voice traffic traveling across the wireless signal as well as the data sent by the device. KASUMI is the proposed 3G cryptographic standard. This modified version of the MISTY1 algorithm uses 64-bit blocks and 128-bit keys. Multiple attacks have been launched against this cipher.
  • 17. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Our cell phones are one of the most visible indicators of advancing technology. Within recent memory, we were forced to switch from old analog phones to digital models. The networks have been upgraded to 3G, greatly enhancing speed and lowering latency. This has reduced the need for lightweight protocols to handle data transmission, and more standard protocols such as IP can be used. The increased power and memory of the handheld devices also reduce the need for lighter-weight encryption protocols. This has caused the protocols used for 3G mobile devices to build in their own encryption protocols. Security will rely on these lower-level protocols or standard application-level security protocols used in normal IP traffic. Multiple attacks have been launched against this cipher. While the attacks tend to be impractical, this shows that application layer security is needed for secure transmission of data on mobile devices. WAP and WTLS can be used over the lower- level protocols, but traditional TLS can also be used. 17 4G Mobile Networks 4G can support high-quality VoIP connections, video calls, and real-time video streaming. True 4G would require a firm to meet all of the technical standards issued by the ITU, including specifications that apply to the tower side of the system. Most 4G deployments are continuations of technologies already deployed—just newer evolutions of standards.
  • 18. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Just as the mobile network carriers were finishing the rollout of 3G services, 4G networks appeared on the horizon. The desire for anywhere, anytime Internet connectivity at speeds near that of a wired connection drives deployment of these next- generation services. 4G can support high-quality VoIP connections, video calls, and real-time video streaming. Just as 3G had some intermediaries that were considered 2.9G, LTE and WiMAX networks are sometimes referred to as 3.5G, 3.75G, or 3.9G. The carriers are marketing these new networks as 4G, although they do not adhere to the ITU standards for 4G speeds. Some of the 4G requirements are: Be based on an all-IP packet switched network Offer high quality of service for next-generation multimedia support Smooth handovers across heterogeneous networks Peak data rates of up to approximately 100 Mbps for high mobility (mobile access) Peak data rates of up to approximately 1 Gbps for low mobility such as nomadic/local wireless access Dynamically share and use the network resources to support more simultaneous users per cell Use scalable channel bandwidths of 5–20 MHz, optionally up to 40 MHz Peak link spectral efficiency of 15-bps/Hz in the downlink, and 6.75-bps/Hz in the uplink To achieve these and other technical elements requires specific tower-side equipment as well as handset specifications.
  • 19. Different carriers have chosen different sets of these to include in their offerings, each building upon their existing networks and existing technologies. Most 4G deployments are continuations of technologies already deployed—just newer evolutions of standards. This is how LTE, LTE Advanced, WiMAX, and WiMAX 2 were born. LTE and WiMAX series come from separate roots, and are not interchangeable. Within the families, interoperability is possible and is dependent upon carrier implementation. 18 SATCOM SATCOM (Satellite Communications) is the use of terrestrial transmitters and receivers and satellites in orbit to transfer the signals. SATCOM can be one way, as in satellite radio, but for most communications two-way signals are needed. In high-density urban areas Cost and line-of-sight issues make SATCOM a costly option. In rural areas or remote areas, or mobile areas such as at sea SATCOM is one of the only options for communications. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 19 Bluetooth (1 of 3) Bluetooth is a short-range (approx. 32 feet), low-power wireless protocol transmitting in the 2.4 GHz band. Bluetooth transmits data in Personal Area Networks (PANs)
  • 20. through mobile phones, laptops, printers, and audio devices. Version 1.2 allows speeds up to 721 Kbps and improves resistance to interference over version 1.1. Bluetooth 2.0 introduced enhanced data rate (EDR), which allows the transmission of up to 3.0 Mbps. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Bluetooth was originally developed by Ericsson and known as multi-communicator link; in 1998, Nokia, IBM, Intel, and Toshiba joined Ericsson and adopted the Bluetooth name. This consortium became known as the Bluetooth Special Interest Group (SIG). The SIG now has more than 24,000 members and drives the development of the technology and controls the specification to ensure interoperability. Most people are familiar with Bluetooth as it is part of many mobile phones and headsets, such as those shown in Figure 12.3. This short-range, low-power wireless protocol transmits in the 2.4 GHz band, the same band used for 802.11. The concept for the short-range (approx. 32 feet) wireless protocol is to transmit data in personal area networks (PANs). Bluetooth transmits and receives data from a variety of devices, the most common being mobile phones, laptops, printers, and audio devices. The mobile phone has driven a lot of Bluetooth growth and has even spread Bluetooth into new cars as a mobile phone hands-free kit. Bluetooth has gone through a few releases. Version 1.1 was the first commercially successful version, with version 1.2 released in 2007 and correcting some of the problems found in 1.1.
