DISM 2B02

ASEC Test

2008-08-14T14:44:00.004+08:00

By Yong Xiang:

Section A MCQ

Section B 4 structured question.

Read questions . Start them in a new page.
Write legibly.

d
Introduction – Various scanning tools

Passwords and Access control – Default or weak passwords, permissions.
Problem with default / weak passwords, permission controls

Scripts and DLL – Malicious scripts and DLL loading paths.

Buffer overflow – Heap overflow, stack overflow. Effects of the exploit

Proprietary Format and protocols. - Security through obscurity is not good.

Format string exploits – how is it conducted? Effects of the exploit (what can you do with it – countermeasures).

Integer overflow – when does it happen, preventive measures.

SQL injection – conducting the exploit, using meta data, protecting the database credentials.

Web vulnerabilities – error messages, forceful browsing, cross site scripting, data tampering, (http sessions, form data, cookies). May need to know answer what is the attack, based on a scenario.

Information disclosure – passwords stored in text file memory

Know vulnerabilities and countermeasure, be prepared to identify the attack based on a scenario. Distribution of marks for section b
20,25,20,15

Section B – Format String, DLL, Integer overflow, SQL injection, web vulnerabilities, information disclosure.
MCQ may have buffer overflow. MCQ study everything.

ISPA Test

2008-08-14T14:43:00.000+08:00

supplied by Koon Ming:

Topics 1 - 9
10 MCQ and 5 Questions
NO ACL COmmands
But need to know what is acl, maybe is from mcq

MST tested questions may not come out.

Topic 1 MCQ, structured not, skippable, no cobit, maybe no security policies

------Topic 4-----
- Page 77 Dont think lai is interested
- Page 71-75 Different kinds of email risks
- Page 65
- Page 57 Distributed model <-- Not very important
- Page 57 Disaster recovery
- Page 54 Computer center operations <-- Ops security, maybe something from there. Need to know physical security
- Segregation of dutues <-- quite important

-------Topic 5 Data Management--------
- There will be questions in structured and MCQ
- Page 93-95, Flat file approach
- Page 97-106 maybe won't be tested
- 3 DBMS structures may not be asked in structured
- Page 114, data in a distributed environment
- Page 116, What are the two distributed database
- Page 118, Concurrency control
- Page 120, Access control
- Page 125, Backup controls

-------Topic 6 SDLC ------
- Turn key,
- Page 141, SDLC… Auditor's role in SDLC phase
- Page 156, Good for MCQ
- Page 172, Controlling and auditinv SDLC, must know, mayube strucutred

-------Topic 7 -----------
- May have MCQ and structured
- Study auditors point of view
- Topologies are not important
- Page 227, Controls of E-commerce (worth reading because of audit point of view)
------Topic 8--------
- Input is important!
- Processign and output control not very important, maybe mcq
-----Topic 9--------
Test data and para simulation.. May be tested in MCQ only

PM test

2008-08-14T14:42:00.000+08:00

10 mcq

1 network diagram
1 cost calculation
2 unknown... check past year papers...

Lin Feng's Birthday! (18 March - Tuesday)

2008-03-18T10:27:00.001+08:00

Can leave comments or tag at the cBox.

Web 2.0 @ NUS

2008-03-18T10:23:00.002+08:00

Dear Chan Timothy,

We would like to invite you and your students to join us at the inaugural Open Source Day jointly organized by Sun Microsystems and NUS School of Computing. This event will be extremely beneficial for your students as they will get the latest updates on Open technologies and business models that are driving the Web 2.0 era from Sun experts and leading industry speakers.

The event will be held on the NUS campus on 28 March. To help facilitate transport arrangements, we would like to offer to your school a complimentary bus transfer from your campus to the event venue for a total of 40 students and above registered with us.

Please feel free to contact uniday-ext@sun.com for bulk registrations for your school and for transport arrangements.

Students can also register individually at http://sg.sun.com/events/opensource

For more information on the event, please refer to the e-invite below.

Thank you for your time and I look forward to seeing you at the very first Open Source Day!

Warmest regards,
Liang Seng Quee
Director, Strategic Initiative
Sun Microsystems

That's part of an email extracted from our .ichat account. There's another event of Web 2.0 coming up (again). So people who are interested in Web 2.0, it will be beneficial for you guys to attend this event I suppose. Of course, I'm not going.

Application for use of Post Secondary Education Account (PSEA)

2008-03-14T10:38:00.003+08:00

PSEA is administered by Ministry of Education and is opened for all eligible Singaporeans.

With effect from AY2008/2009, Edusave funds will be transferred to Post Secondary Education Account (PSEA). As such, all Edusave applications previously applied through the Polytechnic will no longer be valid.

Students who wish to use Post Secondary Education Account (PSEA) funds will have to submit the form : Standing Order For Use Of Post Secondary Education Account.

¿ The Standing Order is applicable only if the student has a Post Secondary Education Account (PSEA)
¿ Student can use their own or their sibling¿s PSEA to pay for tuition fee and other fees.
¿ The parent has to authorise the application if the student and/or sibling is below 21 years old.

HOW TO APPLY ?
The PSEA Standing Order Application Form and details on PSEA are available at MOE¿s website : http://www.moe.gov.sg/finance/PSEA/

APPLICATION PERIOD
Students must complete the PSEA Standing Order form and submit it to Finance Department, Singapore Polytechnic, by 10th April 2008.

