CC-312 Information Security | Lecture Notes 1

CC-312

INFORMATION SECURITY
Comprehensive Lecture Notes
Based on Whitman & Mattord, Principles of Information Security (6th ed.)

BS Information Technology | Punjab University Affiliated Colleges

Course Title Information Security

Course Code CC-312
Credit Hours 3
Category Computing Core
Prerequisite None
Textbook M. Whitman & H. Mattord, Principles of Information Security, 6th ed.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 2

TABLE OF CONTENTS
TOC \h \o "1-2"

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 3

Unit 1: Introduction to Information Security

1.1 What is Information Security?
Information security refers to the set of measures and practices that protect data, information, and
systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Its purpose
is to keep confidential data secure so that it cannot be misused.
Information security uses techniques such as encryption, access controls, firewalls, antivirus software,
and secure network protocols to protect against both external and internal threats.

1.2 Why Information Security Matters

In today's digital world, data and information are used in every sector. Unauthorized access or misuse
can cause:
• Financial loss
• Reputation damage
• Legal and regulatory penalties
• Threats to personal privacy
Without information security, organizations and individuals cannot protect their confidential information
and may become victims of cyber attacks or data breaches.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 4

Unit 2: Information Security Foundations and Design

Principles
2.1 The CIA Triad
The three fundamental goals of information security are known as the CIA Triad:

Principle Definition Example

Confidentiali Ensuring information is only Encrypting medical records so only
ty accessible to authorized individuals. doctors can read them.
Integrity Ensuring data is accurate, complete, Using checksums to detect
and unchanged by unauthorized tampering in financial transaction
parties. records.
Availability Ensuring authorized users can Load balancing and failover systems
access information and resources keeping a web service online 24/7.
when needed.

2.2 Confidentiality
Definition
Confidentiality means that information is kept private and is only shared with those who have a
legitimate need to know. It prevents unauthorized access to sensitive data such as personal
information, financial records, intellectual property, and classified government documents.

Common Confidentiality Threats

1. Unauthorized Access – hacking, phishing, physical theft.
2. Insider Threats – employees or contractors misusing access.
3. Data Breaches – weak encryption or insecure networks.
4. Social Engineering – manipulating people into sharing information.
5. Physical Theft – theft of laptops, hard drives, or documents.

Types / Mechanisms for Enforcing Confidentiality

6. Encryption – converts data to unreadable ciphertext.
7. Access Controls – RBAC and permissions restrict who can read data.
8. Data Masking – hides sensitive parts (e.g., credit card digits).
9. Physical Security – locked cabinets, restricted access areas, CCTV.
10. Secure Communication Protocols – HTTPS, VPNs for transit security.
11. Data Loss Prevention (DLP) – monitors data flows and detects leaks.

Common Uses of Confidentiality

• Medical Records – patient history, diagnoses, treatments.
• Financial Data – bank accounts, credit card information.
• Legal Documents – attorney-client privilege, contracts.
• Government Secrets – classified documents, military strategies.
• Trade Secrets – proprietary product designs, manufacturing processes.
Punjab University Affiliated Colleges | BS Information Technology
CC-312 Information Security | Lecture Notes 5

2.3 Integrity
Integrity ensures that data remains protected from unauthorized changes, modifications, or corruption
and stays in its original, accurate state. Every modification to data should be tracked, and unauthorized
alterations should be prevented.

Common Integrity Threats

12. Unauthorized Modifications – data tampering or unauthorized updates.
13. Malware Attacks – ransomware or viruses modifying/corrupting data.
14. Data Corruption – hardware failures, software bugs, network issues.
15. Insider Threats – intentional or accidental data tampering by employees.
16. MITM Attacks – attacker intercepts and modifies data in transit.
17. Poor Change Management – improper procedures during system updates.

Mechanisms for Protecting Integrity

18. Checksums – recalculate and compare values to detect changes.
19. Hash Functions – generate unique fixed-size values; any change alters the hash.
20. Digital Signatures – private-key signing allows public-key verification of authenticity.
21. Error Detection and Correction Codes – detect and correct transmission errors.
22. Access Controls – only authorized users can modify data.

