Quick Revision - Lecture 7b

W7b – Network Security 2

Key terms to learn first

1. Network encryption

Encryption protects information while it travels across a network.

Two important types:

Link encryption

• Data is encrypted before travelling across a physical network link.

• It is decrypted when it reaches the next system.

• If there are intermediate nodes, they decrypt and re-encrypt the information.

• Useful when the transmission line is vulnerable, such as wireless communication.

End-to-end encryption

• Protects data between the original sender and final receiver.

• Intermediate systems cannot decrypt the information.

• Useful when sending sensitive information through untrusted networks, such as the Internet.

Difference to remember:

2. SSH – Secure Shell

• Originally developed for UNIX.

• Now available on most operating systems.

• Provides secure remote access to a computer's command line.

• Uses authentication and encryption.

• Replaces insecure tools such as Telnet, rlogin and rsh.

Purpose: Securely connect to and control another computer over a network.

3. SSL and TLS

SSL (Secure Sockets Layer):

- Designed in the 1990s to protect communication between web browsers and servers.

TLS (Transport Layer Security):

• Introduced as an upgrade to SSL in 1999.

• Modern and more secure replacement for SSL.

What SSL/TLS provides

• Server authentication: Confirms the identity of the server.

• Client authentication: Can verify the client when required.

• Encryption: Protects communication.

• Integrity: Helps ensure data has not been modified.

SSL/TLS cipher suites

At the start of a secure session, the client and server negotiate which cryptographic algorithms to use.

A cipher suite contains:

1. Digital signature algorithm: Used for authentication.

2. Encryption algorithm: Provides confidentiality.

3. Hash algorithm: Helps provide integrity.

Digital certificates

Certificates help verify the identity of a website.

They contain information such as:

• Domain name.

• Organisation that owns the website.

• Certificate Authority (CA) that issued the certificate.

• Validity dates.

• Digital signature information.

CA (Certificate Authority): A trusted organisation that issues digital certificates.

Certificate chain: A sequence of certificates linking a website's certificate to a trusted root certificate.

4. Onion routing

• Protects the identity and communication of users.

• Uses multiple layers of encryption.

• Sends data through several intermediate hosts.

• Makes it difficult for observers to identify the original sender, destination or message content.

Remember: Onion routing = multiple encrypted layers through different network nodes.

5. VPN – Virtual Private Network

VPN = an encrypted tunnel over a public network.

• Provides confidentiality and integrity.

• Connects separate networks over the Internet.

• Allows remote users to connect securely to an organisation's network.

• Firewalls often manage VPN connections.

Site-to-site VPN

• Connects two separate office networks.

• Makes them appear like one private network.

• Both locations communicate securely through an encrypted tunnel.

Remote-access VPN

• Allows an employee to connect to their workplace remotely.

• The employee authenticates with the VPN server.

• Access is controlled before reaching internal resources.

Difference: Site-to-site connects networks; remote-access connects an individual user to a network.

6. Firewalls

Firewall: A device or system that filters network traffic between a trusted internal network and a less trusted external network.

Main purposes

• Blocks unauthorised traffic.

• Allows permitted traffic.

• Enforces network security policies.

• Controls communication between networks.

Reference monitor principles

A firewall should have three characteristics:

1. Always invoked: All relevant traffic must pass through it.

2. Tamperproof: Attackers should not be able to modify it.

3. Small and simple: Easy to inspect and analyse for security weaknesses.

Firewall security policies

Firewalls use rules to determine which traffic is allowed or blocked.

Rules may include:

• Source IP address.

• Destination IP address.

• Port number.

• Protocol.

• Direction of traffic.

7. Types of firewalls

These are important to distinguish for exams.

A. Packet-filtering gateway

• Checks individual network packets.

• Filters using IP addresses, ports and protocols.

• Can allow or block traffic based on rules.

• Does not remember previous packets.

Example: Allow HTTP traffic but block Telnet traffic.

B. Stateful inspection firewall

• Monitors network traffic and remembers connection information.

• Uses the context of previous packets to make decisions.

• Can detect unusual connection behaviour.

Difference: Packet filtering examines packets individually; stateful inspection remembers connection state.

C. Application-level gateway (Proxy)

• Operates at the application layer (OSI Layer 7).

• Examines application requests.

• Can filter dangerous commands.

• Records user activity.

• Can cache information to save bandwidth.

Example: A company web proxy monitors and filters employees' Internet usage.

D. Circuit-level gateway

• Operates at OSI Layer 5 (Session Layer), according to the lecture.