Quoted from an email which is sent to our .ichat inbox. I bet most of us do not check that email so better post it in our class blog. So in summary, there's no more edusave for us already. So people who wanna continue using such fund, please remember to apply for this stupid PSEA scheme before the closing date. For information go to the link stated above.

chat

2008-02-20T21:33:00.006+08:00

Moved to top

Tommy's Bday! (12 Feb Tues)

2008-02-12T19:44:00.000+08:00

can leave comments or cbox

opps... posted "abit" late...

Exam timetable

2008-01-13T01:31:00.000+08:00

Compiled exam dates... in accending order...

Module	Date	Time	Venue
WSNA	14 Jan 2008 (Mon)	2:00pm - 3:00pm	T2022
CLI	17 Jan 2008 (Thur)	1:00pm - 2:40pm	T2013
ETH	18 Jan 2008 (Fri)	3:30pm - 5:30pm	T1751
WEBS	24 Jan 2008 (Thur)	9:00am - 11:10am	T2157
DSM	29 Jan 2008 (Tue)	2:00pm - 4:10pm	T2158
OPS	31 Jan 2008 (Thur)	2:00pm - 4:10pm	T2141
"shadow" of the rainbow suggested by wx :p

Think combine tips into this post bah...
WSNA
Chapts for test: said in "Module Information"(Student Reading column in the table), practically the basics of all chapts
Format: 25 MCQ, Written(means not online quiz)
Revision Tips: Do all quizes in blackboard(worth GP marks also)

CLI
Chapts for test: All slides in blackboard except cyber terrorism...
Format: 10 MCQ, 3 structured, 1 case-law
Revision Tips: Here!
Class Post: Here!

ETH
Chapts for test: Chapts 1,2,4,5,6,8,9
Format: 15 MCQ, 4 Structured
Revision Tips: Here! and also do quizes on blackboard
Class Post: Here!

WEBS
Chapts for test: All
Format: 10 MCQ, 4 structured(1 scenario Diagram, 1 WSDL question)
Class Post: Here!

DSM
Chapts for test: All
Format: dunno
Revision Tips: dun have yet...

OPS
Chapts for test: All i think...
Format: dunno
Revision Tips: dun have yet...
Class Post: Here!

Mervin's Bday! (11 Jan Fri)

2008-01-11T13:43:00.000+08:00

can leave comments or cbox

over liao but belated still welcome...

Weixiang's Bday! (13 Jan Sun)

2008-01-11T13:34:00.000+08:00

can leave comments or cbox

over liao but belated still welcome...

ETH Tips

2008-01-10T18:15:00.000+08:00

Chapter 1
Just read through as not many questions will be from here

Chapter 2
Pages: 20, 21, 22, 24, 25
Points: TCP flags, ISN, ICMP(major ones like 0,8,30)
Important diagrams: Fig 2-1(Pg 20),Table 2-2(Pg 28)
Exceptions: Overview of Numbering Systems

Chapter 3(not tested)

Chapter 4
Pages: 62, 70, 71, 72, 75
Points: Cookie and Web bug, Zone transfer, social engineering
Important diagrams: table 4-1(Pg 62), table 4-4(Pg 71)

Chapter 5
Pages: 91, 98, 99, 102
Points: Types of ports, Types of port scans(how they determine type of port), nmap options, Difference between Fping and Hping

Chapter 6
Pages: 115,116, 120, 121
Points: Know enumeration tools and what each does
Exceptions: Enumeration the NetWare Operating System

Chapter 7(Not tested)

Chapter 8 & 9
Need to know the whole chapter for these 2...
Must read all pages...
But here are afew more important pages to read during revision...

Important Pages (chapt 8): 168, 170, 172
Important Pages (chapt 9): 196, 197, 202, 211, 213
Important Points(chapt 8): Winfingerprint
Important Points(chapt 9): Linux Directory Structure, Linux File System, Linux OS Vulnerabilities

CLI Tips

2007-12-22T18:49:00.000+08:00

Words in red= my guesses... so dun trust too much lol

seems like mr hu skipped topic 5A during revision totally... dunno if it means not tested or not important... but just marked out 2 slides from it...

Topic 1: Slide 26
Topic 2: Slides 9-12, 15, 17,18
Topic 3: Slide 13, 25, 26
Topic 3A: Slides 5-11,40-43 (mainly see 40)
Topic 5: Slides 6-13, 27-29, 30-37
Topic 5A: Slides 5, 9
Topic 6: Slides 15-17
Topic 7: Slides 11,15

Structured
Tut 2: Precedence(what it is, how it works)(Topic 2 Slides 17,18)
Tut 3A: Question 1 (Topic 3A: Slides 5-11)

Extra
Mr Hu said to study Ethics and Legal system... so most likely this means extra slides...
Topic 1: Slides 10,11,13-20

Case Law
Identify:- listing out sections of CMA breached
Legal principles/Law:- Listing out paraphrase, commentary, relavant cases
Application:- Specify [who, what, how of each breach]
Conclusion:- Own opinion

Identify
Example:
"The issues involved in the scenario relates to:
a) Section 3- Hacking
b) Section 5- Illegal Modification"

Legal principles/Law
Example:
"The legal principles of the relavant sections are as follows
a) Section 3 [write out paraphrase+commentary+relavant cases... need memorise from slides topic 4]
b) Section 5 [write out paraphrase+commentary+relavant cases for Section 5]"

Application
Example:
"Applying the legal principles to the scenario,
[person name from scenario] breached [section number] of CMA because of [action]"

Conclusion
Use any format you are comfortable with...