2.4 Availability
Availability ensures that authorized users can access information and resources whenever they need
them. Systems, networks, and data should be protected from downtime so that authorized users can
effectively complete their tasks.

Common Availability Threats

23. Denial of Service (DoS) Attacks – overwhelm target systems.
24. Distributed DoS (DDoS) – multiple compromised systems attack a target.
25. Hardware Failures – server, switch, or storage device failures.
26. Software Failures – bugs or flaws causing crashes.
27. Network Failures – router/switch/firewall connectivity issues.
28. Natural Disasters – earthquakes, floods damaging data centers.
29. Human Error – misconfigurations or accidental deletions.

Availability Mechanisms
30. Redundancy – RAID arrays, multiple network paths, geographically distributed data centers.
31. Load Balancing – distributes traffic across multiple servers.
32. Failover Systems – hot-standby systems activate automatically on failure.
33. Caching – reduces retrieval time and server load.
34. Scalability – vertical scaling (more resources per server) and horizontal scaling (more servers).

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 6
2.5 Additional Security Goals
Beyond the CIA triad, two more goals are important:

Authentication
Verifying the identity of a user, system, or device before granting access.
Methods: passwords, biometrics, tokens, digital certificates, MFA.

Authorization
Granting specific access rights to authenticated users based on their role and responsibilities.
Implementation: ACLs, RBAC, least-privilege principle.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 7

Unit 3: Security Mechanisms

3.1 Overview of Security Mechanisms
Security mechanisms are processes or measures designed to protect systems, networks, data, and
information from unauthorized access, attacks, or damage. They work together to enforce security
policies, detect threats, and respond to incidents.

Key Security Mechanisms

35. Encryption – converts plaintext into ciphertext.
36. Access Control – defines who can access which resources.
37. Firewalls – monitor and filter network traffic.
38. Intrusion Detection/Prevention Systems (IDS/IPS) – detect and respond to attacks.
39. Antivirus / Antimalware Software – detects and removes malicious software.
40. Security Auditing and Logging – records events for forensic analysis.
41. Authentication Protocols – verify user identities.
42. SSL/TLS – encrypts data in transit between clients and servers.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 8

Unit 4: Cryptography
4.1 Introduction to Cryptography
Cryptography is the branch of mathematics and computer science that uses mathematical techniques
to securely encode and decode data. Its primary goals are to keep sensitive information confidential,
maintain data integrity, and facilitate secure communication.
Cryptographic techniques transform data into a secure form that can only be accessed by authorized
parties through the use of algorithms and keys.

4.2 Types of Cryptography

Type Description Examples
Symmetric Single secret key used for both AES, DES, 3DES, Blowfish, RC4
encryption and decryption.
Asymmetric Public key for encryption; private RSA, ECC, Diffie-Hellman
key for decryption.
Hash Functions One-way function producing a SHA-256, MD5, SHA-3
fixed-size digest; irreversible.
Digital Asymmetric technique for RSA Signatures, ECDSA
Signatures authentication and integrity
assurance.

4.3 Symmetric Cryptography

Symmetric cryptography uses a single secret key shared by both the sender and receiver for encryption
and decryption. This makes it fast and efficient for encrypting large volumes of data.

How It Works
43. Encryption: Plaintext + Secret Key → Ciphertext (using the algorithm).
44. Transmission: Ciphertext is sent to the recipient.
45. Decryption: Ciphertext + Same Secret Key → Original Plaintext.

Key Algorithms
• AES (Advanced Encryption Standard): Block cipher; 128, 192, or 256-bit keys. Current gold
standard.
• DES (Data Encryption Standard): 56-bit key; now considered insecure.
• 3DES (Triple DES): Applies DES three times; 168-bit effective key. More secure than DES.
• Blowfish: Variable key length (32–448 bits); high speed and strong security.
• RC4: Stream cipher; used in early SSL/TLS; now deprecated due to vulnerabilities.

Advantages
• Fast – only one key used, computationally efficient.
• Efficient – handles large data volumes well.
• Scalable – works equally well for small and large datasets.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 9
Disadvantages
• Key Distribution Problem – securely sharing the key is challenging.
• Security Risk – if the key is compromised, all communications are exposed.
• Lack of Authentication – cannot verify the identity of the sender.
• Limited for PKI – challenges with key exchange over public networks.

