Network Security Exam 1

Section 1: Introduction to Network Security Systems

This section introduces the course "Network Security Systems (EECE 461 / ECEG 761)" and provides a formal definition of computer security.

Computer security is formally defined as "the protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunications)" (NIST Computer Security Handbook).

Key points:

  • Computer security aims to preserve the integrity, availability, and confidentiality of information systems.

  • It encompasses the protection of hardware, software, firmware, data, and telecommunications.

Section 2: Security Services and Objectives

This section discusses the key security services and objectives, including confidentiality, integrity, availability, authenticity, and accountability.

  • Confidentiality: Assures that private or confidential information is not disclosed to unauthorized individuals.

  • Integrity: Assures that information and systems are modified only in an authorized manner.

    • Data integrity: Information is not modified without authorization.

    • System integrity: Systems perform intended functions without unauthorized manipulation.

  • Availability: Assures that systems work promptly and service is not denied to authorized users.

  • Authenticity: Verifies that users are who they claim to be and that inputs come from trusted sources.

  • Accountability: Ensures that actions of entities can be traced uniquely to those entities.

Key points:

  • The CIA triad (Confidentiality, Integrity, and Availability) is the foundation of information security.

  • Authenticity and accountability are also crucial security objectives.

Section 3: Threats and Attacks

This section defines threats and attacks, and classifies them into passive and active attacks.

  • Threat: A potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm.

  • Attack: An intelligent act that deliberately attempts to evade security services and violate the security policy of a system.

  • Passive attacks: Attempt to learn or make use of information from the system without affecting system resources (e.g., eavesdropping, traffic analysis).

  • Active attacks: Attempt to alter system resources or affect their operation (e.g., masquerade, replay, modification of messages, denial of service).

Key points:

  • Threats and attacks can be classified as passive (eavesdropping) or active (modifying data, denying service).

  • Active attacks involve various techniques like masquerade, replay, message modification, and denial of service.

Section 4: Security Services

This section discusses the various security services, including authentication, access control, data confidentiality, data integrity, and non-repudiation.

  • Authentication: Assuring that a communication is authentic and from the claimed source.

  • Access control: Limiting and controlling access to host systems and applications via communication links.

  • Data confidentiality: Protecting transmitted data from passive attacks (eavesdropping).

  • Data integrity: Assuring that messages are received as sent, with no duplication, insertion, modification, reordering, or replays.

  • Non-repudiation: Preventing the sender or receiver from denying a transmitted message.

Key points:

  • Authentication and access control are fundamental security services.

  • Data confidentiality protects against passive attacks, while data integrity protects against active attacks.

  • Non-repudiation ensures accountability for sent and received messages.

Section 5: Attack Surface and Security Model

This section introduces the concept of attack surface and presents a model for network security.

  • Attack surface: Consists of reachable and exploitable vulnerabilities in a system (e.g., open ports, services, interfaces, code vulnerabilities).

  • Network security model: Illustrates the various components and layers involved in network security, including encryption, authentication, and secure communication protocols.

Key points:

  • The attack surface represents potential entry points for attacks and must be minimized.

  • The network security model provides a framework for understanding and implementing security measures.

Section 6: Symmetric Encryption

This section covers symmetric encryption principles, including terminology (plaintext, encryption algorithm, secret key, ciphertext, decryption algorithm), requirements, and types of operations (substitution, transposition, product systems). It also discusses symmetric block encryption algorithms like DES, 3DES, and AES.

Key points:

  • Symmetric encryption uses the same secret key for encryption and decryption.

  • Security depends on keeping the key secret, not the algorithm itself.

  • Block ciphers (DES, 3DES, AES) process data in fixed-size blocks.

Section 7: Random and Pseudo-random Numbers

This section briefly mentions the use of random and pseudo-random numbers in network security algorithms and the requirements of randomness and unpredictability.

Key point:

  • Random and pseudo-random numbers are essential for cryptographic algorithms, requiring both randomness and unpredictability.

Section 8: Stream Ciphers and RC4 Algorithm

This section introduces stream ciphers, which process data continuously, and discusses the RC4 algorithm, a widely used stream cipher in various protocols like SSL/TLS and WEP/WPA.

Key points:

  • Stream ciphers process data continuously, producing output one element at a time.

  • The RC4 algorithm is a widely used stream cipher in various security protocols.

Section 9: Message Authentication

This section discusses message authentication, which ensures the integrity and authenticity of messages. It covers approaches using symmetric encryption, message authentication codes (MACs), and hash functions (with or without encryption).

Key points:

  • Message authentication verifies the integrity and authenticity of messages.

  • Approaches include MACs, hash functions, and using symmetric or asymmetric encryption.

Section 10: Secure Hash Functions

This section focuses on secure hash functions, their purpose, and security considerations. It also discusses the SHA (Secure Hash Algorithm) family of hash functions.

