[yashrajkakkad (OP)]

I am supposed to participate in a science exhibition where I have to prepare a static/dynamic model on IT/Cyber Security. In other words, I have to find a gap in this industry, fill it and present it accordingly.

So what do you think can be a good idea for this exhibition?

[chris]

We did a programme on Internet security recently. The threats owing to failure by the general public to alter pre-set security configurations - like leaving the default "user: admin password: admin" means that there most people are horribly exposed.

The Hack Attack show we made (linked to above) should be a fertile source of ideas for you.

Chris

[nicephotog]

How about Internal company networking(e.g. VPN's and Intranet) and "data integrity with self constructed certificates", "authorization and use process procedure" and "data check-summing".

[alancalverd]

A fun project would be to assess the cost of pointless "security".

I spend a lot of time in clinics waiting for someone to find the password to their image processing computer so I can test the x-ray machines. This adds about 10% to the cost of my services. Who would  steal the x-rays of a dog's teeth?

Best so far was a dental school where I spent 4 hours drinking coffee (at the taxpayer's expense) before I could do 2 hours' work, and a private CT scanner that had been installed by an engineer who at that very moment was on a flight to India with the password....

It takes about 20 seconds to write a cheque. It takes more than 60 seconds to log in to an on-line bank account, they you have to faff about getting the payee's account number wrong.....

If you want to authorise and identify a user, what's wrong with a key? It works for houses and cars.

The other interesting aspect is one of legal liability. If someone does you harm via some form of "identity theft", it is clearly the responsibility of the bank or whatever to compensate you. The implicit contract is for the bank to act on your instructions and no others, so if they respond to a fraudulent instruction, it's their fault for failing to adequately identify the author - after all, it is their security system, not yours. But will the argument stand up in court?

[RD]

If you want to authorise and identify a user, what's wrong with a key? It works for houses and cars.

Physical IT keys already exist ... https://en.wikipedia.org/wiki/Software_protection_dongle

Q. "what's wrong with a key?"
 A. It gets lost and you get locked-out.

[evan_au]

What about a survey of internet-connected devices which can be purchased by the public? Things like:
- Smartphone
- Smartphone Aps
- Popular sites like Facebook, Twitter, eBay, etc
- Fitness Trackers
- Home security systems
- Security tools (McAffee, Symantec, etc)

Ask questions like:
- Do they have a Security or Privacy policy?
- Is the policy available to the public before they sign up?
- Is the policy comprehensible to the public?
- How many people click "Accept" without reading it? (I heard one survey where the average time to click "ACCEPT" was about 1 second!)
- Does it cover things like:
    + Who owns my data?
    + How well is it protected?
    + Who is it given to?
    + Is it anonymized in some way?
    + What happens if the company goes bankrupt?
    + How will I know if there is a data breach?


Maybe buy a fitness tracker, and see if you (as the owner) can get access to your own raw data.