• Creates a virtual connection between networks.

• Can be used to implement a VPN.

E. Guard

• A sophisticated firewall that understands application protocols.

• Can enforce more advanced security rules.

Examples:

• Restricting the number of emails received.

• Limiting web bandwidth.

• Blocking documents containing confidential words.

• Scanning downloaded files for viruses.

F. Personal / Host-based firewall

• Installed directly on a computer or server.

• Controls incoming and outgoing traffic.

• Can restrict which applications are allowed to access the network.

Example: Windows Defender Firewall.

Quick firewall comparison

8. DMZ – Demilitarised Zone

• A separate network area for servers that need to be accessible from the Internet.

• Sits between an external network and the protected internal network.

• Uses firewalls to restrict communication.

Example

A DMZ may contain:

• Web servers.

• Email servers.

• FTP servers.

The internal network may contain databases and sensitive information.

Why is a DMZ important?

If an Internet-facing server gets compromised, the attacker should have limited access to the internal network.

Remember: DMZ = separates public-facing services from the private internal network.

9. What firewalls can and cannot do

What they can do

• Filter network traffic.

• Enforce access policies.

• Protect network boundaries.

• Block unauthorised connections.

What they cannot do

• Protect information outside their security perimeter.

• Guarantee protection against every attack.

• Automatically prevent malicious code from entering.

• Protect a network if incorrectly configured.

Important: Firewalls must be regularly updated and their activity logs reviewed.

10. NAT – Network Address Translation

• NAT changes the source or destination IP information in network packets.

• Commonly allows internal devices to communicate using a firewall's public IP address.

• Hides the internal device's actual IP address from external systems.

How NAT works

1. An internal computer sends a packet to an external destination.

2. The firewall replaces the internal source IP with its own address.

3. It records the original address and port in a translation table.

4. The external destination sends a reply.

5. The firewall checks its translation table.

6. The reply is forwarded to the original internal device.

Remember: NAT translates IP addresses and helps conceal internal network addresses.

11. DLP – Data Loss Prevention

• Technologies that detect and possibly prevent sensitive data from being sent somewhere unauthorised.

• Helps prevent accidental information leaks.

DLP looks for:

• Keywords: Sensitive words or information.

• Traffic patterns: Unusual data transfers.

• Encoding/encryption: How information is represented or protected.

Example: Preventing an employee from accidentally emailing a confidential document outside the organisation.

Important: DLP is particularly useful for preventing accidental data loss. Malicious users may find ways around it.

12. IDS – Intrusion Detection System

IDS = monitors systems and networks to identify suspicious activity.

An IDS can:

• Monitor user and system activity.

• Identify known attack patterns.

• Detect unusual behaviour.

• Check system configurations for vulnerabilities.

• Monitor important files for unauthorised changes.

• Record suspicious activity.

• Highlight security policy violations.

Types of IDS

A. Signature-based IDS

• Looks for known attack patterns.

• Detects threats that match existing signatures.

• Cannot reliably identify completely new attack patterns.

B. Heuristic-based IDS

• Looks for unusual behaviour.

• Uses patterns and analysis to identify suspicious activity.

• Can identify behaviour that does not match normal activity.

C. Host-based IDS (HIDS)

• Monitors an individual computer or server.

• Examines activity on that specific host.

D. Network-based IDS (NIDS)

• Monitors network traffic.

• Usually operates through a network appliance or server.

E. Front-end IDS

- Monitors traffic entering a network.

F. Internal IDS

- Monitors traffic within the network.

Passive IDS vs Active IDS

IPS = Intrusion Prevention System.

Remember: IDS detects; IPS detects and attempts to prevent.

13. SIEM – Security Information and Event Management

• Collects security-related information from different systems.

• Combines logs into one central location.

• Helps security analysts investigate threats.

• Creates alerts, dashboards and reports.

• Identifies relationships between events from different devices.

Sources of SIEM data

• Operating systems.

• Applications.

• Firewalls.

• IDS systems.

• Cloud services.

• Databases.

• Web servers.

• Email servers.

• Routers and switches.

• Proxy servers.

SOC (Security Operations Centre):

- A team or department responsible for monitoring and managing an organisation's security.

Why is SIEM useful?

Without SIEM, analysts would need to check every device separately.

SIEM makes it easier to:

• Collect logs centrally.

• Search for suspicious events.

• Correlate events from different systems.

• Generate security alerts.

• Investigate incidents.

Remember: SIEM = centralised security monitoring and log analysis.