ETH assignment

2007-12-21T11:46:00.000+08:00

hmm... some ppl cannot run superscan... so the results are: Here!

Assignment due dates compilation...

2007-12-21T01:09:00.000+08:00

Compiled assignment due dates... in accending order...

Module	Date	Week
DSM	2 Jan, Wed	15
OPS	2 Jan, Wed	15
WEBS	8 Jan, Tues	16
WSNA	8 Jan, Tues	16
ETH	18 Jan, Fri	17

ITP placement thingy

2007-12-17T09:40:00.000+08:00

Foreword and Summary
post in cbox as "[company name], [LO name]"
Thanks... lol

Finding ppl with same ITP
hmm... post your itp placement and try find ppl with same placement bah...

Company Name	Student Name	slots left
PC Connect	Yong Xiang	1
QALA SINGAPORE PTE LTD	Seetoh, Tng bk, Farhan (and Hong Yun)	6
EUCALYPTUS PTE LTD	Zhan Hong	dunno
Singular ID PTE LTD	Weixiang	dunno
DSO Lab	Emil(and QC and Jeremy)	4
DELOITTE & TOUCHE MGMT SVCS P/L	Ridzwan, Ren Tang, Tommy, Suzanah(and Choon Rui and Ben)	0
IAH Games	Lin Feng, Quek bk	Unlimited
Chevron	Liting	dunno
OITP	Suzanne(and 3 ppl from 01)	Unlimited
School	Jack	Unlimited
Crescendas group	Choon Wei	0
CSIT	Koon Ming, Mervin	dunno
E-Cop	Jun Hui	dunno
SAS Slow(or unsettled placement)	1 person whose name not out yet	Unlimited?

Use postal code search at Here!

Liaison Officer
also, can say who is your LO(liaison officer or something...)

Meeting
need arrange meeting with them by, preferbly, around 8 Jan(as said in itp briefing slides...)
so same LO can go together bah

Lecturer(LO) Name	Student Name
Agnes Wong	Yong Xiang, Liting
Clarance Ng	Seetoh, Tng bk, Farhan
Loh Kwong Khuin	Weixiang, Zhan Hong
Lai Fook Ming	Emil
Samson Yeo	Ridzwan, Ren Tang, Tommy, Suzanah
Quek Nguan Tuan	Lin Feng
Kenny Seah	Jack
Calvin Siak	Choon Wei

lab bookings...

2007-12-13T23:31:00.000+08:00

ETH (1912D) (booked by tommy):
Time: 9am-5pm
Tues of first week (18 dec) *
Fri of first week (21 dec) **
Thurs of sec week (27 dec) ***
According to blackboard... lab will lab open except on
Thurs of first week (20 dec)
Mom of sec week (24 dec)
Tue of sec week (25 dec)

DSM(1912C):
Time: various times... check blackboard...
Tues of first week (18 dec) *
Wed of first week (19 dec)
Fri of first week (21 dec) **
Wed of sec week (26 dec)
Thurs of sec week (27 dec) ***

days with *(asterisks) means same days...

DSM assignment

2007-12-13T23:02:00.000+08:00

For 1c
"You have to populate the given tables with relevant data",

insert around 5 records... (at least 3)

no need to include method you used to insert

"it will be good" (most likely more marks) to know how to use those 3 methods taught in class

MUST include primary key as marks are given...

no need to include foreign keys and no extra marks if you included

for 1e(i)
"select * from inventory.product"

this question is asking for the result of "select * from inventory.product" to be displayed

there are afew methods to do for (i) and (ii) but "implement appropriate objects"...

for 1f
include all sql statements for all parts

WEBS assignment

2007-12-11T22:12:00.000+08:00

WEBS assignment things...

Questions 1&2: see prac 5

Question 3: see prac 7
Additional requirements for question 3: can implement 0 or 1 or 2 of those...
(means best to do both)

Question 4: means proper error messages

Question 5: the question is clear enough...

Deadline: shifted to 8 Jan, after demo(no need to upload on 4 Jan)

Elective thingy

2007-12-07T18:44:00.000+08:00

The Modules
3a (2 choices)

Module	People
1. Securing Linux(SLIN)	6
2. Securing Microsoft Windows(SMW)	7

3b (5 choices)

Module	People
1. AITEC + ADMS (aka JCU)	3
2. Advanced Internet Technologies (AITEC)	1
3. Advanced Database (ADMS)	1
4. Smart Card Technology (SCT)	3
5. Advanced Java Programming (JPRA) (Opps thought was APRG lol...)	3
6. Not sure! (IDK)	2

Help share your choices!
cos i cannot decide what to take for 3b also lol

and regis opens at 3:30 on 11 dec(Tues)
(eee kena cheat...)

The Slides
The slides can be found on blackboard at:
My Community>SMIT Student Notice Board>DISM>DISM Elective Briefing Slides - AY0708S2

OR

login to blackboard and go: here
note: dun save the slide, view it online

OR

login to blackboard then go:
SWIN: here!
SLIN: here!
AITEC: here!
ADMS: here!
SCT: here!
JPRA: here!