  • 21. Version 1.2 allows speeds up to 721 Kbps and improves resistance to interference. Version 1.2 is backward-compatible with version 1.1. With the rate of advancement and the life of most tech items, Bluetooth 1 series is basically extinct. Bluetooth 2.0 introduced enhanced data rate (EDR), which allows the transmission of up to 3.0 Mbps. Bluetooth 3.0 has the capability to use an 802.11 channel to achieve speeds up to 24 Mbps. The current version is the Bluetooth 4.0 standard with support for three modes: classic, high speed, and low energy. Bluetooth 4 introduces a new method to support collecting data from devices that generate data at a very low rate. Some devices, such as medical devices, may only collect and transmit data at low rates. This feature, called Low Energy (LE), was designed to aggregate data from various sensors, like heart rate monitors, thermometers, and so forth, and carries the commercial name Bluetooth Smart. As Bluetooth became popular, people started trying to find holes in it. Bluetooth features easy configuration of devices to allow communication, with no need for network addresses or ports. Bluetooth uses pairing to establish a trust relationship between devices. To establish that trust, the devices advertise capabilities and require a passkey. To help maintain security, most devices require the passkey to be entered into both devices; this prevents a default passkey–type attack. The Bluetooth’s protocol advertisement of services and pairing properties is where some of the security issues start. 20 Bluetooth (2 of 3) Figure 12.3 Headsets and cell phones are two of the most popular types of Bluetooth-capable devices.
  • 22. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Most people are familiar with Bluetooth as it is part of many mobile phones and headsets, such as those shown in this figure. 21 Bluetooth (3 of 3) Bluetooth 3.0 has the capability to use an 802.11 channel to achieve speeds up to 24 Mbps. Bluetooth 4.0 standard with support for three modes: classic, high speed, and low energy. Bluetooth 4 introduces a new method to support collecting data from devices that generate data at a very low rate. Bluetooth features easy configuration of devices to allow communication, with no need for network addresses or ports. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 22 Bluetooth Attacks Bluetooth is open to connection and attack from outside the intended sender and receiver. Several different attack modes have been discovered that can be used …
  • 23. Authentication and Remote Access Chapter 11 Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Objectives (1 of 2) Identify the differences among user, group, and role management. Implement password and domain password policies. Describe methods of account management (SSO, time of day, logical token, account expiration). Describe methods of access management (MAC, DAC, and RBAC). Discuss the methods and protocols for remote access to networks. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 2 Objectives (2 of 2) Identify authentication, authorization, and accounting (AAA)
  • 24. protocols. Explain authentication methods and the security implications in their use. Implement virtual private networks (VPNs) and their security aspects. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 3 Key Terms (1 of 9) AAA Access control Access control list (ACL) Access control matrix Accounting Account expiration Account maintenance Account recertification Administrator Attribute-based access control (ABAC) Authentication Authentication server (AS) Authorization Basic authentication Biometric factors Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved.
  • 25. AAA – Acronym for authentication, authorization, and accounting (AAA). They are three common functions performed upon system login. Authentication and authorization almost always occur, with accounting being somewhat less common. Access control – Mechanism or method used to determine what access permissions subjects (such as users) have for specific objects (such as files). Access control list (ACL) – A list associated with an object (such as a file) that identifies what level of access each subject (such as a user) has—what they can do to the object (such as read, write, or execute). Access control matrix – A matrix that provides the simplest framework for illustrating a process. Accounting – The collection of billing and other detail records. Account expiration – The setting of an ending time for an account’s validity. Account maintenance – The routine screening of all tributes for an account. Account recertifcation – The process of recertifying an account periodically. The process of recertifcation ensures that only users needing accounts have accounts in the system. Administrator – A superuser account under the Windows operating system. Attribute-based access control (ABAC) – An access control model built around a set of rules built upon specific attributes. Authentication – The process by which a subject’s (such as a user’s) identity is verified. Authentication server (AS) – A server used to perform authentication tasks. Authorization – The function of determining what is permitted for an authorized user. Basic authentication – The simplest technique used to manage access control across HTTP. Basic authentication operates by passing information encoded in Base64 form using standard
  • 26. HTTP headers. This is a plaintext method without any pretense of security. Biometric factors – The measurements of certain biological features to identify one specific person from other people. These factors are based on parts of the human body that are unique. The most well-known of these unique biological factors is the fingerprint. 4 Key Terms (2 of 9) Certificate Challenge-Handshake Authentication Protocol (CHAP) Client-to-server ticket Common Access Card (CAC) Credential Management Crossover error rate Digest authentication Digital certificate Directory Discretionary access control (DAC) Domain controller Domain password policy Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Certificate – A method of establishing authenticity of specific objects such as an individual’s public key or downloaded software. Challenge-Handshake Authentication Protocol (CHAP) – A protocol used to provide authentication across a point-to-point link using PPP. In this protocol, authentication after the link has
