Category: CSE Seminar Topics

In Active Directory forest, from any domains universal groups can include users. Thus, in order to control security across the domains, they are utilized. Whenever operating on domain functional level of Windows Server 2003 or Windows 2000 Native, only universal groups exist. When controlling several domains, it frequently supports to group worldwide groups in universal groups. 

In Active Directory deployment of Windows server 2003, domains are regarded as boundary of logical security that permits for management, creation and administration of related resources. Domain can be thought of as logical division like neighborhood in a city.

Even though the essential features and names are similar, the domains of Active Directory change significantly from those in Windows NT. When compared to Windows NT domain, several objects can be accumulated by active directory domain. Moreover, the domains of active directory can be joined mutually into forests and trees in order to structure more difficult hierarchical structures. 

Domain functional levels: these levels are same like modes in Windows 2000 server. The functional level of Windows 2003 server domain consist of all of latest features that are included in Windows server 2003, however needs that each SC operate Windows 2003 server. The native domain functional level of Windows 2000 provides each of the native mode functionality in Windows 2000; however each of the DC should either operate Windows 2000 server or Windows 2003 server.

The mixed domain functional level of Windows 2000 provides minimum amount of functionality, however it assist DCs operating WindowsNT4 server, Windows 2003 server, and Windows 2000 server. Observe that domains cannot be translated into Windows 2000 Mixed domain functional level from Windows 2000 Native domain functional level back.

The most significant threats to domain controllers are those that try to achieve access on domain controller towards the database of security. All the passwords and accounts of user are contained by DC; therefore computer access offers a hacker about unrestricted access towards the network. Usual assaults consist of:

• Attaining access towards the database of security in order to adapt rights of user to offer managerial access towards unauthorized users.
• Attaining access towards communications of domain controller through connections of network, so as to exploit, monitor and capture information of security like user passwords and accounts.
• Attaining physical access towards server in order to copy database of security onto detachable media for soon analysis.
• Attaining access towards domain controller in order to adapt computers on domain to permit ‘rouge’ computer so as to take part in the domain.

Domain controllers are the heart of Windows-based network. As the name suggests, the activities on the domain can be controlled by them. To just single function their roles can be restricted, or the domain controller can be organized to include number of related functions. Significantly, this decision depending on the network size and several users and processes will access the data. The better the network, the more specialized domain controllers tends to become. Basic measures of security consist of:

• In order to secure information on system volume, NTFS file system must be used.
• Securing the domain controller essentially in an access-controlled location.
• Extracting every service that will not be utilized on the domain controller.
• Needing smart card access on domain controllers when probable. Passwords are randomly produced and encrypted by making use of stronger methods of encryption. 

In general, the domain controller authenticates the logons of domain and controls the master database and security policy for the purpose of domain. Even though domain controllers and servers can authenticate logons of user, only the domain controllers alter to passwords or additional changes to computer and user accounts. In the network, in order to configure security for domain controllers, one has to start with a recognized state (baseline). Whenever a server is promoted to DC, the security information template of DC is applied. For DCs, the baseline security is offered that is identical to the setup security information for other server types. In addition, two other predefined security templates are present that can be utilized on domain controllers, they are: the hisecdc.inf and securedc.inf. 

          If there are member servers or DCs that are not functioning Windows NT 4.0 SP4 or later in the domain, then securedc.inf template can be utilized. This template offers string security, however it does not need strong encryption, SMB signing, or utilization of NTLM v2 authentication protocol. On the other hand, SMB signing as well as strong passwords are found to be necessary for hisecdc.inf template.  Before using this template in mixed environment on a DC, test every scenario carefully as few down-level clients ay not be capable of connecting to domain controller through hisecdc.inf template. 

Role/function played by domain structure/relationships in a Windows domain 

Understanding Active Directory Domains and Trusts 

The security, access to resources, information flow, and the relationship type between various domain forests, domains and domain trees can be controlled all through the environment of enterprise network by the active directory trusts structure and domains of Windows Server 2003. This can relieve managerial burden of multi-domain structures and large domains by saving expense, time and effort. A relationship can be made among two domains that allows passwords of authentication from one domain to the other or among both ways domains, whenever a trust relationship is created among them.   

Active Directory

It is defined as the directory service’s Microsoft implementation that permits to search and store any object in multiple domains of single domain.  Everything in the domain is classified as objects by the directory services. The objects consist of computers, servers, application data, users, printers, file shares, etc. All these objects will be located in Active Directory in a single file that consists of objects as well as plan information known as ntds.dit.

Domains

Domain is defined as a security container, a data base application of Active Directory, and is the common container for explaining internet namespace and DNS. Beginning with Windows 2000 Server domains and enduring Windows Server 2003, an individual domain can be created and can be secure all the trust and security functions that need several domains making use of Windows NT. 