CLI assignment

2007-11-30T18:19:00.000+08:00

Marking scheme used: Here!

Part A:
Some terms are explained in: Here!

Part B&C&E:
Quite straight forward as explained in marking scheme...

Part D: ILAC method...

Added (4/12/2007 Tues 7:20)
Paraphrase, commentary and case law illustrations in this slide in blackboard:
Topic 4
SP Topic 4.ComputerLaw&Invest.ComputerCrime.ppt (114 Kb)

Examination Detail

2007-11-25T12:00:00.000+08:00

Well, I think most of us wouldn't bother to check our school email. So I better post this on the blog. Since Year 1, SP will send us a letter to our home with the details of our examination (Datetime, Venue etc..). But starting from this semester onwards, SP would not send such letter to us anymore. So we have to check our SAS for such details. For more information, take a look at that email they send to our school email.

Ridzwan's BDay!(25 Nov Sun)

2007-11-24T23:58:00.000+08:00

can leave comments or cbox(preferably bday cbox)

(over liao but belated still welcome)

ETH assignment questions

2007-11-23T19:19:00.000+08:00

hmm... some of the questions inside the assignment are not too clear... so some parts are explained here...

Right before 1a, the following can be found:
"Note: Show how you derive your findings by attaching details in an Appendix and provide references. "

This means that we have to include the tools used for each part and briefly explain how the answer is derived
(eg format:
Question: [question number]
Tool(s): [tool name(s)]
Step(s): [important steps taken]
)

For 1b,
For answers, no specific tool to use, hint is to find and read their websites for such info...

For 1f,
Domain name=
host names(eg. dns.mediaservice.net and other [something].mediaservice.net and [something].blackhats.it)
(not very sure about this...)

These 3 are more confusing questions... if got others can post in cbox

extra tip...(added 28/11/2007):
for 1f, 12 marks question should not have too short answers... and the answer really is quite long... lol...

so... tip is... use their mail server to find more answers...
happy trying!

extra tips again... (added 29/11/2007):
For 1b, subsidaries and diaster recovery etc should be given for mediaservice.net also

For 1f, domain names should include web domain names(eg. www.mediaservice.net)
For ppl who found alot of domain names and deciding if they should be included... this is a quote from mr lai...
"Pls include them in the report if you can quite confirm it's relevant"

"hidden" ip range and domain names(added 4/12/2007 7:30):
Hmm... assignment already submitted... so here is how to get ip range...
1. find mail server(mail2.mediaservice.net)
2. "host mail2.mediaservice.net" and get 213.254.20.2
3. you can see that the third bit is different from 213.254.16.* block
4. "whois 213.254.20.2" and get the "hidden" ip range(213.254.20.0-213.254.20.255)
5. write a script to host each of the ips inside this range and you should get 11 new domain names...

Tng Boon Kiat's BDay!(20 Nov Tues)

2007-11-19T23:45:00.000+08:00

hmm... same thing... can leave comments or cbox(preferably bday cbox)

(sorry to suzanne as the post was quite late... first bday since bday area came out...)

(hmm... over liao but belated is still welcome)

PT Lunch thingy

2007-11-19T21:18:00.000+08:00

Next week Wednesday(28 Nov 2007) 12pm-1pm
From email he sent to everyone... supposed to tell him if cannot go...

Suzanne's BDay!(17 Nov Sat)

2007-11-17T15:39:00.004+08:00

hmm... can leave comments here or cbox(bday one) to wish her happy bday bah

(hmm... over liao but belated is still welcome)

Additions to blog...

2007-11-17T15:39:00.003+08:00

1. got new menu thingy(see left)

2. planning to make a section for each module. but it is working now but cbox not working too properly...(fixed)

3. now there are 2 buttons under cbox, the words inside the buttons explains themselves

Note: Each section has a different cbox. To differentiate them, see the words inside the ( ) (brackets).
It may also take afew seconds before the cbox changes after you change page

cboxes combined again... except bday one

OPS class post

2007-11-17T15:39:00.001+08:00

Important things said in class will be listed in this post...

Lecture (10/12/2007 Week 13):
for exams... only need to remember RAID levels 1 and 5...

ETH class post

2007-11-17T15:38:00.002+08:00

Important things said in class will be listed in this post...

Lecture(30/11/2007)
Chapter 7 from book and pages 124-129 not included

DSM class post

2007-11-17T15:38:00.001+08:00

Important things said in class will be listed in this post...

CLI Class post

2007-11-17T15:36:00.000+08:00

Important things said in class will be listed in this post...
Fri(18/11) Week 8 CLI Lecture:

For exam:
Section A: MCQ,
Section B: Short answered questions,
Section C: Essay questions

Notes for Section C questions:
Use ILAC method
Identify(legal issues/problems)
Law (or Legal Principles)
Apply
Conclusion(personal opinion)

When answering:
State section(s) of CMA involved
paraphrase of section
commentary
case-law illustrations(support)

Tip: can use "Under provisions of CMA, [paraphrase etc]" if you forget exact section from CMA

WSNA class post

2007-11-17T13:08:00.000+08:00

Important things said in class will be listed in this post...

Lecture (27/11/2007 Week 10):
No more lectures and it will be moved to prac lessons...