Key points:

  • Hash functions produce a "fingerprint" or condensed representation of data.

  • Security depends on the length of the hash code and resistance to cryptanalysis and brute-force attacks.

  • The SHA (Secure Hash Algorithm) family of hash functions is widely used.

Section 11: Public-Key Encryption

This section introduces public-key encryption, also known as asymmetric encryption, which uses two different keys (public and private) for encryption and decryption. It covers the structure, misconceptions, and applications of public-key cryptosystems, including encryption/decryption, digital signatures, and key exchange.

Key points:

  • Public-key encryption uses two different keys (public and private) for encryption and decryption.

  • Applications include encryption/decryption, digital signatures, and key exchange.

  • Well-known algorithms include RSA and Diffie-Hellman key exchange.

Section 12: Digital Signatures

This section discusses digital signatures, which provide authentication and non-repudiation using public-key cryptography. It covers the Digital Signature Standard (DSS) and the digital signature process.

Key points:

  • Digital signatures provide authentication and non-repudiation using public-key cryptography.

  • The Digital Signature Standard (DSS) specifies a digital signature algorithm (DSA).

Section 13: Remote User Authentication

This section focuses on remote user authentication, which is the process of verifying a user's identity. It discusses the identification and verification steps, means of authentication (something you know, have, are, or do), and the importance of user authentication for access control and accountability.

Key points:

  • User authentication verifies a user's identity and is crucial for access control and accountability.

  • Authentication factors include something you know (passwords), have (tokens), are (biometrics), or do (behavioral characteristics).

Section 14: Symmetric Key Distribution

This section discusses the challenges of symmetric key distribution, including the need for secure key exchange, frequent key changes, and protecting keys from unauthorized access.

Key points:

  • Symmetric key distribution requires secure key exchange and protection mechanisms.

  • Frequent key changes are desirable to limit the amount of data compromised if a key is compromised.

Section 15: Link vs. End-to-End Encryption

This section contrasts link encryption, which encrypts and decrypts traffic at each end of a communication line, with end-to-end encryption, where messages are encrypted by the sender and decrypted only by the intended receiver.

Key points:

  • Link encryption operates at the communication line level.

  • End-to-end encryption provides protection from the sender to the receiver.

Section 16: Key Distribution Centers (KDCs) and Kerberos

This section introduces Key Distribution Centers (KDCs) as a centralized approach to key distribution. It also discusses Kerberos, a key distribution and user authentication service developed at MIT, which relies on symmetric encryption and uses an Authentication Server (AS) and Ticket Granting Server (TGS) for authentication and ticket granting.

Key points:

  • Key Distribution Centers (KDCs) provide centralized key distribution and authentication services.

  • Kerberos is a widely used authentication service that uses symmetric encryption and a ticket-granting mechanism.

Section 17: Key Distribution using Asymmetric Encryption

This section discusses the use of public-key encryption for key distribution, including the distribution of public keys and the use of public-key encryption to distribute secret keys securely. It also introduces the concept of public-key certificates and their use in verifying the authenticity of public keys.

Key points:

  • Public-key encryption can be used for secure key distribution and distribution of public keys.

  • Public-key certificates, signed by trusted Certificate Authorities (CAs), ensure the authenticity of public keys.

Section 18: SSL/TLS Protocols

This section covers the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, which provide secure communication over the internet. It discusses the SSL Record Protocol, Handshake Protocol, and the use of HTTPS (HTTP over SSL/TLS) for secure web communication.

Key points:

  • SSL/TLS protocols provide secure communication over the internet, including web traffic (HTTPS).

  • The Handshake Protocol allows authentication and key negotiation between the client and server.

  • SSL/TLS is widely used for secure web communication (HTTPS).

Section 19: Domain Name System (DNS)

This section introduces the Domain Name System (DNS), its hierarchy, and the use of caching and name servers. It also discusses DNS security threats such as DNS hijacking and cache poisoning.

Key points:

  • DNS is a distributed system for resolving domain names to IP addresses.

  • Caching and name servers are used to improve efficiency and distribute the load.

  • DNS is vulnerable to attacks like hijacking and cache poisoning, which can redirect users to malicious sites.

Section 20: SSH (Secure Shell)

This section briefly mentions the Secure Shell (SSH) protocol and its use for secure remote access and tunneling.

Key point:

  • SSH provides secure remote access and tunneling capabilities.

Section 21: TCP/IP Network Model

This section presents the TCP/IP network model, which consists of the Application, Transport, Internet/Network, and Network Access layers, and their respective functions.

Key points:

  • The TCP/IP model defines the layered architecture for network communication.

  • Each layer has specific responsibilities, from representing data to the user (Application) to controlling hardware devices (Network Access).