4.4 Asymmetric Cryptography

Asymmetric cryptography (or public-key cryptography) uses two mathematically related keys: a public
key (shared openly) and a private key (kept secret by the owner). The public key encrypts data; only
the corresponding private key can decrypt it.

How It Works
46. Key Generation: A key pair (public + private) is generated.
47. Encryption: Sender encrypts the message with the recipient's public key.
48. Decryption: Recipient decrypts using their private key.
49. Digital Signatures: Sender signs with their private key; anyone verifies with the public key.

RSA Example
Bob selects prime numbers p = 11 and q = 13:
• n = p × q = 143 (public modulus)
• Phi(n) = (p-1)(q-1) = 120
• Public exponent e = 7 → Public Key: (143, 7)
• Private key d = 103 (calculated via extended Euclidean algorithm)
Alice encrypts message m = 17: c = 17^7 mod 143 = 88
Bob decrypts: m = 88^103 mod 143 = 17 (original message)

Advantages
• Eliminates the key distribution problem – public key can be shared freely.
• Enables digital signatures for authentication and non-repudiation.
• Secure over insecure channels such as the internet.

Disadvantages
• Computationally slower than symmetric cryptography.
• Complex key management infrastructure (PKI).
• Vulnerable to man-in-the-middle attacks without proper certificate validation.
• Inefficient for encrypting large amounts of data (use hybrid approach).

4.5 Encryption
Encryption is the process of converting plaintext into ciphertext using a mathematical algorithm and an
encryption key, so that only authorized parties with the corresponding decryption key can read it.

Objectives of Encryption
• Data Confidentiality – prevents unauthorized reading of sensitive data.
• Data Integrity – requires a specific key to decrypt, protecting against tampering.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 10
• Secure Communication – protects data in transit (emails, web traffic).
• Compliance – meets regulatory standards such as GDPR, HIPAA, PCI-DSS.

Types of Encryption
Symmetric Encryption: Both parties share a secret key. Fast and suitable for large data.
Asymmetric Encryption: Public key encrypts; private key decrypts. Ideal for secure key exchange.
Hashing: One-way conversion to a fixed-size digest. Irreversible; used for integrity checks and
password storage.

4.6 Hash Functions

Hash functions are cryptographic algorithms that convert input data of any size into a fixed-size output
called a hash value (or digest, fingerprint). They are deterministic — the same input always produces
the same hash.

Properties of Good Hash Functions

Property Meaning
Deterministic Same input always yields the same hash output.
Fixed-size Output Variable-length input produces a consistent fixed-length output.
Irreversibility (Pre- Cannot reverse-engineer the original input from the hash.
image Resistance)
Avalanche Effect A tiny change in input causes a drastically different hash.
Collision Resistance Extremely unlikely for two different inputs to produce the same
hash.

Uses of Hash Functions

• Data Integrity Verification – compare hash before and after transmission.
• Digital Signatures – hash the document, then sign the hash.
• Password Storage – store hash of passwords, not plaintext.
• Data Comparison – quickly check whether two files are identical.

4.7 Digital Signatures

Digital signatures are cryptographic techniques that authenticate and validate electronic documents and
transactions. They use asymmetric cryptography — the signer uses their private key to sign, and
anyone can verify using the public key.

How Digital Signatures Work

50. Document Creation – the document to be signed is prepared.
51. Hashing – a hash function generates a fixed-size digest of the document.
52. Signing – the author encrypts the hash with their private key, creating the digital signature.
53. Attachment – the signature is attached to the document.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 11
54. Verification – receiver decrypts the signature using the sender's public key to recover the hash,
then recomputes the hash from the received document. If both match, the document is authentic
and unaltered.

Advantages
• Authenticity – confirms the document's author and origin.
• Integrity – detects any unauthorized changes.
• Non-Repudiation – the signer cannot deny having signed the document.
• Efficiency – eliminates paper-based signatures.
• Regulatory Compliance – meets legal and industry signature requirements.

