Secure Protocols Notes

Security Protocols

  • A security protocol is an abstract protocol that performs a function securely using cryptographic methods.
  • Essential for password-protected URLs to prevent eavesdropping.
  • All network protocol levels are vulnerable to eavesdropping and manipulation.
  • Proper cryptography is necessary for security.
  • Effective mechanisms protect session-oriented and session establishment protocols.
  • Secure equivalents exist for many insecure protocols.
  • Examples:
    • SSH instead of Telnet.
    • SFTP instead of FTP.

"Do I Know This Already?" Quiz

  • Self-assessment quiz to gauge understanding before reading the chapter.
  • Key topics include protocols and use cases.
  • Questions:
    1. How to create a chain of trust using DNS? d. Configure and use DNSSEC.
    2. How to secure LDAP? b. Install a properly formatted PKI certificate.
    3. How does SSH secure communications? b. By using asymmetric (public key) cryptography
    4. S/MIME utilizes which cryptographic mathematic key type? a. Symmetric
    5. Authentication Header (AH)/Encapsulating Security Payloads (ESP) guarantees connectionless integrity. c. Connectionless integrity
    6. Which email protocol allows the user to download all the messages and still retain a copy of the email on the email server? c. IMAPS
    7. What Hypertext Transfer Protocol provides encrypted communications? d. HTTPS
    8. Which time zone should you configure your NTP server to utilize? d. UTC (Coordinated Universal Time)
    9. What type of remote access is the most widely used and secure method considering all your assets are located behind a firewall? a. VPN
    10. Ways to secure DNS without DNSSEC: a. Limit or disable zone transfers. b. Use trusted DNS forwarders. c. Use firewalls and limit communications to the DNS server. d. Use caching-only DNS servers.

Protocols

  • A protocol is a standard set of rules for electronic devices to communicate.
  • Includes data types, commands, and confirmation methods.
  • Similar to a spoken language enabling effective communication between devices.

Domain Name System Security Extensions (DNSSEC)

  • DNS translates IP addresses to names via UDP port 53.
  • DNSSEC provides secure answer validation using public key cryptography.
  • Backward-compatible and deployable alongside traditional DNS.
  • Does not encrypt traffic; keys used for authentication.
  • Enhances security features like SPF and DKIM.
  • Secures the chain of trust between DNS records at each domain level.
  • Verifies trust between child and parent domains, up to the root zone.
  • Ensures the integrity of DNS records, confirming the website or service's authenticity.
  • Protects against malicious URLs impersonating sites for harvesting credentials.
  • Guards against man-in-the-middle attacks, DNS cache poisoning, and spoofing.
  • Returns a 404 error for domains with unvalidated DNS records.
  • Setup steps:
    1. Verify TLD supports DNSSEC.
    2. Ensure service provider supports DNSSEC.
    3. Generate Zone Signing Key (ZSK) and Key Signing Key (KSK) for the domain DNS zone.
    4. Sign the DNS zone to generate signed zone records.
    5. Generate the DS Declaration of Signing Record with hashed values for cryptographic keys.
    6. Import the DS record(s) to the nameserver.
    7. Test the chain of trust and DNSSEC.
  • Note: DNS was not initially designed with security in mind (designed in the 1980s).
  • Tip: DNSSEC is defined in RFCs 4470, 4641, 5155, and 6014.

SSH (Secure Shell)

  • Network communication protocol for secure data sharing between devices.
  • Communication is encrypted, suitable for insecure networks.
  • Replaces insecure Telnet.
  • Uses asymmetric (public key) RSA cryptography for connection and authentication.
  • Implementation should be phased, starting with high-value assets.
  • SSH connection process:
    • ssh {user}@{host}
    • ssh command initiates the encrypted Secure Shell connection.
    • {user} represents the account to access (e.g., root).
    • {host} refers to the computer's IP address or domain name.
  • Prompts for the account password; nothing is displayed, but the password is transmitted securely.
  • Advantage: encryption ensures secure information transfer.
  • Host: remote server being accessed.
  • Client: computer used to access the host.
  • SSH uses three encryption technologies:
    • Symmetrical encryption
    • Asymmetrical encryption
    • Hashing

S/MIME (Secure/Multipurpose Internet Mail Extensions)

  • Technology to encrypt emails using asymmetric cryptography.