  • 27. been established is not mandatory. Client-to-server ticket – The second ticket used in the Kerberos environment that is used to gain access to a server’s service in the realm. The user presents a request and a client-to-server ticket to the desired service and if the client-to-server ticket is valid, service is granted to the client. Also called a service ticket. Common Access Card (CAC) – A smart card identification used by the U.S. Department of Defense (DoD) for active duty military, selected reserve personnel, DoD civilians, and eligible contractors. It is used for carrying the credential data, in the form of a certificate, for the cardholder used to determine access to Federal facilities and information systems. Credential management – Refers to the processes, services, and software used to store, manage, and log the use of user credentials. Credential management solutions are typically aimed at assisting end users manage their growing set of passwords. Crossover error rate – The rate where both accept and reject error rates are equal. This is the desired state for most efficient operation, and it can be managed by manipulating the threshold value used for matching. Also known as the equal error rate (EER), Digest authentication – A method used to negotiate credentials across the Web. Digest authentication uses hash functions and a nonce to improve security over basic authentication. Digital certificate – A digital file that is sent as an attachment to a message and is used to verify that the message did indeed come from the entity it claims to have come from. Directory – A data storage mechanism similar to a database, but it has several distinct differences designed to provide efficient data-retrieval services compared to standard database mechanisms. A directory is designed and optimized for reading data, offering very fast search and retrieval operations. Discretionary access control (DAC) – An access control mechanism in which the owner of an object (such as a file) can
  • 28. decide which other subjects (such as other users) may have access to the object, and what access (read, write, execute) these objects can have. Domain controller – A computer that responds to security authentication requests, such as logging into a computer, for a Windows domain. Domain password policy – A password policy for a specific domain. 5 Key Terms (3 of 9) eXtensible Access Control Markup Language (XACML) Extensible Authentication Protocol (EAP) False acceptance rate False negative False positive False rejection rate Federated identity management FTPS Generic accounts Group Group policy object (GPO) Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. eXtensible Access Control Markup Language (XACML) – An open standard XML-based language used to describe access control. Extensible Authentication Protocol (EAP) – A universal authentication framework defined by RFC 3748 that is frequently used in wireless networks and point-to-point
  • 29. connections. Although EAP is not limited to wireless and can be used for wired authentication, it is most often used in wireless LANs. False acceptance rate (FAR) – A measurement of the level of false positives are going to be allowed in the system. Expressed as probabilities, the false acceptance rate is the probability that the system incorrectly identifies a match between the biometric input and the stored template value. The FAR is calculated by counting the number of unauthorized accesses granted, divided by the total number of access attempts. False negative – An instance when the system denies access to someone who is actually authorized. False positive – An instance where you receive a positive result for a test, when you should have received a negative result. Thus, a false positive result occurs when a biometric is scanned and allows access to someone who is not authorized. False rejection rate (FRR) – A measurement of what level of false negatives, or rejections, are going to be allowed in the system. If an authorized user is rejected by the system, this is a false rejection. Federated identity management – An agreement between multiple enterprises that lets parties use the same identification data to obtain access to the networks of all enterprises in the group. This federation enables access to be managed across multiple systems in common trust levels. FTPS – The use of FTP over an SSL/TLS secured channel. Generic accounts – Accounts without a named user behind them. These can be employed for special purposes, such as running services and batch processes, but because they cannot be attributed to an individual, they should not have login capability. Group – A collection of users with some common criteria, such as a need for access to a particular dataset or group of applications. Group policy object (GPO) – Stores the group policy settings in a Microsoft Active Directory environment.
  • 30. 6 Key Terms (4 of 9) Guest accounts HMAC-based One-Time Password (HOTP) Identification IEEE 802.1X Kerberos Key distribution center (KDC) Layer 2 Tunneling Protocol (L2TP) Lightweight Directory Access Protocol (LDAP) Mandatory access control (MAC) Multifactor identification Mutual authentication Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Guest accounts – Frequently used on corporate networks to provide visitors’ access to the Internet and to some common corporate resources, such as projectors, printers in conference rooms, and so on. Again, these types of accounts are restricted in their network capability to a defined set of machines, with a defined set of access, much like a user from the Internet visiting their publically facing web site. HMAC-based One-Time Password (HOTP) – An algorithm that can be used to authenticate a user in a system by using an authentication server. (HMAC stands for Hash-based Message Authentication Code.)