Disadvantages
• Dependence on Key Security – compromised private key invalidates signatures.
• Complexity – difficult to implement in large-scale environments.
• Technology Dependence – requires appropriate infrastructure and software.
• Cost – secure infrastructure and key management systems are expensive.

4.8 Key Management

Key management is the process of generating, distributing, storing, maintaining, and destroying
cryptographic keys. It is critical because the security of any cryptographic system depends entirely on
the security of its keys.

Key Management Lifecycle

55. Key Generation – keys must be random and unpredictable.
56. Key Distribution – keys must be distributed securely using encrypted channels.
57. Key Storage – use hardware security modules (HSMs) or strong encryption.
58. Key Rotation – periodically replace keys to limit exposure.
59. Key Revocation – immediately revoke keys that are compromised.
60. Key Destruction – securely destroy keys when no longer needed.
61. Key Escrow – store copies for emergency recovery situations.
62. Key Management Policies – documented organizational policies governing all of the above.

Why Key Management is Essential

• Data Confidentiality – insecure keys expose all encrypted data.
• Data Integrity – compromised keys can lead to unauthorized data modifications.
• Authentication – keys underpin authentication protocols.
• Non-Repudiation – secure keys ensure transaction authorship cannot be denied.
• Regulatory Compliance – many standards (PCI-DSS, HIPAA) mandate key management
practices.
• Risk Mitigation – reduces risk of data breaches and cyber attacks.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 12

Unit 5: Authentication and Access Control

5.1 Authentication
Authentication is the process of verifying the identity of a user, system, or device. It ensures that the
entity attempting to access a resource is who they claim to be.

Authentication Methods
Method Description
Knowledge-based User provides secret information: password, PIN, security answer.
Token-based User possesses a physical/virtual token generating a temporary
code (OTP).
Biometric Physical characteristics: fingerprint, facial recognition, iris scan,
voice.
Multi-Factor (MFA) Combines two or more factors (e.g., password + OTP) for stronger
assurance.
Certificate-based Digital certificates associated with cryptographic keys verify identity.
Single Sign-On (SSO) One authentication grants access to multiple systems without re-
entering credentials.
Risk-based Analyzes behavior and context (IP, location) to trigger additional
steps on anomalies.

The Authentication Process

63. Identity Assertion – user submits username, email, or certificate.
64. Credential Submission – user provides their password, token code, or biometric data.
65. Verification – system validates credentials; if correct, access is granted; otherwise denied.

5.2 Access Control

Access control is a critical component of information security that prevents unauthorized access and
manages authorized access to systems, data, and resources. It specifies which users have access to
which resources and what permissions they hold.

Key Components of Access Control

66. Authentication – verify user identity via login credentials.
67. Authorization – determine what resources the authenticated user can access.
68. Access Policies – define conditions and resources for access based on security requirements.
69. Access Control Lists (ACLs) – specify allowed and denied operations per user/group.
70. Role-Based Access Control (RBAC) – permissions are associated with roles, not individuals.
71. Audit Trails – logs record who accessed which resource at what time.

The Access Control Process

72. Identification – user submits username or identifier.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 13
73. Authentication – system verifies credentials.
74. Authorization – system determines permitted resources and operations.
75. Access Grant/Deny – access is granted or denied based on verification.
76. Logging – every access attempt is logged for audit purposes.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 14

Unit 6: Software Security, Vulnerabilities, and Malware

6.1 Software Security
Software security protects software applications and systems from malicious attacks, vulnerabilities,
and threats. It ensures that software applications perform their intended operations securely and
reliably without the risk of unauthorized access or data breaches.

Key Concepts of Software Security

77. Vulnerability Management – identifying, patching, and mitigating risks.
78. Secure Coding Practices – following standards that prevent buffer overflows, SQL injection, and
XSS.
79. Static and Dynamic Analysis – SAST scans code without execution; DAST tests running
applications.
80. Threat Modeling – identifying potential attack vectors and planning defenses.
81. Security Testing – penetration testing, fuzz testing, and code reviews.
82. Authentication and Authorization – MFA and strict role-based controls.
83. Encryption – encrypting data both in transit and at rest.
84. Security Patches and Updates – regularly applying patches against new vulnerabilities.
85. Logging and Monitoring – detecting suspicious activities proactively.

