CHAPTER 5

CYBER (WEB) SECURITY

Quick-Revision Exam Notes

5.1 Approaches to Web Security

What is Web Security?

■ Web security = protecting data, systems & users from attacks over the internet/web.
■ Threats exist at every layer: network, transport, application.

Three Main Placement Approaches

Approach / Level Example Protocols / Mechanism
Network / Transport Layer IPSec, SSL/TLS — transparent to apps
Application Layer PGP, S/MIME — app-specific security
Perimeter / Firewall Filter unwanted traffic at network edge

Key Security Goals (CIA + More)

Goal Meaning
Confidentiality Data readable only by intended parties (encryption)
Integrity Data not altered in transit (hashing, MAC)
Authentication Verify identity of sender/receiver
Non-repudiation Sender cannot deny sending (digital signatures)
Availability Services accessible when needed (anti-DoS)
Access Control Only authorized users can access resources

Web security is implemented at DIFFERENT layers (Network, Transport, Application).

KEY POINT
Know which protocol belongs to which layer — a common exam question!

5.2 SSL / TLS Architecture

Overview
■ SSL = Secure Sockets Layer (original, by Netscape).
■ TLS = Transport Layer Security (successor to SSL; TLS 1.3 is current standard).
■ Operates between TCP and the Application Layer (e.g., HTTPS = HTTP over TLS).
■ Provides: Confidentiality, Integrity, Authentication.
SSL/TLS Protocol Stack (Two Sub-Protocols)
Sub-Protocol Purpose
Handshake Protocol Negotiates cipher suite, authenticates server (&
optionally client), establishes session keys
Record Protocol Fragments, compresses, encrypts & transmits actual
data using keys from handshake

SSL/TLS Handshake — Step by Step

■ Step 1 — ClientHello: Client → Server: supported TLS version, cipher suites, random number.
■ Step 2 — ServerHello: Server → Client: chosen cipher suite, server certificate, server random.
■ Step 3 — Authentication: Client verifies server's certificate (via CA chain).
■ Step 4 — Key Exchange: Client generates Pre-Master Secret, encrypts with server's public key, sends it.
■ Step 5 — Session Keys: Both sides derive same symmetric session keys from Pre-Master Secret +
randoms.
■ Step 6 — Finished: Both sides confirm handshake is complete; encrypted communication begins.

SSL Record Protocol — Steps

■ Fragment → (optionally) Compress → Add MAC → Encrypt → Append SSL header → Transmit.

Key Concepts
Term Explanation Note
Cipher Suite Combo of key exchange + auth + encryption + e.g.,
MAC algorithms TLS_RSA_WITH_AES_12
8_CBC_SHA
Certificate Digital cert signed by CA, proves server X.509 format
identity
Session vs Connection Session = long-term params; Connection = Multiple connections per
one transport link session
Master Secret 48-byte secret derived from Pre-Master Secret Used to derive all session
+ randoms keys

TLS is at Transport Layer, NOT application layer. SSL v3 is deprecated — TLS

EXAM TIP
replaced it. TLS 1.3 removes weak cipher suites and speeds up handshake to 1-RTT.

Version Status
SSL 3.0 Deprecated (POODLE attack)
TLS 1.0 / 1.1 Deprecated (weak)
TLS 1.2 Still widely used; secure with proper config
TLS 1.3 Current standard; faster (1-RTT), removed weak
algorithms

5.3 IPSec (IP Security)

What is IPSec?
■ IPSec = suite of protocols for securing IP communications at the Network Layer.
■ Provides: Authentication, Integrity, Confidentiality, Replay protection.
■ Transparent to applications — works below TCP/UDP.
■ Mandatory in IPv6; optional but widely used in IPv4.

Two Core IPSec Protocols

Protocol What it provides
AH (Authentication Header) Provides authentication + integrity + anti-replay. NO
encryption. Protects entire IP packet including
header.
ESP (Encapsulating Security Payload) Provides authentication + integrity + anti-replay +
ENCRYPTION. Most commonly used.

Security Association (SA)

■ SA = one-way logical connection defining security parameters between two parties.
■ Identified by: SPI (Security Parameter Index) + Destination IP + Protocol (AH/ESP).
■ Full two-way comms needs TWO SAs (one per direction).
■ Managed by IKE (Internet Key Exchange) protocol.