  • Protects emails from unauthorized access and ensures sender authenticity.

  • Based on asymmetric cryptography with public and private keys.

  • Emails are encrypted with the recipient’s public key and can only be decrypted with the recipient’s private key.

  • Asymmetric encryption works as follows:

    1. Chris wants to send an email to Joseph but does not want anyone else on the network to read or modify it.
    2. Chris uses Joseph’s public key to encrypt the message. Anyone can have access to this public key. Therefore, Chris or anyone can encrypt the message they want to send to Joseph.
    3. An intruder/attacker on the network cannot read this message, though, without the corresponding private key. The private key is accessible only to Joseph, so only he can decrypt and read the message.

  • Digital signatures:

    1. Associated with a private key and a public key.
    2. Authentication is done using the public key; the private key generates the signature.
    3. The public key is sent with every protected email to assert sender identity.
    4. The private key generates and applies a unique digital signature to each email, verifying that the message is unaltered.

Secure Real-Time Transport Protocol (SRTP)

  • Secure version of RTP for encryption, message authentication, integrity, and replay attack protection.
  • Uses Advanced Encryption Standard (AES) as the default cipher.
  • Published by IETF in RFC 3711 (March 2004).
  • Encrypts RTP payload but not the RTP header.
  • Supports source origin authentication and is widely used for RTP security.
  • Security features can be disabled.
  • Key management options: DTLS-SRTP, MIKEY in SIP, Security Description (SDES) in SDP, ZRTP, etc.
  • Two defined cipher modes:
    • Segmented Integer Counter Mode: Default encryption algorithm with 128-bit key and 112-bit salt key.
    • f8-mode: Variation of output feedback mode. Default values are the same as for AES in counter mode.
  • The NULL cipher disables encryption.
  • Adds Auth and MKI to the packet.
  • Master Key Identifier (MKI) is optional and indicates the master key ID.
  • SRTP is normally used to secure voice and video transmissions.
  • Voice and video calls are established via Session Initiation Protocol (SIP), and data is transmitted with RTP.
  • SRTP is based on RFCs 2104, 3711, 4771, and 3550.

Lightweight Directory Access Protocol over SSL (LDAPS)

  • LDAP reads and writes information to Active Directory; unsecured by default.
  • LDAPS uses SSL/TLS for confidential and secure traffic.
  • Enabled by installing a properly formatted certificate from a CA.
  • Uses TCP port 636.
  • No user interface for configuring LDAPS.
  • Requirements for the certificate:
    • Located in the local computer’s personal certificate store.
    • A private key is present and correctly associated with the certificate.
    • Enhanced Key Usage extension includes the Server Authentication OID (1.3.6.1.5.5.7.3.1).
    • The Active Directory FQDN of the domain controller must appear:
      • Common Name (CN) in the Subject field.
      • DNS entry in the Subject Alternative Name extension.
    • Issued by a trusted CA.
  • Schannel cryptographic service provider (CSP) can be used to generate the key.

File Transfer Protocol Secure (FTPS)

  • Also known as FTP over SSL, FTP/SSL, FTP-SSL, FTP-ES, and FTP Secure.
  • Uses a security layer below the standard FTP protocol to encrypt data.
  • Uses multiple port numbers for implicit and explicit connection types.
  • Authentication methods: passwords, client certificates, and server certificates.
  • Implicit FTPS:
    • Clients are immediately expected to challenge the FTPS server with a TLS Client Hello message.
    • Listens on well-known ports: 990/TCP (control channel) and 989/TCP (data channel).
    • Implicit negotiation was not defined in RFC 4217 (deprecated).
  • Explicit FTPS (FTPES):
    • Clients must explicitly request security from the FTPS server.
    • Negotiation added under RFC 2228 with the AUTH command.
    • Requires the FTPS client to challenge the FTPS server with a mutually known mechanism.
    • FTPS server responds with error code 504 if the security mechanism is unknown.
    • Clients can query supported mechanisms using the FEAT command.
    • Common methods: AUTH TLS and AUTH SSL.
  • Explicit method is defined in RFC 4217.

