Imagine that you have recently joined a university as a central information security analyst. On a busy Wednesday morning, your supervisor tells you that a significant vulnerability has been discovered in the university$$s cryptosystem. Since this is a serious matter, he wants you to do some research and come up with a list of things that the university should do to handle the situation. When you inquire about the vulnerability, he points to the following URLs:

http:$//$technet$.$microsoft.com$/$en$-$us$/$security$/$advisory$/961509$

http:$//$www$.$win.tue.nl$/$hashclash$/$rogue$-$ca$/$

http:$//$www$.$kb$.$cert.org$/$vuls$/$id$/836068$

http:$//$www$.$cisco.com$/$en$/$US$/$products$/$csr$/$cisco$-$sr$-20090115-$md$5.$html

You are a bit unsure about how your university uses the cryptosystem, so he explains that the university uses Message$-$Digest algorithm $5($MD$5)$ in a wide variety of areas. These include hashing to check for file integrity of downloaded files, as well as MD$5$ hashes that the university provides for its own files that it makes available for download, MD$5$ based$-$signing certificates from the university's internal Certificate Authority. In addition, the university uses a Cisco ASA firewall device which can create and sign digital certificates for users and systems. These ASAs use MD$5$ by default, and the university has used the ASAs to create certificates for critical systems in some departments.

With these considerations in mind, you are required to submit a report on the threat the university faces and what response it would require from your institution. Briefly explain what the university should do about the vulnerability, and what effect any changes required might have on the institution or its students, employees, graduates, or other populations. The summary should include what the vulnerability is$,$ how dangerous it could be$,$ what its effects are and how it can be countered or remediated. You should address communication of the issue, such as who would need to be made aware of it and how. Therefore, while writing the summary, consider answering the following questions:

What effect does the vulnerability have on the cryptosystem?

Is the threat significant? What would an exploit of the cryptosystem mean to your organization?

How easy is it to exploit the vulnerability?

Does a tool exist to exploit the vulnerability?

Is the cryptosystem still usable but with caveats, or should it be replaced?

Can your organization easily replace the cryptosystem?

Has an exploit been released?

What is the likelihood of an exploit?

Would attacks be conducted? What would their result be$?$

How widely used is the system?

Would the attacks cause it to be no longer trustworthy?

What information is required for a technical audience?

What information is required for a nontechnical audience?

Required Resources

Access to the Internet

Submission Requirements

Format: Microsoft Word

Font: Arial, $12-$Point, Double$-$Space

Citation Style: APA

Length: $12$ pages

Self$-$Assessment Checklist

I have explained what effect the vulnerability has on the usefulness of the cryptosystem and explained why this is significant.

I have explained the effect of the threat in the context of a higher education institution.