WEBS class post

2007-11-17T01:31:00.000+08:00

Important things said in class will be listed in this post...

Prac (8/1/2008 Week 16):
Tutorial 12 answers are important... (2 questions)

Lecture (4/12/2007 Week 11):
High likely that a WSDL question will come out for exams...
And high likely that they will provide a WSDL file and ask us to interprete it

Lecture (10/12/2007 Week 12):
Chapt 11 important points:

the 3 types of registries(slide 10)
the 3 types of pages(slide 15)
the 2 types of discovery(slide 42)
Problems (slide 43)

Chapter 12 important points:

Limitations of SSL (slide 14)
Proposed security specs (slide 17)

ETH assignment

2007-11-08T13:35:00.000+08:00

hmm... for commands like dig, host and whois... there are afew ways to get them...

1. Use the commands through websites found at:
ETH blackboard>Module Docs>Prac>Footprinting Exercise>Footprinting Exercise 1

2. Use SamSpade:
Link can be found at:
http://www.softpedia.com/progDownload/Sam-Spade-Download-34862.html

3. Dl files and use it in your own windows cmd!
http://serghei.net/windows/dig/

From this source... you can either do it yourself from the site or follow this:
1. Download this: here!
(login:dismdl pw:dismdl)all letters all small caps
(Note: can check "remember me" with this ac to dl using ftp directly next time)
OR dl here!
If the abv dun work for you
2. Unzip it into any location you wan
3. Edit the file named "resolv.conf.txt"
4. Replace the "(replace this with your ip)" with your ip
5. Remove the .txt extension
6. Place the file inside "(your drive)\windows\system32\drivers\etc"
7. Set system environment variables
(those who know can do it, those dunno read below...)
8. Done!

For those who dunno how to set environment variables...
1. Right click on "my computer" and properties
2. Go to "Advanced" tab
3. Click on "Environment Variables"
4. Either edit "PATH" under either "User Variables" or "System Variables"
5. Go to the folder which you unzipped and copy the address
6. Paste the address into "Variable value"
(Note: make sure there is a ;(semi colon) betw each value)
7. Click OK 3 times
8. Done!

MST schedule and scope(ended yay)

2007-11-05T20:06:00.000+08:00

In chronological order...

5 Nov(Mon)
Module: DSM
Time: 3pm-4.10pm
Venue: T2132
Scope: All lecture slides except last one
(Maintaining Database Security Part 3) eLearning not included also
Format: Structured questions(eee i kena cheated lol)

6 Nov(Tues)
Module: WEBS
Time: 9am-10.10am
Venue: T2132
Scope: Chapters 1 to 6, theory test, plus XML Schema
Format: 15 MCQs, 5 True/False, 3 structured questions
not too reliable tips: here!
WEBS slides dl: here!

Module: WSNA
Time: 3pm-5pm
Venue: T2022
Scope: (copied from mock test doc)
Chapter 1 (Pages 8 – 13)
Chapter 3 (All)
Chapter 4 (Pages 93-105, 119-133)
Chapter 5 (Pages 139-160)
Chapter 6 (Pages 189-194, 204-208)
Exercise 4 (User Profiles and Home Folders)
Exercise 5 (Auditing, Disk Quotas and Task Scheduler).
Format: (see mock test)

7 Nov(Wed)
Module: OPS
Time: 9am-10:40am
Venue: T2132
Scope: Lecture, tutorial and practical sessions from weeks 1 to 5 and e-Learning.
Tips: here!
Format: 10 MCQ 4 Structured
Revision ppt: here!(updated 1:17am on 7/11) only those who check in morning will see this bah lol

Also... about classes...
For DISM, classes is cancelled for MST days(mon, tues, wed, fri)
Also, thurs is deepavali so public holiday!
opps... forgot to put here but most likely everyone know liao... GEMS as per normal...

WEBS study tips...

2007-10-27T14:03:00.000+08:00

This may help highlight some important points...
this is made by me(highly unreliable) so just reference abit dun follow too closely =X

Chapt 1: Slides: 3, 7-9, 11, 16, 18-20, 24-27
Chapt 2: Slides: 3, 7, 9, 36(good to read about each benefit)
Chapt 3: Slides: 15
Chapt 4: Slides: 5-7, 11, 15-17, 19, 20, 22-29, 31, 35-36
Chapt 5: Slides: 39-40
Chapt 6: Slide: 14(said to be very very important)

This "tips" is actually quite useless but maybe good for last minute revision tml...
Compiled revision slides: here! total 41 slides

OPS Tips

2007-10-25T22:00:00.000+08:00

From Koon Ming:

ITP resume

2007-10-25T20:06:00.000+08:00

Some important things to note for resume which are not said inside samples
(things which vernon suggested to ppl who submitted to him):
nationality
if you are liable for ns
recent photo(optional unless requested)
results(specifically results in poly currently)

those who know more can help add to the list =X

best to follow 1 sample and add these points in...

vernon's email is:
vernon_tan@sp.edu.sg

DSM assignment

2007-09-18T20:43:00.000+08:00

For the deliverables...
All of the listed should be handed up in hardcopy...
For point 1, you can either

-just print out all the generated script(will have alot of redundant codes)(easiest and personally recommended :p)
-remove extra coding(may not work properly after editing so must double check)
-type out all codes manually(test to make sure they work)

