Security Evaluation 1

Out: Tuesday, April 10
Due: Tuesday, April 17 (start of class)

Description

At the end of class on April 3, we did an exercise in which everyone evaluated the security of a real product.

For this security evaluation, you are to do this exercise again, this time for the U.S. telecommunications (landline, cellular) systems.

Namely, please provide the following:

• Summary of the U.S. telecommunications system. This should be at a very high level, around one or two paragraphs in length. State the parts that are relevant to your observations below.
• State three assets and security goals. Please explain why the security goal is important. This should be around one or two sentences per asset/goal.
• State three potential adversaries and threats. You should have around one or two sentences per adversary/threat.
• State three potential weaknesses. Again, justify your answer with around one or two sentences per weakness. Hypothesize about how one might protect against these weaknesses.

We realize that many of you may not know how the U.S. telecommunications system works internally. That's OK. Just state your assumptions.

Think about the big picture. For example, think about all the types of calls one might wish to make (911, family, business, etc). Think about all the parties involved (businesses, cellular providers, average citizens, professional criminals, foreign nations, etc).

Extra credit may be awards for extreme creativity. (And remember, some adversaries may be very creative!)

I suggest typing your security evaluation. If we cannot read what you write, we will not be able to evaluate your submission and will have no choice but to award a zero grade.