Domain Controllers 

For a Windows 2003 server, Domain controller is defined as specialized function. Towards domain controller, server can be promoted in such a way that it can replicate, construct and receive Active Directory database copy. Information regarding all the objects available in domain is included by domain controller, and the users of network can explore it to observe resources, people and computers all the time on the domain. The database of domain controller is updated continuously so that most of the recent information is contained by all the users. At last, as changes takes place, the domain controller replicates or exceeds to other domain controllers along its most recent database. Every domain controller is not equal with Windows NT domains. A PDC (Primary Domain Controller) has to be produced in every domain, which holds the Active Directory database’s master copy. BDCs (Backup Domain Controllers) that held database copy is another type of domain controller. 

Domain Tree Trusts 

Trust can be created among all the domains, which states that among two or more domains, resources can be shared forth and back as if the resources were one of the domain controller’s parts. Among two NT domains, a one-way non transitive trust can only be created, whenever domain trusts of Windows NT is used. A trust can be created where only an individual domain is trusted and another one is trusting. It must be considered that trust is not assured by interrelationship, whenever generating trust. By the introduction of Windows 2003 Server and Windows 2000 Server Active directory, two-way transitive trusts can be automatically generated in similar domain among various domains so that trust among two domains is two-way.  

Domain Forest Trusts 

Among two unrelated domain trees, trust relationships can be produced, however the relationships of two-way transitive trust cannot be generated automatically. Similar to the generation of domain trust relationships with Windows NT, forest trust relationships must also be produced. As this is defined as link among two unrelated domains, relationships of trust must be generated carefully with higher security element. Both domains can be owned; separate namespaces can be maintained, and to access resources on second domain one domain must be permitted and must restrict on how the resources are accessed on first domain by second domain.

Any other domain can be accessed transparently by the users in forest through two-way transitive trusts. Transitive trust is the one in which two or more parent domains as well as their child domains trust each other. Depending on the parent trust, the trust present at parent level crosses down to child domains. Transparent trust is defined as the one in which the user does not know anything about how the relationships of trust shifts several domain trees and domains. 

This assignment addresses the following learning outcome(s) of the module:

• To critically explain how to respond to various types of attack that can be applied to a Windows 2000 and Windows NT systems, and apply that knowledge to actually respond to an attack.
• To explain in a systematic manner the importance of systems configuration and management and to undertake systems configuration and management for Windows 2000 and Windows NT systems;
• To perform an Information Technology Health Check (ITHC) and understand the role and limitations of an ITHC in securing Windows 2000 and Windows NT systems.

You are required to produce a 2500 word report, discussing the Windows Domain structure. Assume a Windows 2000/2003/2008 Domain running in native mode. In particular attention should be paid to:

•  What role/function is the domain structure/relationships play in a Windows domain?
• What are the security risk/threats to the Windows domain structure?
• Giving practical examples how can we enumerate/explore a Windows domain structure?
• How do Windows domains and domain structures communication with each other?
• What is best practice in securing a Windows domain structure?

 

In Flight Wireless Communications Assignment topic

Detailed Requirements

This coursework consists of research work on some specialised topics in Wireless, Mobile and Computer Communications that will not be covered during this module. Main emphasis will be on (but not limited to) topics in mobile communications and computing.

Deliverable:   A report of maximum 2500 words containing

–         Abstract of no more than 100 words summarizing the topic

–         Introduction written in own words on what is this about. Introduce the topic, how relevant is the topic, Where did you find the information?

–         Description of the topic from references (No direct copying! Collect and re-organise information from different sources).

–         List of references (at least two books or articles and four web sites) but the more the better!

Since this is a Master level assignment, the report MUST show professionalism in reporting. Cut and Paste from website will not be accepted. You need to gather information from different sources – categorise and analyse the information reported.

Copying and similarity check will be done on each assignment.

Use MS Word Times New Roman Font size 12.

State-full Packet inspection is a software module that is designed for inspecting the packets forwarded. This software is configured in the operating systems of UNIX of windows PC firewalls, and are used for inspecting the packets that are received. The rules of inspection are configured buy the security officer in to the machine and the inspection of packets is done based on these rules only.

Using this software in the ISO model the inspection is done in all the headers of 7 layers and the data related to the packets in the headers are stored in the dynamic state tables, these tables will preserve the information related to the connection. Packet filters can be run in the dual homed computers as they are designed in the form of software, these can filter the packets but at various networks they cannot be routed.

A firewall is also sometimes called as a bastion host when it is placed in the layer 5 of Internet model and layer 7 in ISO model. It is also called as guardian system, application gateway and proxy server. The services that are offered by the application are filtered as a main aim of these firewalls. Then the consequent packets are evaluated on the consequent connection trails and same connections by using the information that is stored in the tables.