Symantec training course

2007-08-22T13:10:00.001+08:00

Symmantec Cert Training
-4 and 1/2 days
-$100(was $200)
-the week before school starts

Pls put in comment if you wan to go

SDT Summary

2007-08-17T17:57:00.000+08:00

from past year papers... seems like there will be:
5 true false
5 MCQ
5 structured

first 10 in Section A can tikam if dunno bah =X

Section B important points:
Use case diagram:

names of use case must be verb noun
there can only be solid lines from actor to use case
there can only be dotted lines from use case to use case
"include" and "extend" should be inside "<<" and ">>"
to use include you must have at least 2 include relationship
(convention: actors at
the border to allow boundary)

Activity diagram:

conditions inside guard must be inside '[' and ']'
names of activity must be verb noun
there can be more than 1 end state

Class diagram:

constrain should be inside '{' and '}'
name of association should be
singular verb(with s)

Sequence diagram:

object and actor name should start with ':' most of the time

State diagram:

guard condition should be in '[' and ']'

The abv are actually key points in first few pages in the book before examples. So those with book can ownself study dun care this bah =X

Section A should take all 9 chapters
Section B should only need chapters 2-7

And remember to do quizes on blackboard(compulsary for GP)

acg tips

2007-08-15T12:17:00.001+08:00

From Yong Xiang:
- C.I.A (Classical Security Objectives)
- Cryptanalytic attacks.
- Confusion - Permutation /diffusion -

- Classical Cipher
-Caesar (+3,-3) 26 letters
- Playfair (5X5) 36X26 letters/combinations
-Improved security
-Need a 676 entry frequency table to analyse
-The ciphertext depends on diagraph pair
-Reepated digraphs produce same ciphertext each time.
-Decipherment based on digraphs much more diffucult.(NOT IMPOSSIBLE NOW)

-Vigenere (table 26X26) That big table
-Rail Fence up down the alternating letters then take the ciphertext from first and second line.

-STRENGHT OF CIPHERS
-Good ciphers?
-Amount of secrecy needed should determine effort to encrypt and decrypt.
-key set and enciphering algorithm should not be complex.
-Implementation should be as simple as possible
-Errors should not propogate.
-Symetric Algorithm
-DES (64bit block, 56 bit KEY)
-ECB/CBC/CGB.OFB
-How they work?
-Trple DES 3DES
112 and 168 bit key.
-168 bit key (3keys)
-Encryption (E-D-E) 1st 2nd 3rd Key.
-Decryption (D-E-D) 3rd 2nd 1st key

-112-bit key
-Encryption (E-D-E) 1st 2nd 1st key
-Decryption (D-E-D) 1st 2nd 1st Key
-Asymetric
-RSA
- Public Key and Private Key.
-Calculations
c= M to the power of e mod n (pxq)
M = c to the power of d mod n (pXq)

One way hash function
-Message Digest
-One way
-Collision Free
-Fixed length of output
-Examples?
MD4/5, SHA 1,256,512.
Message Authentication code
-Key Hash Function
- Ewquires a secret key
Examples
(need to know)

-Key Distribution issue in symetric key distribution. Key can be lost, forgotten, forged.
-Public Key Infrastructure
-Problems or issues of PKI
-Authentication
-One Way (UserID and password)
-Two way/Mutual (Challenge Response Protocol)
-A Nonce (challenge) to B. Usually encrypted with password.
-B Nonce (message) to A.
-Compare results.
(THIS IS ONLY AN OVERVIEW) WHY NEED TWO WAY?
-Kerberos
-AS
-TGS
-Users subsequently request access to other services from TGS.

-Key exchange protocols
-RSA (public key to encrypt.) need PKI
-Fixed Diffie Hellman (need PKI)
-Anonymous Diffie Hellman (Exchange public parameters.With it and random number to generate a common value.)
-Ephemeral Difie Hellman (need PKI)
-Fortezza
Common value is not secret key. Use it for key exchange, Diffie hellman use to get that common value. So the key won't be seen!

(Need to know)
-IPSec
-SA
-How it works
-Applications
-SSL
-Suite of Protocols
-How it works?
-Applications
-SET
-Suite of protocols
-How it works?
-Applications

Also read on lectures slides, all tutorial exercises for better knowledge.

from Koon Ming:

NETS exam

2007-08-10T09:23:00.000+08:00

Chapter 1:
Common ports
IP classes
Tables 1-3
DMZ

Chapter 4:
3 way handshake
4 categories of attack

Chapter 5:
IPSec, IKE
Definition of VPN

Chapter 6*:
Drawing VPN layout
figure 6.5

Chapter 7:
Types of IDS
Glossary

Chapter 8*:
Incidence responce steps
Slide 19
(not too much focus should be put on diagrams)

Chapter 9:
Slide 34
configurating email rules

Chapter 10:
NAT

Note:
The exam is actually on Chapters 1-12, excluding 2,3, including lecture 11 slides
so... it is better to read all slides and book chapters excluding 2,3
also... chapters 10 and abv is said to be "not important" so should just read abit or browse through bah...

ELSA prac test

2007-08-04T14:44:00.000+08:00

Things to study:
1. MUST try out and understand mock test(obviously)
2. Read through lecture slides in blackboard
3. Read 3037v2, some keywords to search for are: ssh, samba, apache, syslog, pure-ftp, cron and ntp
4. Try out exercises for those with vmware, read through and try to remember what did you do in prac lessons for those without... =X
5. Be prepared to use man command alot in the prac, "man page for pure-ftp" can be displayed using "pure-ftp --help" i think...