6.2 Vulnerabilities
Vulnerabilities are weaknesses or flaws in systems, applications, networks, or processes that attackers
can exploit to carry out unauthorized access, data breaches, and other malicious activities.

Types of Vulnerabilities
Software Vulnerabilities:
• Buffer Overflows – writing beyond a buffer's bounds causes arbitrary code execution.
• SQL Injection – malicious SQL queries manipulate databases.
• Cross-Site Scripting (XSS) – injecting scripts into web pages affecting users.
• Cross-Site Request Forgery (CSRF) – forcing authenticated users to perform unwanted actions.
• Command Injection – injecting arbitrary OS commands.
Network Vulnerabilities:
• Unsecured Wi-Fi Networks – lack of encryption allows data interception.
• Open Ports – unnecessary open ports offer unauthorized access opportunities.
• Weak Network Configurations – default passwords, missing segmentation.
Operating System Vulnerabilities:
• Privilege Escalation – exploiting flaws to gain higher access rights.
• Unpatched Software – known vulnerabilities in outdated OS versions.
• Kernel Flaws – bugs deep within the OS core.
Hardware Vulnerabilities:
• Firmware Exploits – targeting firmware of hardware devices.
• Side-Channel Attacks – using physical characteristics (e.g., Spectre, Meltdown).
Human Factor Vulnerabilities:
• Social Engineering – manipulating individuals to obtain confidential information.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 15
• Phishing – fraudulent emails tricking users into revealing sensitive data.
• Poor Password Practices – using weak or reused passwords.

Managing Vulnerabilities
• Regular Updates and Patching – keep all software up to date.
• Vulnerability Scanning – use Nessus, OpenVAS, or Qualys.
• Penetration Testing – simulate real attacks to find weaknesses.
• Code Reviews and Audits – identify flaws during development.
• Security Training and Awareness – educate employees about threats.
• Incident Response Plan – plan to quickly address discovered breaches.

6.3 Malware
Malware (malicious software) is created to infiltrate, damage, or disable computers, networks, and
systems without the user's consent. Its purposes range from disrupting operations and stealing data to
gaining unauthorized control over systems.

Types of Malware
Type How It Works Example
Virus Attaches to files; requires user action ILOVEYOU virus (2000)
to execute and spread.
Worm Self-replicates autonomously across Conficker worm
networks without user interaction.
Trojan Disguises itself as legitimate Zeus Trojan (banking theft)
software; creates backdoors.
Ransomwar Encrypts files and demands ransom WannaCry (2017)
e payment for decryption.
Spyware Secretly monitors user activity and Keyloggers
captures sensitive data.
Adware Displays unwanted advertisements; Gator software
often bundled with free software.

Malware Spread Mechanisms

• Phishing Emails – malicious attachments or links trigger download.
• Drive-by Downloads – malware auto-downloads when visiting compromised sites.
• Infected Software – legitimate-looking software bundled with malware.
• Network Exploits – vulnerabilities in network services exploited to spread.
• Removable Media – infected USB drives or external devices.

Protection Against Malware

• Regular Software Updates – patch known vulnerabilities promptly.
• Antivirus and Anti-malware Tools – detect and remove malicious code.
• Firewalls – control incoming and outgoing network traffic.
• User Education – train users to recognize phishing and suspicious content.
Punjab University Affiliated Colleges | BS Information Technology
CC-312 Information Security | Lecture Notes 16
• Backup and Recovery – regular backups to recover from ransomware attacks.
• Network Segmentation – limit spread by dividing the network into isolated segments.
• Intrusion Detection and Prevention Systems (IDPS) – detect malicious network activity.