Despite the fact that when compared to the simple packet filtering routers, this technology is very much secure, but when compared to the application gateways these are not that much secured because the information in the application is not completely inspected. Yet when compared to the application proxies, this technology is performed very fast. When compared to the security guards the concept of state-full inspection is almost similar in asking the questions like “who are you”, “where are going” and then permits the users. 

The most important and essential component of a firewall system are the Packet filter routers, and these are represented as the first among the defence because there are number of deficiencies and they are discussed as follows:

a)    The configuration of these packet filtering routers is difficult because there is a huge rule set that is to be followed file configuring and specifically when the services from the applications are available, the accuracy and consistency in the set of rules cannot be estimated because there is no automatic approach for verifying the rules that whether they are implemented properly in the security policy or not. In addition to this if the logging of calls is not supported by the routers then it is not possible to have an idea about the packets that are not allowed apparently that are passing through the rules are not.

b)    In an organization if some users among the employees have need specially for accessing the internet then their systems are added with new rules according to the requirement. This addition of new rules to the existing system makes the rule set more difficult to manage and so it becomes a complicated issue. Moreover, as the user is given permission to access the system it is considered as the wrong level of granularity. Here only the packets are verified but the users of the system are not authenticated.

c)    The TCP filtering or UDP filtering are not permitted by some of the routers that are mostly basic, and therefore implementing specific security polices is very difficult and sometimes impossible also.

d)    The packets between various ISO protocols that are running through the IP or TCP layers cannot be filtered. The process how ISO applications like X.400 and X.500 can run across the IP or TCP is specified by the RFC 1006. Conversely the RFC 1006 service will sit on the 102 port and so the ISO applications X.400 and X.500 are connected to port 102.

e)    Hence at last it is concluded that the packet filtering routers are not very much secure, because there is no inspection of the content in the packet and there is a chance for the passing of any malicious content through transferring of these packets. For example the packets may contain viruses, delete commands that unauthorized. Then finally no proper authentication is provided for the sender of the packets.

These deficiencies can be addressed and avoided by inspecting the content in the packets when it is forwarded from the sender to the receiver. Therefore checkpoint provides a state-full packet inspection module which is done at the application level firewalls.

Packet Filtering Routers are a type of firewalls that are invented first. These are designed with a main aim of filtering the IP packets, and this filtering is done based on four fields and they are given below:

• TCP source port/ UDP source port
• TCP destination port/ UDP destination port
• Source IP address
• Destination IP address

The IP packets are filtered by these firewalls for the following reasons:

• To block connections to certain ports
• To block connections to certain hosts or certain networks
• To block connections from certain ports
• To block connection from certain hosts or certain networks.

                    Generally all the ports or the hosts can be specified while the routers are configuring in specific situations. The performance of the packet filtering routers will be fast because the content in the IP packets is not inspected before it is dropped or forwarded that means there port fields are also not checked before transferring the content. For the IP packets these packet filtering routers are the guards who may ask certain questions like “who are you”, “where are you going” etc. In this case the guard of a building allows a person enter in to the build when once he answered all his questions and in similar way these firewalls will also behave.

In general internet is a 5 layer model and the model used by the ISO for making an Open systems interconnection is a 7 layer model. In ISO model, firewalls are placed in 3, 4 and 7 layers and in case of the internet model the firewalls are placed in the 3, 4 and 5 layers. These firewalls are used to protect a corporate system from the unauthorized accesses.

In simple it is said as protecting a network from the intruders and attackers. A firewall can be placed among any networks for instance a firewall can be placed between a R&D network and its corporate network related to business. Generally a firewall can be placed among the domains of lower security and higher security. The firewall system will be operating at various layers and firewall system operating particularly at layer 3 and layer 4 is sometimes called as screening router or packet filtering router. The main aim of these firewall systems is to filter the TCP ports or UDP ports and also to filter the IP packets and ICMP packets.

By depending on the filtering rules the packets are filtered as there are many ports at the router and these ports are available for routing. Packet filters can be run in the dual homed computers as they are designed in the form of software, these can filter the packets but at various networks they cannot be routed. A firewall is also sometimes called as a bastion host when it is placed in the layer 5 of Internet model and layer 7 in ISO model.

It is also called as guardian system, application gateway and proxy server. The services that are offered by the application are filtered as a main aim of these firewalls. If the firewall system is placed in the layer 2 then it is called as the link level and even it is able to operate in that link level also. For instance in order these particular assured packets are to be forwarded an Ethernet bridge is configured, which is not regular. The packets are inspected before they are transferred trough firewalls by an inspection module of checkpoint.