Sorry but there really is no special tip for this lol

SAPD Exam

2007-08-04T14:26:00.000+08:00

Things to study:
bean: Week 14>cart.java and cartDemo.zip(not in book)
SQL: know syntax of common queries. eg. select, insert into and update(just incase this comes out, use "delete from" to remove a row)
cookie: 188 and 192(optional since can reference from book)

Not very sure what else to study cos can bring in book lol

Pages to remember:
SQL: "insert into" on page 198, "delete from" on page 206
cookie: as mentioned abv
Appendix A: 358-378(since others behind are not taught)

ACG assignment

2007-07-28T13:44:00.000+08:00

(found by Zhan Hong and his group)Site about the main threat of diffie-hellman(man-in-the-middle):
http://gauss.ececs.uc.edu/Courses/C653/PPT/dh.pdf

(found by me =X)Site about packages and tools for encryption:
http://java.sun.com/javase/6/docs/technotes/guides/security/
Focus on "API Specification>General Security" to see packages
and "Tools" for important tools like keytool.

(found by Zhan Hong and his group)Site about overall diffie-hellman:
http://en.wikipedia.org/wiki/Diffie-Hellman
Inside "Description>chart" segment has good information.

And i think that both CA and Digital Signature must be implemented to prevent man-in-the-middle attack... not very sure... =X
_______________________________________________________
Some questions which i asked lecturer are:
1. Can we make the application 2 way?
Of couse, you can. That is the whole idea. If make 2-way, that is ideal situation.

2. Inside Report Requirements, point number 4, "Handouts (or print-outs) of presentation slides on your findings." Is this same as presentation slides?
The group supposed to demo their project. Therefore you need to prepare the powerpoint slides. The presentation is to highlight "why you implement your solution with justification". Your powerpoint should be ready and submit together with your report. The powerpoint should be used for your presentation.

3. Inside Report Requirements, point number 6,
"Avoid mentioning high tech, sophisticated attacks using technology."
Say, you want to ensure integrity. This is how you do it... blah blah.
Say, you want to ensure confidentiality. This is how you do it in your application... blah blah
So don't mention very COMPLEX stuff... such as session highjacking.... syn attack...

3. Does this mean that we should only focus on "man-in-the-middle" attack and other basic flaws in the system?
You can mentioned man-in-the-middle attack, but i am more interested in your justification and how you implement it.

4. About learning reflection, are we supposed to do 1 for each member or submit 1 as a group?
Individual.

5. How do we do peer evaluation?
Just create a table and give a score out of a scale of 10 for each member. Rank them. Please don't give me all with 10 points.

Answers are in exact quotes... only changed the questions abit to look shorter...
_______________________________________________________
(found by Jack and his group)From a piece of print out during acg class(about the 3 types of diffie-hellman)

The current codes is "Anonymous Diffie-Hellman", the ideal situation should be to make it into a "Ephemeral Diffie-Hellman" which includes signing with RSA keys and certificate authentication.(Digital Signature and use of CA)

MST

2007-06-13T16:00:00.000+08:00

NETS

Chapter 1:

-Classes of ip addresses
-table 1-3
-Summary and Key Terms

Chapter 4:

-Categories of attacks.(and at least 2 attacks of each type)
-packet header discrepancies
-CVE
-figures are important, tables are not

Chapter 5:

-what are VPNs
-choosing VPN
-definition of encryption, encapsulation and authentication
-difference in encapsulation and encryption
-understanding tunneling protocols
-IPSec/IKE(SA, AH, ESP)
-Kerberos is not tested

SDT

Chapters 1-5

ELSA

Study tips on blackboard

ACG

All lectures(weeks 1-8) and all tutorials

-CIA

-Classical Ciphers
(Caesar, Playfair, Vigenere, Colummar)

-Symmetric ciphers
(DES, encryption rule and decryption rule, types of modes)

-Triple DES
(key length, encryption and decryption pattern(EDE, DED), number of rounds, based on fiestel cipher, advantages and disadvantages)

-AES
(key length, number of rounds, 149 trillion years to break, based on block cipher, advantages and disadvantages)

-Public cryptography
(RSA, based on 1 pair of keys, calculation: C=M^e mod n, calculation of keys= n(n-1)/2, process(P,Q,N,Z,etc), flow of encryption and decryption)

-One-way hash
(keyless and keyed, properties, examples)

SAPD assignment

2007-05-23T14:27:00.000+08:00

Here is a useful link(found by yong xiang) to help ppl with the NRIC checking...
http://forums.vr-zone.com/archive/index.php/t-69833.html

And yes, this codes does contain some errors but the overall algorithm is there...
And so... dun rely too much on the codes, just try to understand what the overall algorithm is doing

Note: pls acknowledge this as reference... else would get everyone into trouble...

NRIC validation checking...
S0000000J=true
S1000000I=true
S0100000D=true
S1111111D=true
S(7 random numbers + 1 random alpha)=false(unless you are lucky you change 1 digit)
with these 5 + own nric... if your validation works like this you should be correct...