  • 31. Identification – The process of determining identity as part of identity management and access control. Usually performed only once, when the user ID is assigned. IEEE 802.1X – An authentication standard that supports port- based authentication services between a user and an authorization device, such as an edge router. Kerberos – A network authentication protocol designed by MIT for use in client/server environments. Key distribution center (KDC) – A portion of the Kerberos authentication system. Layer 2 Tunneling Protocol (L2TP) – A Cisco switching protocol that operates at the data link layer. Lightweight Directory Access Protocol (LDAP) – An offshoot of the Directory Access Protocol (DAP) that offers all of the functionality most directories need and is easier and more economical to implement. It is the protocol that is commonly used to handle user authentication/authorization as well as control access to Active Directory objects. Mandatory access control (MAC) – An access control mechanism in which the security mechanism controls access to all objects (files), and individual subjects (processes or users) cannot change that access. Multifactor authentication – Simply the combination of two or more types of authentication. Also known as multiple-factor authentication. Mutual authentication – Describes a process in which each side of an electronic communication verifies the authenticity of the other. 7 Key Terms (5 of 9) OAuth (Open Authorization) Offboarding Onboarding OpenID
  • 32. OpenID Connect Password Authentication Protocol (PAP) Permissions Personal identity verification (PIC) Point-to-point protocol (PPP) Point-to-Point Tunneling Protocol (PPTP) Privilege management Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. OAuth (Open Authorization) – An open protocol that allows secure token based authentication and authorization in a simple and standard method from web, mobile, and desktop applications, for authorization on the Internet. Offboarding – Involves the bringing of personnel onto a project or team. During onboarding, proper account relationships need to be managed. New members can be put into the correct groups. Onboarding – Involves the taking personnel off a project or team. When people are offboarded, they can be removed from the groups they were added to when brought onto the project. OpenID – OpenID is about proving who you are, the first step in the Authentication-Authorization ladder used for authentication. OpenID was created for federated authentication that lets a third party authenticate your users for you, by using accounts the users already have. OpenID connect – A simple identity layer on top of the OAuth 2.0 protocol. OpenID Connect allows clients of all types (mobile, JavaScript, and web based clients) to request and receive information about authenticated sessions and end users. Password Authentication Protocol (PAP) – A protocol that involves a two-way handshake in which the username and
  • 33. password are sent across the link in cleartext. PAP authentication does not provide any protection against playback and line sniffing. PAP is now a deprecated standard. Permissions – Authorized actions a subject can perform on an object. See also access controls. Personal identity verification (PIV) – A U.S. government smart card that contains the credential data for the cardholder used to determine access to federal facilities and information systems. Point-to-Point Protocol (PPP) – An older, still widely used protocol for establishing dial-in connections over serial lines or Integrated Services Digital Network (ISDN) services. PPP has several authentication mechanisms, including PAP, CHAP, and the Extensible Authentication Protocol (EAP). Point-to-Point Tunneling Protocol (PPTP) – The use of generic routing encapsulation over PPP to create a methodology used for virtual private networking. Privilege management – The process of restricting a user’s ability to interact with the computer system. 8 Key Terms (6 of 9) Privileged accounts Privileges Remote access server (RAS) Remote Authentication Dial-In User Service (RADIUS) Remote Desktop Protocol (RDP) Rights Role Role-based access control (RBAC) Root Rule-based access control Principles of Computer Security, Fifth Edition
  • 34. Copyright © 2018 by McGraw-Hill Education. All rights reserved. Privileged accounts – Any accounts with greater than normal user access. Privileged accounts are typically root or admin- level accounts and represent risk in that they are unlimited in their powers. Privileges – Term meaning that you have the ability to “do something” on a computer system such as create a directory, delete a file, or run a program. Remote access server (RAS) – A combination of hardware and software used to enable remote access to a network. Remote Authentication Dial-In User Service (RADIUS) – An AAA protocol designed as a connectionless protocol that uses the User Datagram Protocol (UDP) as its transport layer protocol. Connection type issues, such as timeouts, are handled by the RADIUS application instead of the transport layer. RADIUS utilizes UDP port 1812 for authentication and authorization and UDP port 1813 for accounting functions. Remote Desktop Protocol (RDP) – A proprietary Microsoft protocol designed to provide a graphical connection to another computer. Rights – These define the actions a user can perform on the system itself, such as change the time, adjust auditing levels, and so on. Rights are typically applied to operating system– level tasks. Role – Term used to describe a person’s job or function within the organization. Role-based access control (RBAC) – An access control mechanism in which, instead of the users being assigned specific access permissions for the objects associated with the computer system or network, a set of roles that the user may perform is assigned to each user. Root – An account under Unix that is reserved for special functions and typically have much more access and control over
  • 35. the computer system than the average user account. Rule-based access control – An access control mechanism based on rules. 9 Key Terms (7 of 9) Security Assertion Markup Language (SAML) Secure token Service accounts SFTP Single sign-on (SSO) Shared accounts Shibboleth Smart card Software tokens Something you are Something you do Something you have Something you know Somewhere you are Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Security Assertion Markup Language (SAML) – A single sign- on capability used for web applications to ensure user identities can be shared and are protected. Secure token – A service that is responsible for issuing, validating, renewing, and cancelling these security tokens. Service accounts – Accounts that are used to run processes that do not require human intervention to start/stop/administer.
