NAME:

TODAY’S DATE:

ISEC 610 Homework 2

Question 1

Match policies, standards, procedures, and guidelines described in Chapter-5 with the security roles described in Chapter-6. There are two sample rows. Fill out five extra rows similarly.

Question 2 – Weekly learning and reflection

In two to three paragraphs of prose (i.e., sentences, not bullet lists) using APA style citations if needed, summarize and interact with the content that was covered this week in class. In your summary, you should highlight the major topics, theories, practices, and knowledge that were covered. Your summary should also interact with the material through personal observations, reflections, and applications to the field of study. In particular, highlight what surprised, enlightened, or otherwise engaged you. Make sure to include at least one thing that you’re still confused about or ask a question about the content or the field. In other words, you should think and write critically not just about what was presented but also what you have learned through the session. Questions asked here will be summarized and answered anonymously in the next class.

Research Paper: Microsoft Software Development Security

Overview

The purposes of this assignment is:

1) To analyze and inspect main components of Microsoft SDLC (Secure Development Lifecycle Process).

2) To describe and explain security features and essential security configuration of Microsoft .NET framework and ASP.NET.

Research

Please refer to following resources to complete this project:

· Textbook Chapter 26 and Chapter 29

· SDLC: https://www.microsoft.com/en-us/securityengineering/sdl/practices

· .NET: https://docs.microsoft.com/en-us/dotnet/standard/security/

· .NET:https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DotNet_Security_Cheat_Sheet.md

· ASP.NET: https://support.microsoft.com/en-us/help/891028/asp-net-security-overview

· Other resources you find

Write

Part 1: Microsoft SDLC Practices

· Carefully review the Microsoft SDLC page.

· Prepare a 250-300 word overview of the Microsoft SDLC practices. Summarize all 12 of the practices in SDLC.

· Select one of the following practices. In one paragraph, research and summarize available tools in the market:

· Practice #4 – Threat modeling

· Practice #9 – Perform Static Analysis Security Testing (SAST)

· Practice #10 – Perform Dynamic Analysis Security Testing (DAST)

· Practice #11 – Perform Penetration Testing

Part 2: .NET Security Guidelines

Describe essential items in a.NET security guidelines in 150-200 words. Use the textbook, Microsoft .NET security page, OWASP GitHub page, and any other authoritative resources you find.

Part 3: ASP.NET Security Guidelines

Describe essential items in a ASP.NET security guidelines in 150-200 words. Use the textbook, Microsoft .NET security page, OWASP GitHub page, and any other authoritative resources you find.

Theoretical Project

Name of Student

Instructor

Institution

Course

Date

Theoretical Project

Fraud Detection System Using Machine Learning

Fraud Detection through Machine Learning enables the system users to run an automated transaction processing on the dataset. The involved Machine Learning model detects all potential fraudulent activities and flags. The fraud detection system using Machine learning remains the future for fraud detection in every financial institution since the ancient rules-based fraud detection systems have failed in their detection role since they cannot align with current technological advancements.

The Project Idea

The primary idea of this project is to facilitate self-learning to enable the system to adapt to new, unknown fraud patterns for detection. Unlike rules-based systems, this idea is based on machine learning, noting the fraudulent transactions that portray strange trends that are different from genuine ones. Machine learning algorithms detect the trends and can differentiate those between scammers and authentic customers (Akinbohun & Atanlogun, 2018). In the banking industry, this idea has successfully helped banks eliminate fraudulent transactions by fraudsters.

Furthermore, the implementation will immediately replace inconsistent and ineffective traditional fraud detection techniques. Over the past decades, banks, and other financial institutions have used rules-based systems associated with manual evaluation to detect fraud (Zhou et al., 2018). However, this project aligns with the current technology that has led fraudsters to increase in sophistication, such that the traditional systems cannot help anymore. The technology can assist machines in predicting and responding to suspicious activities in the system by fraudsters.

Work To Be Performed

This project’s primary task is collecting and clustering the previously recorded data for fraud prevention and risk management programs. The gathered data will include information regarding legitimate and fraudulent transactions (Mallidi & Zagabathuni, 2021). After collection, the data will have a ‘legitimate or fraudulent transactions or clients’ label.

After collection, the data will be used to “teach” the machine learning software to detect whether a specific client or transaction is fraudulent or legitimate. A successful fraud detection system will need to gather more data on fraud trends. This maximum data collection will have many examples that algorithms can learn for accurate detection (Mallidi & Zagabathuni, 2021). After training the machine learning algorithm, the software becomes specific to the transactions and is said to be ready for use in the fraud management model. Therefore, the work will primarily train the algorithm by subjecting it to as huge data as possible to learn the patterns and update it from time to time since it is not infallible.

The project manager, the bank director (project sponsor), bank employees, and the software developers are involved.

Literature Review Behind the Motivation for Doing Project

According to Yee et al. (2018), the dominance of online-related transactional activities has raised fraudulent incidences worldwide. These activities have contributed to considerable losses to individuals and the banking sector. Despite the presence of multiple cybercrime practices within the banking sector, credit card fraudulent activities dominate, making online customers vulnerable to losing their money. Therefore, Yee et al. (2018) demonstrate that preventing fraud activities via a machine learning and data mining is a crucial strategy for eliminating illegal monetary acts. Initially, data mining approaches played a critical role in studying the trends and characteristics of legitimate and fraudulent transactions based on anomalies and normalized data.

References

Akinbohun, F., & Atanlogun, S. K. (2018). Credit Card Fraud Detection System in Commercial Sites. European Journal of Engineering and Technology Research, 3(11), 1-5.

Mallidi, M. K. R., & Zagabathuni, Y. (2021). Analysis of Credit Card Fraud Detection using Machine Learning models on balanced and imbalanced datasets. International Journal of Emerging Trends in Engineering Research, 9(7).

Yee, O. S., Sagadevan, S., & Malim, N. H. A. H. (2018). Credit card fraud detection using machine learning as data mining technique. Journal of Telecommunication, Electronic and Computer Engineering (JTEC), 10(1-4), 23-27.

Zhou, H., Chai, H. F., & Qiu, M. L. (2018). Fraud detection within bankcard enrollment on mobile device based payment using machine learning. Frontiers of Information Technology & Electronic Engineering, 19(12), 1537-1545.

A final report which describes and documents your analysis and design efforts of the proposed solution. Your report must include at a minimum

• A brief description of the problem, functionality of your proposed information system solution, and the business benefits gained by implementing it.
• Artifacts such as use case diagrams, activity diagrams, context level data flow diagrams, E-R diagrams, user interfaces etc. used in your information needs/requirements specification and the systems design.
• List of the hardware and software required to meet the needs of your business problem.
• A brief discussion on what kind of a project methodology do you envision to use to implement your proposed solution. Include in your discussion the possible project scope and risk issues, you may encounter.

Note: For 1st and 2nd bullet points, you can use your assignment work and add it to the report