Secure File Transfer Protocol (SFTP)

  • Also known as Secure Shell (SSH) File Transfer Protocol.
  • Builds on the File Transfer Protocol (FTP) and includes Secure Shell (SSH) security components.
  • Designed by the Internet Engineering Task Force for greater web security.
  • Two ways to use the protocol:
    • Graphical user interface (GUI).
    • Command line (often used in Linux environments).
  • Situations where file security is important:
    • Complying with standards like HIPAA.
    • Meeting the requirements of GDPR.
    • Protecting trade secrets.

Simple Network Management Protocol Version 3 (SNMPv3)

  • Provides secure access to devices by authenticating and encrypting data packets over the network.
  • Defined in RFCs 3413 to 3415.
  • Security features:
    • Message integrity.
    • Authentication.
    • Encryption.
  • Security model: authentication strategy is set up for a user and group.
  • Security level: permitted level of security within a security model.
  • Configuration types:
    • No authentication and no privacy (noAuthNoPriv).
    • Authentication and no privacy (authNoPriv).
    • Authentication and privacy (authPriv).
  • Example configuration on Cisco devices: snmp-server group group-name v3 auth
  • Use SNMPWALK to verify configuration.
  • SNMP uses Management Information Bases (MIBs) to locate specific elements of reporting the status on a device.

Hypertext Transfer Protocol over SSL/TLS (HTTPS)

  • Secure version of HTTP for secure data transfer between a web browser and a website.
  • Uses encryption (Transport Layer Security (TLS)) to increase security of data transfer.
  • Essential for websites requiring login credentials.
  • Identified by a green padlock in the URL address bar.
  • Uses an asymmetric public key infrastructure:
    • Private key: controlled by the website owner and used to decrypt information encrypted by the public key.
    • Public key: available to everyone and used to encrypt information that can only be decrypted by the private key.
  • HTTPS uses port 443 for secure communications.
  • Regular HTTP uses port 80 and is unencrypted.

IPsec (Internet Protocol Security)

  • Defines the architecture for security services for IP network traffic.

  • Provides security at the IP layer through authentication and encryption of IP network packets.

  • Includes protocols for cryptographic algorithms, key exchange, and key management.

  • Originally defined two mechanisms for imposing security on IP packets:

    • Encapsulating Security Payload (ESP) protocol.
    • Authentication Header (AH) protocol.

  • Internet Key Exchange (IKE) protocol is used to manage the cryptographic keys.

  • IPsec uses two distinct protocols: AH and ESP.

  • The AH protocol provides a mechanism for authentication only, ah provides data integrity, data origin authentication, and an optional replay protection service:

    1. IP Authentication Header (AH), specified in RFC 4302, defines an optional packet header to be used to guarantee connectionless integrity and data origin authentication for IP packets, and to protect against replays.

  • IP Encapsulating Security Payload (ESP), specified in RFC 4303, defines an optional packet header that can be used to provide confidentiality through encryption of the packet, as well as integrity protection, data origin authentication, access control, and optional protection against replays or traffic analysis.

  • Can be used to protect network data by setting up circuits using IPsec tunneling (VPN connection).

  • Can also be used to provide authentication without encryption.

  • The two modes in which ESP and AH can operate:

    • Transport mode: encrypts the data packet and used between two workstations that are running a VPN client.
    • Tunnel mode: encrypts the whole packet including header info and source, and is used between networks.

Post Office Protocol/Internet Message Access Protocol

  • Internet Message Access Protocol (IMAP) allows you to access your email wherever you are, from any device.
    *IMAP downloads a message only when you click on it, and attachments aren’t automatically downloaded. Operates on port 143 nonencrypted and port 993 SSL/TLS
  • Post Office Protocol (POP) works by contacting your email service and downloading all of your new messages from it. After they are downloaded onto your PC, they are deleted from the email service.
    POP3 operates on TCP port 110 nonencrypted and port 995 SSL/TLS, known as POP3S.
  • There are many options when configuring your client for receiving and sending emails; however, only the secure methods are acceptable practice nowadays.

Use Cases

Protocols

Voice and Video
Setting up secure private VLANs; configure quality of service (QoS), anti-brute-force technology, and two-factor authentication (where available); and configure and deploy firewalls to secure these systems and networks.