  • 36. SFTP – SFTP refers to running FTP over SSH, as later versions of SSH allow securing of channels such as the FTP control channel. SFTP is also referred to as Secure FTP. Single sign-on (SSO) – An authentication process by which the user can enter a single user ID and password and then move from application to application or resource to resource without having to supply further authentication information. Shared accounts – Go against the specific treatise that accounts exist so that user activity can be tracked. They exist only to provide a specific set of functionality, like in a PC running in kiosk mode, with a browser limited to specific sites as an information display. Sometimes the shared accounts are called generic accounts. Shibboleth – A service designed to enable single sign-on and federated identity-based authentication and authorization across networks. Smart card – A card that can increase physical security because they can carry cryptographic tokens that are too long to remember and have too large a space to guess. Software tokens – An access tokens that is implemented in software. Something you are – A one of the categories of authentication factors. It specifically refers to biometrics, as the “you are” indicates. One of the challenges with something-you-are artifacts is they are typically hard to change, so once assigned they become immutable. Another challenge with biometrics involves the issues associated with measuring things on a person. Something you do – Another one of the categories of authentication factors. It specifically refers to activities, as the “you do” indicates. An example of this is a signature, because the movement of the pen and the two dimensional output are difficult for others to reproduce. Something you have – Another one of the categories of authentication factors. It specifically refers to tokens and other items that a user can possess physically, as the “you have”
  • 37. indicates. Something you know – Another one of the categories of authentication factors. It specifically refers to passwords, as the “you know” indicates. The most common example of something you know is a password. Somewhere you are – Another one of the categories of authentication factors. One of the more stringent elements is your location, or somewhere you are. Location can be compared to records to determine if you are really there, or even should be there. 10 Key Terms (8 of 9) Superuser Terminal Access Controller Access Control System+ (TACACS+) Ticket-granting server (TGS) Ticket-granting ticket (TGT) Time-based One-Time Password (TOTP) Time-of-day restrictions Token Transitive truest Tunneling Usage auditing and review Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Superuser – Accounts that accounts are not typically assigned to
  • 38. a specific individual and are restricted, accessed only when the full capabilities of that account are required. Terminal Access Controller Access Control System+ (TACACS+) – The current generation of the TACACS protocol family. TACACS+ extended the attribute control and accounting processes. Ticket-granting server (TGS) – A portion of the Kerberos authentication system. Ticket-granting ticket (TGT) – The first ticket issued in the Kerberos environment. The KDC verifies credentials and issues a ticket-granting ticket (TGT) which the user presents for service to the KDC. Time-based One-Time Password (TOTP) – An algorithm that is a specific implementation of an HOTP that uses a secret key with a current time stamp to generate a one-time password. Time-of-day restrictions – Specify restrictions that limit when a user can log in, when certain resources can be accessed, and so on. Time-of-day restrictions are usually specified for individual accounts. Token – A hardware device that can be used in a challenge- response authentication process. Transitive trust – A relationship where the trust relationship extended to one domain will be extended to any other domain trusted by that domain. Tunneling – The encapsulation of one packet within another, which allows you to hide the original packet from view or change the nature of the network transport. This can be done for both security and practical reasons. Usage auditing and review – An examination of logs to determine user activity. Reviewing access control logs for root level accounts is an important element of securing access control methods. 11 Key Terms (9 of 9)
  • 39. User Username Virtual private network (VPN) Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. User – A term that generally applies to any person accessing a computer system. In privilege management, a user is a single individual, such as “John Forthright” or “Sally Jenkins.” This is generally the lowest level addressed by privilege management and the most common area for addressing access, rights, and capabilities. Username – A unique alphanumeric identifier that a user will use to identify himself or herself when logging into or accessing the system. Virtual private network (VPN) – An encrypted network connection across another network, offering a private communication channel across a public medium. 12 Introduction Privileges mean you have the ability to “do something” on a computer. Privilege management is the process of restricting a user’s ability to interact with the computer system. Remote access enables users outside a network to have network access and privileges as if they were inside the network. Authentication is the process of establishing a user’s identity to enable the granting of permissions.