6.4 Protections Against Software Threats

A layered approach to protection (defense-in-depth) is essential:
• Regular Updates and Patching – apply OS and application patches (e.g., Windows Update).
• Firewalls – Cisco ASA and similar products block unauthorized access.
• Antivirus / Anti-malware – Norton, McAfee, Kaspersky for malware detection.
• IDS/IPS – Snort (IDS) and Cisco Firepower (IPS) detect and prevent intrusions.
• Encryption – SSL/TLS for web traffic; AES for file encryption.
• Access Controls – RBAC ensures least-privilege access.
• Multi-Factor Authentication (MFA) – password + second factor (Google Authenticator).
• Security Awareness Training – regular training and phishing simulations.
• Backup and Recovery – cloud or local backups to restore after attack.
• Penetration Testing – Kali Linux tools simulate real-world attacks.
• Secure SDLC – integrate security into every software development phase.
• Incident Response Plan – documented procedures for rapid breach response.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 17

Unit 7: Data Security and Database Security

7.1 Data Security
Data security focuses on protecting data from unauthorized access, corruption, or theft throughout its
entire lifecycle. It ensures the confidentiality, integrity, and availability of data — whether at rest, in
transit, or in use.

Key Concepts in Data Security

86. Encryption – convert plaintext to ciphertext. Example: encrypting hard drive files or internet
transmissions.
87. Access Control – ensure only authorized users can access specific data.
88. Data Masking – hide sensitive parts of data. Example: showing only last four digits of a credit
card.
89. Data Backup and Recovery – regular copies and a disaster recovery plan.
90. Data Integrity – checksums and hash functions verify data remains unaltered.

Common Data Security Threats

• Malware – disrupts or damages data and systems.
• Phishing – tricks users into revealing credentials.
• Insider Threats – employees misusing data access.
• Ransomware – encrypts data and demands payment.
• SQL Injection – targets databases through malicious queries.

7.2 Database Security

Database security encompasses all techniques and processes used to protect databases from
unauthorized access and malicious activities, including implementing security protocols, access control
mechanisms, and regular monitoring.

Key Components of Database Security

91. Access Controls – user authentication (passwords, biometrics), authorization (roles,
permissions, ACLs).
92. Encryption – data at rest and data in transit encryption.
93. Database Auditing – audit trails, access logs, and regular activity reviews.
94. Backup and Recovery – regular backup schedules, offsite storage, disaster recovery plans.
95. Database Activity Monitoring (DAM) – real-time monitoring and anomaly detection.
96. Patch Management – applying security patches and updates to the DBMS.

Common Database Security Threats

Threat Description Prevention
SQL Injection Malicious SQL queries manipulate the Input validation,
database. parameterized queries.
Privilege Gaining higher access rights than Strict RBAC and least-
Escalation intended. privilege principle.
Data Leakage Unauthorized access and exfiltration Encryption, access controls,

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 18

of sensitive data. auditing.

Malware Infiltrating databases to corrupt, steal, Antivirus, scanning, secure
or ransom data. configurations.
Insider Threats Employees or contractors misusing Behavior monitoring, access
database access. controls, training.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 19

Unit 8: Network Security, Firewalls, and Intrusion

Detection
8.1 Network Security
Network security comprises all policies, practices, and technologies used to protect network
infrastructure from unauthorized access, misuse, modification, and harm. Its goal is to ensure the
confidentiality, integrity, and availability of data and resources within the network.

Key Concepts in Network Security

Mechanism Description
Firewalls Hardware or software that monitors and controls traffic based on
security rules.
IDPS Tools that monitor network traffic to detect and prevent suspicious
activities.
VPNs Secure tunnels for private communication over public networks.
Encryption Encoding data to prevent unauthorized access during transmission.
Access Control Restricts network resource access to authorized users only.
SIEM Collects, analyzes, and reports security data for real-time alert
analysis.

Common Network Security Threats

• Malware – viruses, worms, and trojans disrupting or damaging networked systems.
• Phishing – social engineering to steal credentials via fraudulent communications.
• Denial of Service (DoS) / DDoS – overwhelming resources to disrupt availability.
• Man-in-the-Middle (MitM) – intercepting and altering communications between parties.
• SQL Injection – targeting web applications connected to databases.

8.2 Firewalls
A firewall is a network security device or software program that filters incoming and outgoing network
traffic based on predefined security rules. Its purpose is to block unauthorized access while allowing
legitimate communications.