IPSec Databases
Database Purpose
SAD (Security Association Database) Stores active SA parameters: algorithms, keys,
sequence numbers
SPD (Security Policy Database) Rules that say WHAT to do with each packet:
Discard / Bypass / Protect

5.3.1 IPSec — Transport Mode

■ Protects only the PAYLOAD (data) of the IP packet.

■ Original IP header is LEFT UNCHANGED (exposed).
■ Used for end-to-end communication between two hosts.
■ Smaller overhead — more efficient than Tunnel mode.

Packet structure (ESP Transport Mode): Original IP Hdr | ESP Hdr | TCP Hdr +
Data | ESP Trailer | ESP Auth

■ Use case: Secure communication between two end-hosts (e.g., client-to-server within a LAN).

5.3.2 IPSec — Tunnel Mode

■ Protects the ENTIRE original IP packet (header + payload).

■ Entire original packet is ENCAPSULATED inside a new IP packet.
■ Used for VPNs — gateway-to-gateway or host-to-gateway communication.
 ■ Higher overhead but hides original IP addresses.

Packet structure (ESP Tunnel Mode): New IP Hdr | ESP Hdr | [Original IP Hdr |
TCP Hdr + Data] | ESP Trailer | ESP Auth

■ Use case: Corporate VPN — routers/firewalls act as gateways, users' internal IPs are hidden.

Transport Mode vs Tunnel Mode — Quick Comparison

Feature Details
Scope of protection — Transport: Payload only Tunnel: Entire original IP packet
IP header — Transport: Original header kept Tunnel: Original header hidden; new outer header
added
Typical use — Transport: Host-to-host (end-to- Tunnel: Gateway-to-gateway (VPN)
end)
Overhead — Transport: Lower Tunnel: Higher
Hides IP addresses? — Transport: No Tunnel: Yes (inner addresses hidden)

Transport Mode = end-to-end (hosts). Tunnel Mode = network-to-network

EXAM TIP (gateways/VPN). ESP provides encryption; AH does NOT. Tunnel mode is most
common in real-world VPNs.

5.4 Email Security

Why Email Security?

■ Email travels through multiple servers — vulnerable to eavesdropping, tampering, spoofing.
■ Key threats: Interception, Forgery, Replay, Denial, Spam/Phishing.
■ Two major standards: PGP (Pretty Good Privacy) and S/MIME.

5.4.1 PGP — Pretty Good Privacy

Overview
■ PGP: Created by Phil Zimmermann (1991). Widely used for personal email encryption.
■ Uses a Web of Trust (WoT) model — no central CA; users vouch for each other's keys.
■ Provides: Confidentiality, Authentication, Integrity, Non-repudiation.

PGP Services (5 Key Functions)

Service How it works
Authentication Sender signs with own private key → recipient
verifies with sender's public key
Confidentiality Message encrypted with one-time session key
(symmetric); session key encrypted with recipient's
public key
Compression Compresses message before encryption (using ZIP)
— saves space, increases security
Email Compatibility Converts binary to ASCII using Radix-64 (Base64)
encoding for email transport
Segmentation Breaks large messages into segments for email size
limits

PGP — Sending a Message (Process)

■ 1. Hash the message → sign hash with sender's PRIVATE key → digital signature.
■ 2. Compress: message + signature.
■ 3. Generate random one-time SESSION KEY (symmetric, e.g., AES).
■ 4. Encrypt compressed data with session key.
■ 5. Encrypt session key with RECIPIENT's PUBLIC key.
■ 6. Combine encrypted session key + encrypted message.
■ 7. Encode in Radix-64 (Base64) for email transport.

PGP — Receiving a Message (Process)

■ 1. Decode Radix-64.
■ 2. Decrypt session key using recipient's PRIVATE key.
■ 3. Decrypt message using session key.
■ 4. Decompress message + signature.
■ 5. Verify signature using sender's PUBLIC key.