  • 40. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. Essentially, everything a user can do to or with a computer system falls into the realm of privilege management. Privilege management occurs at many different points within an operating system or even within applications running on a particular operating system. Remote access is another key issue for multiuser systems in today’s world of connected computers. Isolated computers, not connected to networks or the Internet, are rare items these days. To establish network connections, a variety of methods are used, the choice of which depends on network type, the hardware and software employed, and any security requirements. 13 User, Group, and Role Management To effectively manage privileges, a mechanism for separating people into distinct entities (users) is required. It is convenient and efficient to be able to lump users together when granting many different people (groups) access to a resource at the same time. It is useful to be able to grant or restrict access based on a person’s job or function within the organization (role). Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved.
  • 41. While you can manage privileges on the basis of users alone, managing user, group, and role assignments together is far more convenient and efficient. 14 User (1 of 4) The term user generally applies to any person accessing a computer system. In privilege management, a user is a single individual. A username is a unique alphanumeric identifier the user will use to identify himself or herself when logging into or accessing the system. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. The concept of a user is generally the lowest level addressed by privilege management and the most common area for addressing access, rights, and capabilities. When developing a scheme for selecting usernames, you should keep in mind that usernames must be unique to each user, but they must also be fairly easy for the user to remember and use. With some notable exceptions, in general a user who wants to access a computer system must first have a username created for him on the system he wishes to use. This is usually done by a system administrator, security administrator, or other privileged user, and this is the first step in privilege management—a user should not be allowed to create their own account.
  • 42. 15 User (2 of 4) Rights define the actions a user can perform on the system itself. Permissions control what the user is allowed to do with objects on the system. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 16 User (3 of 4) “Special” user accounts are reserved for special functions and typically have much more access and control. The administrator account under Windows and the root account under UNIX Both known as the superuser Must be protected with strong passwords The system account used by Windows operating systems Granted full control to all files on an NTFS volume by default Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 17
  • 43. User (4 of 4) Figure 11.1 Users tab on a Windows Server 2008 system Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. This figure shows the Users management tab of the Computer Management utility on a Windows Server 2008 system. Note that several user accounts have been created on this system, each identified by a unique username. 18 Shared and generic accounts/credentials Shared accounts go against the specific treatise that accounts exist so that user activity can be tracked. Shared accounts are called generic accounts Shared accounts exist only to provide a specific set of functionality Example: PC running in kiosk mode, with a browser limited to specific sites as an information display Tracing the activity to a user is not particularly useful. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 19
  • 44. Guest accounts Guest accounts are frequently used on corporate networks Provide visitors’ access to the Internet Provide common corporate resources Accounts are restricted in their network capability to a defined set of machines with a defined set of access Logging and tracing activity have little to no use Overhead of establishing an account does not make sense Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 20 Service accounts Service accounts are used to run processes that do not require human intervention to start/stop/administer. Windows systems may not allow them to log into the system. Limits attack vectors that can be applied to these accounts Can apply time restrictions for accounts that run batch jobs at night and then monitor when they run. Service accounts that run in an elevated privilege mode should receive extra monitoring and scrutiny. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 21
  • 45. Privileged accounts Privileged accounts have greater than normal user access. Privileged accounts are typically root or admin-level accounts and represent risk in that they are unlimited in their powers. Require regular real-time monitoring, if at all possible, and should always be monitored when operating remotely. There may be reasons why system administrators are acting via a remote session, but when they are, the purposes should be known and approved. Principles of Computer Security, Fifth Edition Copyright © 2018 by McGraw-Hill Education. All rights reserved. 22 Group (1 of 3) Under privilege management, a group is a collection of users with some common criteria, such as a need for access to a particular dataset or group … Chapter 11: Managing Organizational Change and Crises Introduction In this ever-changing global economy, organizational change is inevitable Productively managing change by drawing on the strengths of an organization keeps them healthy and able to adapt to the environment
  • 46. Organizational Change Case Study: Merger Mayhem New Zest Manufacturing CEO Jeremy called a special meeting of management Rumors of a potential merger and branch closings made the atmosphere tense Jeremy was known for “doing more with less” so downsizing was a top concern for the managers Why people are afraid of changes? What problems may arise by downsizing? • Is there any good suggestions to ease the conflict by downsizing? Downsizing A common yet often-overlooked change in organizations, with unintended costs Employees who survive the layoffs often: Voluntarily leave the company for better options View the organization as unstable Experience enhanced workloads, leading to burnout Organizations often struggle to hire new talent and lose employees with organizational knowledge Several key steps should be followed before making the decision to downsize Critical Thinking Questions - Downsizing How does the term “survivor” help us to understand the experiences of individuals after a downsizing has occurred?