Types of Firewalls
Type Description
Packet-Filtering Inspects packet headers (IP addresses, ports) against predefined
rules. Basic, fast, stateless.
Stateful Inspection Tracks connection state (TCP handshakes) for more intelligent
filtering.
Proxy Firewalls Intermediary between client and server; inspects full

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 20

request/response.
Next-Generation Deep packet inspection (DPI), application awareness, and
(NGFW) integrated threat intelligence.
UTM Firewalls Unified Threat Management: firewall + antivirus + IPS in a single
device.

How Firewalls Work

97. Rule-Based Filtering – predefined security rules determine whether to allow or block traffic.
98. Packet Inspection – check source/destination IP addresses, ports, and protocols.
99. Stateful Inspection – track connection states; allow only established-connection packets.
100. Proxy Functionality – intercept, inspect, and forward requests.
101. Deep Packet Inspection (DPI) – analyze full packet content, not just headers.

Advantages of Firewalls
• Enhanced Security – first line of defense against external threats.
• Traffic Monitoring – continuous monitoring and logging of network activity.
• Access Control – define and enforce rules about who can access what.
• Data Protection – protect sensitive information from unauthorized access.

Disadvantages of Firewalls
• Performance Impact – heavy packet inspection can slow network performance.
• Configuration Complexity – misconfiguration creates security gaps.
• Limited Protection – cannot detect internal threats or insider attacks.
• Maintenance – regular updates are required to remain effective.

8.3 Intrusion Detection Systems (IDS)

An Intrusion Detection System (IDS) monitors network traffic and system activities for suspicious
behavior and known attack patterns, generating alerts when threats are detected. An Intrusion
Prevention System (IPS) goes further by actively blocking detected threats.

IDS vs. IPS

Feature IDS IPS
Function Monitors and alerts on suspicious Monitors, alerts, AND blocks threats.
activity.
Response Passive – generates alerts only. Active – blocks malicious traffic.
Placement Out-of-band (monitoring copy of Inline (sits in traffic path).
traffic).
Example Snort (IDS mode) Cisco Firepower, Snort (IPS mode)

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 21

Quick Reference: Key Terms and Acronyms

Term / Meaning
Acronym
CIA Confidentiality, Integrity, Availability – the three core principles of
information security.
AES Advanced Encryption Standard – symmetric block cipher with
128/192/256-bit keys.
DES Data Encryption Standard – legacy 56-bit symmetric cipher, now insecure.
RSA Rivest-Shamir-Adleman – asymmetric encryption algorithm used for secure
key exchange.
SHA Secure Hash Algorithm – family of hash functions (SHA-256 widely used
today).
PKI Public Key Infrastructure – framework for managing digital certificates and
keys.
RBAC Role-Based Access Control – access permissions based on user roles.
ACL Access Control List – list specifying access rights for each user/system.
MFA Multi-Factor Authentication – two or more factors required for identity
verification.
SSL/TLS Secure Sockets Layer / Transport Layer Security – encrypts data in transit.
HTTPS HyperText Transfer Protocol Secure – HTTP over TLS/SSL.
VPN Virtual Private Network – encrypted tunnel over a public network.
IDS Intrusion Detection System – monitors and alerts on suspicious activity.
IPS Intrusion Prevention System – monitors and actively blocks threats.
SIEM Security Information and Event Management – centralizes log analysis and
alerting.
DLP Data Loss Prevention – prevents unauthorized data exfiltration.
XSS Cross-Site Scripting – injecting malicious scripts into web pages.
CSRF Cross-Site Request Forgery – tricks authenticated users into unwanted
actions.
DoS / DDoS Denial of Service / Distributed DoS – overwhelm systems to deny access.
MitM Man-in-the-Middle – attacker intercepts and can alter communications.
NGFW Next-Generation Firewall – advanced firewall with DPI and application
awareness.
SDLC Software Development Lifecycle – phases for building and maintaining
software.
DAM Database Activity Monitoring – real-time database traffic monitoring.

Punjab University Affiliated Colleges | BS Information Technology

CC-312 Information Security | Lecture Notes 22

HSM Hardware Security Module – physical device for secure key storage.

Punjab University Affiliated Colleges | BS Information Technology