BISM3205 – Business Information Security
Business Information Security
Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
BISM3205 – Business Information Security
Assignment 2 worth 60% of overall course marks
Assignment Marking Guide
This assignment is worth 60% and will be marked as per the rubric in Table 1. The following
criteria apply:
• The completeness of the answer ‐ does the answer show that the student has grasped the full
meaning of the question and that the student has included all relevant points in the
answer?
• Does the answer identify and accurately analyse the interdependencies of the relevant points?
• Is the answer presented in business language? The student must present answers (often
discussing technical issues) in terminology/language that is clearly and easily understood by a
business analyst/business manager.
This assignment assumes that a third-year student is capable to assimilate information from not only
this course but also many other courses and reputable sources on the Internet as would be required
in a business setting. However, students are advised that the use of AI technologies to develop
responses is strictly prohibited and may constitute student misconduct under the Student Code of
Conduct. Each assessment question evaluates students' abilities, skills and knowledge without the
aid of Artificial Intelligence (AI). Answer must be as short as possible and as long as necessary.
Table 1 - Marking rubric for assignment 2.
85% ‐ 100% 75% ‐ 84% 65% ‐ 74% 50% ‐ 64% 0% ‐ 49%
You have a very high
level of understanding
of the question. You
have analysed all
interdependencies
within the question
and its context. Your
explanation is
absolutely clear and
professionally concise
in its language and
logical presentation.
You have a very sound
level of understanding
of the question. You
have analysed almost
all interdependencies
within the question
and its context. Your
explanation is mostly
clear and concise in its
language and logical
presentation.
You have mostly
understood the
question. You have
analysed some of the
important
interdependencies
within the question
and its context. Your
explanation needs
more work in terms of
clarity, conciseness,
and logical
presentation.
You need to
improve your
understanding of
the question and its
interdependencies.
You need to do
considerably more
work on producing
a clear, concise
response.
Your submission
appears to lack a
comprehensive
understanding of
the question and
its associated
concepts and falls
short in effectively
communicating a
clear and concise
response.
2 BISM3205 Assignment 2 – Semester 1, 2023
Question 1
a) You have found a treasure map at the Pizza Café (see Figure 1) containing an encrypted
message that describes the coordinates of where a treasure is hidden on this map. Break the
code using cryptanalysis and draw either a red X in the square where you think the treasure is
or, alternatively, just note down the coordinates as In [letter;number] but that is less fun.
b) What is the name of the cipher used?
c) What is the KEY?
The encrypted message is:
Upw frpepvzw oay fb gwmzd lx qim xalwstjvy oozvajvsfed: E; jpl(qauc_wqvlwzt_yyjcmj,10).
Figure 1 - Treasure Map with encrypted message.
(3%)
3 BISM3205 Assignment 2 – Semester 1, 2023
What is your password?
e) What improvement suggestion do you have regarding database password storage in your
company?
(2%)
f) Answer the following question:
57 68 61 74 20 69 73 20 69 74 20 63 61 6C 6C 65 64 20 77 68
65 6E 20 32 20 73 74 72 69 6E 67 73 20 68 61 76 65 20 74 68
65 20 73 61 6D 65 20 68 61 73 68 20 64 69 67 65 73 74 3F
(2%)
(1%)
h) Download the following zip file containing two images
i) What does it tell you about MD5?
(2%)
4 BISM3205 Assignment 2 – Semester 1, 2023
Question 2
Your friend works at the Australian Security Intelligence Organisation (ASIO) and has found out you
are completing BISM3205 at The University of Queensland. She wants to test your abilities and sends
you an email reading "Follow the trail of hints given in the hidden message to arrive at a single two-
digit decimal number" followed by the text below.
a) What is the two-digit decimal number.
b) Explain how you got to your result.
(8%)
c) How does the segmentation of IP addresses, which contain identifiers for both the computer and
the network it belongs to, facilitate data routing across networks by identifying the specific
location of the target computer? Provide an example of this segmentation by determining the
host and network portion of the IP address 192.168.8.10, given a subnet mask of 255.255.0.0?
(2%)
5 BISM3205 Assignment 2 – Semester 1, 2023
Question 3
Kerberos is using the concept of a shared secret to authenticate a user to avoid sending the user's
password over the network.
a) Name three reasons why we can't just hash the user's password and send that hash instead
of a timestamp encrypted with the user's password?
(3%)
b) An Intrusion Detection System (IDS) raises alarms when it detects suspicious activity
or policy violations, how does a false positive alarm differ from a false negative one? From
a security perspective, which is least desirable?
(2%)
c) What would an attacker input into an authentication form asking for a username and
a password, if they wanted to perform an SQL injection attack that would allow them
to log in using the username admin without specifying the correct password?
(1%)
d) Explain how each of the tokens they have to enter contributes to success using the
full back-end SQL statement that is executed as an example.
(1%)
e) Can I access the "deep web" using a normal browser like Chrome or Firefox, or do I
need the Tor browser? Why or why not, explain in a few sentences?
(3%)
6 BISM3205 Assignment 2 – Semester 1, 2023
Question 4
Secure/Multipurpose Internet Mail Extensions (S/MIME) provides a secure and reliable way to
send and receive emails over the internet, protecting against eavesdropping, tampering, and
impersonation.
Here's a breakdown of the steps how S/MIME works to secure email communication:
1. Compose email text and attachments.
2. Create a symmetric session key and encrypt the email text and attachments with this key. This
ensures that only the intended recipient(s) can read the email content.
3. Encrypt the session key with the recipient’s public key and add this to the email using
asymmetric encryption. This ensures that only the intended recipient(s) can decrypt the
symmetric session key and read the email content.
4. Hash the total email (text, attachments, and encrypted session key). Encrypt the resulting
digest with the sender’s private key. Add this encrypted hash to the email package as a digital
signature. Send the lot to the recipient.
Describe a similar breakdown of the steps that happen on the receiver's side when they receive an
S/MIME-secured email. Include a statement about how the receiver can be sure that the message
has not been tampered with and was indeed sent by the claimed sender.
(10%)
7 BISM3205 Assignment 2 – Semester 1, 2023
Question 5
a) The diagram in Figure 2 shows a typical network configuration of an office connected to the
Internet. Areas are labeled with numbers 1-4 and network devices are labeled with letters A-
M. In the list below, assign the correct number and letter to each area and device. Numbers
and letters must only appear once (insert any missing device name). It does not matter where
a device is located in a work area. (8%)
Figure 2 - Typical office network diagram.