  • 47. Identifying the Change Process Tim Brown (2009) suggests the thought process should go something like this: Begin at the beginning Take a human-centered approach Fail early; fail often Get professional help Share the inspiration Blend big and small projects Budget to the pace of innovation Laying the Foundation for Change When organizations face change, how that change is framed can have a tremendous impact on whether employees buy into the change Laying the proper foundation is vital for creating a sense of commitment to the change Employees will be more likely to be committed to the change if they are able to move beyond simple adaptation and acceptance to understanding and a sense of control Implementing Change Organizations implementing change that have the attitude that everyone is on the team and has the potential to contribute ideas will often find that employees “in the trenches” will have knowledge and insight based on observation and experience that just might improve the process Relying on the employees doing the job to offer suggestions is likely to improve the process as well as create a greater sense of commitment on the part of the employee
  • 48. Evaluating Change Outcomes Organizations can reevaluate and change again if it isn’t working Just because an organization has changed something, perhaps even based on extensive research, doesn’t mean that the organization has to accept the results of that change Evaluation is vital Organizational Learning A successful organization is a learning organization For the organization to learn, though, there must be an attitude that recognizes the value of all team members – from the custodial staff to the CEO Just as important, there needs to be an effective system of communication The type of communication may take different forms, depending on the culture of the organization, but there must be a system in place In addition, the attitude of the organization should be one that fosters creative thinking at all levels Critical Thinking Questions – Change How might an organization’s culture influence change processes? Can you think of examples of types of organizations that seem to be “learning organizations”?
  • 49. Crisis and Change Case Study: Takata Airbags Multiple deaths occurred as a result of problematic Takata airbags in Toyota vehicles Multiple rounds of recalls culminated in 31 million recalls in eight years, including those from other manufacturers How an organization communicates in a crisis can be a life-and- death matter What should Takata have done? What ethical concerns do you have about this crisis? Organizational Crisis “A low-probability, high-impact event that threatens the viability of the organization and is characterized by ambiguity of cause, effect, and means of resolution, as well as by a belief that decisions must be made swiftly” (Pearson & Clair, 1998, p. 60) Organizations typically either try to keep crisis from occurring in the first place, or try to soften the impact when crisis does occur Five stages of crisis include signal detection, preparation/prevention, containment/damage litigation, recovery, and learning Crisis Communication Plan Plans should be proactive, specifically: Identify a crisis team Develop key messages for internal and external publics Designate a spokesperson and backup Have a system to monitor communication about the organization
  • 50. Have a postcrisis review plan In addition to correcting the issue, crisis communication should also reduce tension, be ethical, control information flow, and manage the recovery Crisis Communication and Image Image can be impacted positively or negatively as a result of a crisis The way a mistake is resolved, and what the organization learns in the process, is important Examples: BP Deepwater Horizon oil spill JetBlue Crisis Communication Should Be Dynamic Leaders must adapt communication to the changing environment and stakeholder concerns Leaders must continually assess the situation, environment, and changing variables is necessary Leaders must remain consistent in organizational values Context Matters For-Profit Organizations Longer processing times can create both negative and positive crisis situations for larger corporations Family Entrepreneurship Less time required to deal with change and crisis, but potential for big differences for the organization Nonprofit Organizations Very specific missions create potential change challenges
  • 51. Government Sector Resistance to change may take a more political form Chapter 10: Managing Conflict Introduction Workplace conflicts are often not productive Take time away from one’s job Take time away from providing customer service Strained emotion often lingers Conflict can lead to innovation and creativity Conflict must be managed – not ignored Conflict Defined An expressed struggle between at least two interdependent parties, who perceive incompatible goals, scarce rewards or resources or expectations that are not being met, and interference from the other party or parties in achieving their goals Conflict vs. Difference of Opinion Interdependent parties Incompatible goals Interference If we perceive something, we will often act as if it is true
  • 52. Managing Conflict Dimensions of Conflict History: experiences with the party or other conflicts Source: can be the other person or something less personal Perceptions: assumptions and prejudices often make us think something is true even if it is not Emotions: controlling emotions in a positive manner can lead to positive conflict resolution Behavior: good, controlled behavior can move us toward positive results Effective vs. Dysfunctional Responses Differentiation: “Parties raise the conflict issues and spend sufficient time and energy clarifying positions, pursuing the reasons behind those positions, and acknowledging their differences stage determines differences” (Stutman, 2009, p. 14) Opportunities to develop understanding during this stage Case Study: Zest Manufacturing Wars A small group of managers met for their weekly meeting, and conflict arose Two managers were at odds because both failed to ask for rationale and allowed their emotions to flare A third manager facilitated a conversation to help both parties see how to resolve the conflict Perception was key; both managers perceived that the other was questioning their ability to do their job Have their been times when emotion influenced your perception of something? Did it help or hurt?
