An attack is an attempt to bypass security mechanisms to access or damage data.
Security services provide protection for data and communication:
Security mechanisms enforce security services, such as encryption, digital signatures, and hashing.
This model identifies how to secure communication over networks. It includes:
Sender → [Encrypt using Key] → Secure Channel → [Decrypt using Key] → Receiver
Cryptography is the science of securing communication using codes.
Plain Text: Hello
Key: +3 Shift (Caesar Cipher)
Encryption → Cipher Text: Khoor
Decryption → Plain Text: Hello
Uses a pair of keys: one public and one private. Public key is shared with everyone, private key is kept secret.
User A → [Encrypt using B’s Public Key] → Message → B decrypts using Private Key
Used to verify the authenticity and integrity of a message.
Sender: [Sign using Private Key] → Message + Signature
Receiver: [Verify using Public Key]
Process of confirming the identity of a user or system.
User → [Enters Credentials] → System → [Verify] → Access Granted/Denied
Kerberos is a secure authentication protocol for client-server applications using secret-key cryptography.
It uses a trusted third party called Key Distribution Center (KDC).
Client → AS: Request login
AS → Client: TGT
Client → TGS: Request service ticket
TGS → Client: Service Ticket
Client → Server: Access service using ticket
X.509 is a standard defining the format of public key certificates. It provides digital identity using Certificate Authorities (CA).
Certificate = {User Info, Public Key, Expiry Date, CA Signature}
Verification = Use CA's public key to validate certificate.
This service authenticates users based on directory data (LDAP or similar directory services).
User → Login with credentials
Server → Validate against Directory (LDAP)
Response → Access Granted/Denied
PGP is a data encryption and decryption program for securing emails and files.
Sender:
- Encrypt message with session key (symmetric)
- Encrypt session key with recipient's public key
- Sign with sender's private key
Receiver:
- Decrypt session key with private key
- Verify signature with sender's public key
- Decrypt message
S/MIME is a standard for public key encryption and signing of MIME data in email.
Sender:
- Encrypt Email + Sign with private key
Receiver:
- Verify Signature with sender's public key
- Decrypt using private key
IPSec is a suite of protocols used to secure Internet Protocol (IP) communications by authenticating and encrypting each IP packet in a communication session.
Use Case:
Secure communication between two systems over an unsecured IP network (e.g., VPN).
AH provides connectionless integrity and data origin authentication for IP packets. It also protects against replay attacks.
Packet Structure with AH:
[IP Header][AH][Payload]
Fields in AH:
- Next Header
- Payload Length
- Security Parameters Index (SPI)
- Sequence Number
- Authentication Data
ESP provides confidentiality, data origin authentication, and integrity. It encrypts the IP packet data.
Packet Structure with ESP:
[IP Header][ESP Header][Encrypted Payload][ESP Trailer][ESP Auth]
Fields in ESP:
- SPI
- Sequence Number
- Payload Data (encrypted)
- Authentication Data (optional)
A Security Association (SA) defines the parameters for secure communication. IPSec can use multiple SAs together in a specific order called a "bundle."
Example SA Bundle:
[Original IP Packet]
↓
Apply AH → Add AH Header
↓
Apply ESP → Encrypt Payload + Add ESP Header/Trailer
↓
Send Encrypted Packet
Key Management is essential for creating and distributing cryptographic keys securely between entities using IPSec.
IKE Steps:
1. Negotiate security policy
2. Exchange keys securely (e.g., using Diffie-Hellman)
3. Establish Security Association
Web security is essential to protect sensitive data and ensure secure communication over the internet.
Example:
When logging into a bank website, your credentials and session data must be encrypted and authenticated.
SSL is a protocol for establishing authenticated and encrypted links between networked computers.
SSL Handshake Steps:
1. Client sends "Hello" to server.
2. Server sends certificate.
3. Client verifies certificate.
4. Session key is generated and exchanged securely.
5. Encrypted communication starts.
TLS is the successor to SSL and is more secure and efficient. It provides privacy and data integrity between applications over a network.
TLS = SSL 3.0 + Improvements
TLS 1.2 and TLS 1.3 are widely used today.
SET is a protocol developed by Visa and MasterCard for secure credit card transactions over the internet.
SET Flow:
1. Customer gets digital certificate.
2. Customer places an order.
3. Merchant and payment gateway verify details.
4. Payment is processed securely without revealing card info to the merchant.
SNMP (Simple Network Management Protocol) is a framework used for managing devices on IP networks. It enables monitoring, configuration, and control of network devices like routers, switches, and servers.
Example:
Manager (central software) <--> Agent (on router)
Manager sends GET request → Agent responds with CPU load.
SNMPv1 is the original version and operates over UDP using port 161 for agent listening and 162 for traps.
SNMPv1 Example:
Manager sends GET to agent → Agent responds with data.
Agent sends TRAP if CPU usage is too high.
Limitation: No authentication or encryption; vulnerable to spoofing.
SNMPv3 introduces security features to overcome SNMPv1 and SNMPv2 vulnerabilities. It adds authentication, privacy (encryption), and access control.
SNMPv3 Example:
- Manager authenticates with the agent.
- Sends encrypted GET request.
- Agent verifies identity and responds with encrypted data.
Note: SNMPv3 is the preferred version for secure network management.
Intruders are unauthorized users who attempt to access, steal, or damage information systems.
Example:
A user guesses an admin password and installs keylogger software.
Malware refers to malicious software intended to harm or exploit systems. Types include:
Example:
A USB drive with a worm infects the system and spreads over LAN.
Firewalls monitor and control incoming and outgoing network traffic based on security rules.
Example Rule:
Block all incoming traffic on port 21 (FTP).
Allow HTTPS traffic on port 443.
Several tools and platforms are used to demonstrate and implement system security:
Example:
Use Snort to monitor packets for unauthorized port scanning.
Configure rules to alert on suspicious activity.
Configuration Management involves maintaining the integrity and consistency of a system's performance and functionality.
Example:
Use Git to manage firewall configuration scripts and track updates.
Use Ansible for automated configuration deployment.