  • SRTP is ideal for protecting Voice over IP (VoIP) traffic because it can be used in conjunction with header compression and has no effect on IP quality of service
    Time Synchronization
    Network Time Protocol (NTP) synchronizes the time of a computer client or server to another server or within a few milliseconds of Coordinated Universal Time (UTC). Enterprises looking to deploy time synchronization should utilize three public servers and set up a local internal NTP server that is used for all internal hosts as a reference timekeeper, and have only the internal NTP server make requests to the public servers. NTP servers use UDP port 123

Email and Web
Forward secrecy ensures that any future disclosure of encryption keys cannot be used to decrypt any TLS communications previously recorded. HTTPS uses SSL/TLS for secure web-based communications, X.509 digital certificates, and 256-bit encryption keys
Secure File Transfer Protocol
Designed by the Internet Engineering Task Force as an extension of the SSH version 2.0 protocol to provide secure file transfer capabilities
Directory Services
Lightweight Directory Access Protocol (LDAP) is a standard communications protocol used to read data from and write it to Active Directory. With LDAPS, you can improve security across the wire. LDAPS operates on port 636.
Remote Access
A VPN provides privacy and security to users by creating a private network connection across a public network connection. Multiple protocols can establish VPN connections, such as PPTP, L2TP, and IPsec
Domain Name Resolution
DNS on its own is considered an insecure protocol, and its successor, DNSSEC, is a more secure option. You should also protect DNS from cache pollution, enable DDNS for secure connections only, disable zone transfers, and use firewalls to control communication to and from the DNS servers. DNS and DNSSEC use TCP 53, and a lot of standard DNS traffic uses UDP 53.
Routing and Switching
Routing is a process in which a Layer 3 device chooses the best path between the source and destination network, You can manage switches and routers via the SNMPv3 previously discussed in this chapter. SNMP utilizes UDP ports 161 and 162.
Network Address Allocation
DHCP uses UDP port 67 as the destination port of a server and UDP port 68 by the client. Option 3 is the default router, or gateway of last resort. Option 6 is which DNS servers to include when assigning the IP address.
Subscription Services
Subscription services can be software as a service (SaaS), such as cloud email, Google Gmail, or Microsoft Office 365, as well as network defenses like firewalls, web application filtering, and patching.

Key Topics Review:

  • Domain Name System Security Extensions (DNSSEC)
  • SSH
  • Secure/Multipurpose Internet Mail Extensions (S/MIME)
  • Secure Real-Time Transport Protocol (SRTP)
  • Lightweight Directory Access Protocol over SSL (LDAPS)
  • File Transfer Protocol, Secure (FTPS)
  • SSH File Transfer Protocol (SFTP)
  • Simple Network Management Protocol Version 3 (SNMPv3)
  • Hypertext Transfer Protocol over SSL/TLS (HTTPS)
  • IPsec
  • Post Office Protocol (POP)/Internet Message Access Protocol (IMAP)
  • Use cases to implement security for voice and video, time synchronization, and other services

Key Terms Defined

  • DNS Security Extensions (DNSSEC)
  • Secure Shell (SSH)
  • Secure/Multipurpose Internet Mail Extensions (S/MIME)
  • Secure Real-Time Transport Protocol (SRTP)
  • Lightweight Directory Access Protocol Over SSL (LDAPS)
  • File Transfer Protocol, Secure (FTPS)
  • Secure File Transfer Protocol (SFTP)
  • Simple Network Management Protocol version 3 (SNMPv3)
  • Hypertext Transfer Protocol Secure (HTTPS)
  • IPsec
  • Authentication Header (AH)
  • Encapsulating Security Payload (ESP)
  • Tunnel mode
  • Transport mode
  • Internet Message Access Protocol (IMAP)
  • Post Office Protocol (POP)

Review Questions

  1. What is a secure protocol?
  2. How does SSH help secure connections?
  3. What cryptography method does S/MIME use?
  4. Secure Real-Time Transport Protocol uses which cipher by default?
  5. LDAPS is a secure version of LDAP that is used to communicate with Active Directory. What TCP port does LDAPS over SSL/TLS use?