  • 53. Conflict Within the Organization Personality conflicts: arise out of differences in the collection of qualities that make people who they are but that also don’t meet our expectations Role confusion: lack of clarity over expectations of our position or fulfilling our job duties Intragroup conflict: conflict within a group Intergroup conflict: conflict between two or more groups Intraorganizational conflict: conflict within an organization Critical Thinking Questions - Conflict Why does conflict often escalate so quickly? In today’s modern society, what other potential sources of conflict within organization can you think of? Styles of Dealing with Conflict Avoiding Those who prefer avoidance recognize a conflict exists, but tend to want to withdraw from, ignore, or suppress it Low concern for satisfying concerns of themselves or others Can be useful when issues are trivial, there is no chance of satisfying your concerns, or disruption outweighs benefits of resolution Competing Individuals who use competition place their own concerns as more important than the concerns of others “I win, you lose” approach
  • 54. Can work when quick action is necessary Can spur creativity and innovation Can lead to one-sidedness and harmful for building trust Accommodation The opposite of competing Putting one’s needs and concerns aside in order to focus on concerns and needs of others Useful when one is wrong about an issue, or an issue is far more important to others, maintaining cooperation as a goal Compromise Often considered the best strategy because it is in the middle of the grid Both parties get something without excessive disruption Balance of loss and gain can be useful and seen as fair Often leaves both parties feeling dissatisfied Collaboration Ideal because of a high concern for needs of all parties involved Win-win result is the goal Collaborative people help to solve problems by being creative and looking for joint gains Trust is an important component of collaborative processes Strategic Objectives We need to consider the importance of the relationship as well as our goals and desires as we decide which tactic to use Managing conflict requires the ability to recognize the tactics of others and adjust our own tactics to complement and/or counter the other party in an effort to achieve the final goal
  • 55. Organizational Conflict and Power Power can determine: How conflict gets resolved What goals a group will pursue How a group’s resources will be distributed Many conflicts have asymmetrical power Forms of Power Formal power is based on an individual’s position in an organization: Coercive power Reward power Legitimate power Personal power is derived from one’s unique characteristics: Expert power Referent power Critical Thinking Questions - Power Consider conflicts in which you have been involved where power has been used by either yourself or the other party Was power used in a productive way? How did the parties to the conflict feel after power was used? Third Party Intervention • In the following three special types of organizational conflicts, it is necessary to bring in a third party. Whistle-blowing, sexual harassment, discrimination
  • 56. • To deal with conflicts via third party intervention: Negotiation Mediator Arbitration (conventional interest arbitration, final offer arbitration) Judicial approach Case Study- Email Fiasco Phil is unhappy with the hiring of new manager Marshall, and the promotion of Trish Marshall suggested changing the inventory process, and Trish supported it while Phil did not Marshall sent an email to the entire company that derided both Trish and Phil What types of conflict exist in this case? What other issues contributed to this conflict situation? Conflict Outside: Dealing with an Angry Public When conflict has moved outside the organization and we are dealing with a potentially angry public, remember there are some key variables to consider in our response: What are the facts of the situation? What emotions are driving the publics’ perception? What are the contextual variables that create and sustain the crisis? What are/should be the organizational actions taken in response to the critical event(s)? Organizations must recognize the various emotions involved and seek to “step into the shoes” of others and understand their varying perspectives
  • 57. Context Matters For-Profit Organizations Dealing with conflict takes time, which can be both positive and negative Family Entrepreneurship Conflict can be dealt with more quickly but can also infect an entire organization faster Nonprofit Organizations Presence of volunteers complicates conflict processes Government Sector Unique rules and guidelines may produce additional interorganizational conflicts