PT lunch- Date

2007-03-06T19:06:00.000+08:00

Best to be within next week(12 Mar- 18 Mar)

Suggested							total
12 Mar(Mon)	1	0	0	0	0	0	1
13 Mar(Tue)	0	0	0	0	0	0	0
14 Mar(Wed)	1	1	0	0	0	0	2
15 Mar(Thu)	0	0	1	1	0	0	2
16 Mar(Fri)	1	0	1	1	1	1	5
17 Mar(Sat)	1	0	0	0	0	0	1
18 Mar(Sun)	1	0	0	0	0	0	1
Any of the above	3

Note: You can vote for any number of days as long as you are free on that day.

PT lunch- Location

2007-03-06T19:04:00.000+08:00

Best to be located at centrel area/train and bus interchange

Suggestions
Vivocity(suggested by Mr Liew)

Results
Vivocity: 2
Any: 1

PT lunch- Activity

2007-02-20T23:03:00.000+08:00

Here are some more basic and uncreative suggestions... Other suggestions are welcomed.

Activity
1. Lunch at food outlet
2. Barbecue
3. Steamboat
4. Ice cream(suggested by Mr Liew)
5. (others to be added)

Budget is $6.50 per person

Results
Barbecue: 1
Steamboat: 1
Ice cream: 3

PT lunchTime frame

2007-02-16T21:32:00.000+08:00

Ok... You all can leave comments without registering with blogger now... But pls leave your name inside the comments or it will not be counted =X

Time frame
Let's go for the most basic and obvious vote...
1. Should the PT lunch be before exam results? (7 mar)
2. Should it be after exams results?

Current
Before:4
After:6
(Neutrel votes= 1 for each)
Voting closed. Result: After exam result

IDEA presentation

2007-01-22T16:31:00.000+08:00

What to submit for IDEA presentation:

1. Final presentation of business proposal
2. Business proposal
3. "Poster"
4. Prototype
From page 6 of IDEA assignment overview.

1. Presentation (30 mins long)

2. Business proposal

-wear formal clothing(COMPULSARY) cos of some phototaking

-template in Blackboard under Course Documents>Tutorial Materials>Course Assignment 4 Templates>Business Plan

Or here
(Accessible only after logging in to blackboard here)

3. Poster

-Can use A4 paper or A3(drawing block) instead.

-templates in Blackboard also under Course Documents>Tutorial Materials>Course Assignment 4 Templates>A1 Layout Landscape

Or here
(Accessible only after logging in to blackboard here)

4. Prototype(Should already be made)

Time is as per normal at 9:00

WCD test

2007-01-21T00:10:00.000+08:00

Section A (20m): 10 MCQs
Tip(as quoted): No need to study(common sense)

Section B (80m):
Topics A-D

Topic A

Slides

Part 1: Pg. 16-26
Part 2: All

Textbook

Pg. 3,5-9
Pg. 5(table 1-2)

Topic B

Textbook

Chapter 2

Frame not tested.
Focuses more on HTML tags.

Topic C

Textbook
Chapter 3

CSS rules(Pg. 72 table 3-2)

CSS selectors, properties and rules are important.

Topic D

Textbook
Chapter 4

All except
Switch-case
array

Chapter 5

Study:
Object
indexOf

Chapter 6

Study:
\n
alert, confirm, prompt
onClick, onSubmit, onChange

Chapter 7

Study:
Pg. 197-200
Form validation
Functions

Tutorials

Tutorial 4-5 Additional questions.

CRS test

2007-01-20T23:23:00.000+08:00

CRS test tips:
Go through issues raised in CRS blog.
Link has been posted.

ISE2 exam questions

2006-12-16T16:43:00.000+08:00

Section A: MCQ
All chapters including E-Learning

Section B:
4 questions
1. Unit 5: Security Architecture and Models
     Things to take note of:
        1. TCSEC, ITSEC and CC
        2. First 2 and last 2 levels of CC
        3. Types of levels and the relations between levels(opps seems like I treated rationale behind CC to rationale behind each level...)

2. Unit 8: Physical Security Control
     Things to take note of:
        1. Threats
        2. Controls

3. Units 4,7,9: Security Management, Law, Investigations, and Ethics, Operations Security
     Things to take note of:
        Unit 4: Quantitative and Qualitative risk analysis(never come out)
        Unit 7: Laws will not be included, more on ethics
        Unit 9: Types of security controls

4. Units 6,13: Business Continuity Planning and Diaster Recovery Planning, Application Development Security
     Things to take note of:
        Unit 6: Types of alternate sites(never come out), methods of testing DRP
        Unit 13: SDLC process, Security activities

Special pages to take note of: 91, 98, 130, 132, 153, 167, 300

PS: Hope i did not miss anything out...

Yay! First post!(WCD)

2006-12-15T17:54:00.000+08:00

Some things to take note of for WCD assignment:

To make an input box which cannot be changed, use the following:
(input value="anything you like" readonly) Note: use pointy brackets
Example:

To truncate a number, use Math.round
To truncate to 2 decimals, use Math.round(value*100)/100

For example, if value is 10.567
value*100=1056.7
Math.round will make a decimal into nearest whole number.
Thus Math.round(1056.7) will make 1057
Math.round(value*100)/100=1057/100=10.57

Example:

The codes can be seen near top in the source codes. Please TRY to copy with understanding.:p

PS: Dun tell lecturers that it is posted here.(Or later everyone lesser marks =X)