PGP Key Management

■ Public-key ring: stores your own and others' public keys.
■ Private-key ring: stores your own private keys (protected by passphrase).
■ Key trust levels: Unknown → Untrusted → Marginal → Full → Ultimate.
■ Web of Trust: If enough trusted users sign a key, it's considered valid — no CA needed.

PGP Algorithms Used

Purpose Algorithm Service
Digital Signature DSS/SHA or RSA/SHA-1 Authentication
Message Encryption CAST-128, IDEA, 3DES Confidentiality
(symmetric)
Session Key Encryption RSA or Diffie-Hellman Key transport
(asymmetric)
Hashing SHA-1, MD5 Integrity
Compression ZIP Compression

PGP uses HYBRID encryption: symmetric key encrypts message (fast), asymmetric
EXAM TIP key encrypts the symmetric key (secure). Know ALL 5 PGP services and the order of
operations for sending/receiving.
5.4.2 S/MIME — Secure/Multipurpose Internet Mail Extensions

Overview
■ S/MIME: Standard for securing MIME-formatted email (RFC 3850, 3851).
■ Uses Hierarchical PKI (Public Key Infrastructure) with Certificate Authorities (CAs).
■ Provides: Authentication, Integrity, Confidentiality, Non-repudiation.
■ Built into most commercial email clients (Outlook, Apple Mail, etc.).

S/MIME Content Types

Content Type Purpose
EnvelopedData Encrypted content + encrypted key (confidentiality)
SignedData Content + digital signature (integrity +
authentication)
CleartextSigned Unencrypted content with detached signature (can
be read without S/MIME support)
CompressedData Compressed MIME data (optional)
AuthenticatedData Authenticated using MAC (message authentication
code)

S/MIME — Sending a Signed & Encrypted Message

■ 1. Hash message with SHA/MD5.
■ 2. Sign hash with sender's PRIVATE key → attach as signature.
■ 3. Generate random symmetric session key (e.g., AES/3DES).
■ 4. Encrypt message with session key.
■ 5. Encrypt session key with recipient's PUBLIC key.
■ 6. Package as S/MIME message (MIME format).

S/MIME vs PGP — Key Differences

Feature → S/MIME PGP
Key Mgmt Model Hierarchical PKI (CA-based)
Certificate Format X.509 certificates
Trust Model CA vouches for keys
Usage Enterprise / corporate email
Standardization IETF standard (RFC)
Integration Built into email clients
Algorithms RSA, AES, SHA-256, 3DES

S/MIME = CA-based trust (like HTTPS). PGP = Web of Trust (users certify each
EXAM TIP other). Both use hybrid encryption. S/MIME uses X.509 certs; PGP uses its own
format.
MASTER COMPARISON TABLE

Protocol OSI Layer Use Case

SSL/TLS Transport Layer HTTPS, secure web browsing —
client-server
IPSec (Transport) Network Layer Host-to-host secure
communication
IPSec (Tunnel) Network Layer VPN, gateway-to-gateway
PGP Application Layer Personal email encryption, Web
of Trust
S/MIME Application Layer Enterprise email encryption, CA-
based

QUICK FIRE — MOST LIKELY EXAM QUESTIONS

■ Q1: What are the two modes of IPSec? → Transport (payload only) and Tunnel (full packet, VPN).
■ Q2: What does AH provide that ESP does NOT? → AH protects IP header integrity; both give auth — but
only ESP gives encryption.
■ Q3: Two sub-protocols of SSL? → Handshake Protocol and Record Protocol.
■ Q4: 5 PGP services? → Authentication, Confidentiality, Compression, Email compatibility (Radix-64),
Segmentation.
■ Q5: PGP uses what encryption model? → Hybrid: symmetric for message, asymmetric for session key.
■ Q6: S/MIME vs PGP trust model? → S/MIME = CA hierarchy (X.509). PGP = Web of Trust.
■ Q7: Which IPSec mode is used for VPNs? → Tunnel Mode.
■ Q8: What layer does IPSec operate at? → Network Layer (Layer 3).
■ Q9: What is an SA in IPSec? → Security Association — one-way agreement on security parameters (SPI +
dest IP + protocol).
■ Q10: TLS handshake purpose? → Negotiate cipher suite, authenticate server, establish shared session
keys.

Good Luck in Your Exam! — Chapter 5 Complete