Mewar Institute of Management Network Security

Mewar Institute of Management

BCA-601 : NETWORK
SECURITY
(By : Kamal Tiwari)

#Follows Study Material

Faculty- Kamal Tiwari Page 1

 Mewar Institute of Management Network Security

COMPUTER SECURITY UNIT-1

Computer security means protecting computers, laptops, mobile devices,

networks, software & digital data from unauthorized access, theft, damage
& cyber-attacks. It is also known as Cyber Security or Information
Security.
In today’s world, many people use computers for banking, shopping,
education & office work. So, keeping systems secure is very important.
Computer security means applying various technological & managerial
techniques to protect our data, Systems & network from unauthorised users
& attacks.

Threats & Attacks

A threat s any possible danger that can harm a computer system, network
or data. It is a potential risk that may cause damage, steal information or
stop services. A threat does nt always happen, but it has the possibility to
happen. Threats can come from hackers, malware, natural disasters,
hardware failure or human mistakes.
Examples of Threats:
 Virus Infection
 Hacker trying to steal password
 Power failure causing data loss
 Employee deleting important files by mistake.

An attack is the actual action taken t exploit a threat. It happens when

someone or something tries to damage, access, steal or misuse the system.
In simple words, a threat is the possibility of danger, while an attack is a
real attempt.
Examples of Attack:
 Hacking into an email account
 Installing ransomware on a computer
 Sending phishing emails to steal passwords
 Malware deleting files.

Faculty- Kamal Tiwari Page 2

 Mewar Institute of Management Network Security

Attacks are of 2 types:

a. Active Attacks b. Passive Attacks

Active Attacks
An active attack is an attack in which the attacker changes, damages,
destroys or interrupts data or system operations. In this type of attacks, the
attacker directly affects the system.
Relay, Denial of Service, Masquerade & modifications are the active attacks.
Examples
 Modifying data in a file
 Deleting important records
 Spreading viruses

Characteristics:
 These are easy to detect sometimes
 Causes direct damage
 Affects system performance

Passive Attacks
It is an attack in which the attacker only monitors, listens or copies
information without changing data. They analyse or study this data & plan a
future attack. The main goa is to steal information [Link] analysis is
also a passive attack.
Examples:
 Reading confidential mails
 Listening network traffic

Characteristics:
 These are hard to detect
 They do not cause direct damage to system.
 They steal private information secretly.

Faculty- Kamal Tiwari Page 3

 Mewar Institute of Management Network Security

SECURITY SERVICES/Factors for a Secure Network

In order to overcome the above mentioned vulnerabilities of a system or
data or network etc. there are 5 major security service- confidentiality,
Interrity, Availability, Non-Repudiation and Authentication, which are
follows-

1. Confidentiality- Confidentiality means keeping information secret from

unauthorized access and is probably the most common aspect of
information security. It is important to protect to confidential information.
An organization needs to guard against those malicious action that
endanger the confidentially of its information.

2. Integrity- Integrity means that changes should be done only by

authorized users and through authorized mechanisms.

3. Availability- The third component of information security service is

availability. The information created and stored by an organization needs
to be available to authorized users and applications, Information is
useless if it is not available 0 authorized users. Information need to be
hanged constantly, which means that it must be accessible to those
authorized to access it.

4. Authentication- Authentication is the process by which a person or other

entity proves that it is who (or what) it says it is.

5. Non-Repudiation –Non-repudiation is the prevention of either the sender

or the receiver denying a transmitted message. A system must be able to
prove that certain message were sent and received. Non- repudiation is
after implemented by using digital signatures.

6. Access control- Access control means control of access through

identification and authentication. A system need to be able to identify
and authenticate users for access to data applications and hardware. In a
large system there may be a complex structure determining which users
and application have access to which objects. This is done through Access
control List (ACL).

Faculty- Kamal Tiwari Page 4

 Mewar Institute of Management Network Security

CRYPTOGRAPHY: Encryption & Decryption

It is the technique of protecting information by converting it into a secure form so
that only the authorised people can understand it. It is mainly used to keep data
safe from the hackers, unauthorised users & cyber-attacks.

The word cryptography comes from two greek words: crypto means hidden &
graphy means writing. So, cryptography means hidden writeing. It helps in
maintaining confidentiality, integrity, authentication & non-repudiation of data. It
is basically the combination of Encryption & Decryption.

Encryption : It is the process of converting normal readable data called plain text
into an unreadable code form called cipher text using an algorithm & key. This
ensures that if someone intercepts the data, they cannot read it without the key.

Decryption: It is the reverse process f encryption. It converts cipher text back into
the readable plain text using the correct key. Only the authorised users with the
proper key can decrypt the message.

Faculty- Kamal Tiwari Page 5

 Mewar Institute of Management Network Security

Network Security Model

The Network Security Model describes how data can be securely transmitted
between a sender and a receiver over a network while preventing attackers
from accessing or modifying the data.

Network Security Model = A method to protect data while sending it over a

network.

Basic Components of Network Security Model

The network security model mainly includes five elements:

1. Sender
2. Message (Data)
3. Encryption-Decryption Algorithm
4. Secret Key
5. Receiver

A Trusted Third Party is a reliable and neutral organization that helps two
communicating parties establish secure communication.

In simple words:
Trusted Third Party = A trusted middle organization that helps provide
security between sender and receiver.
Both the sender and receiver trust this third party.

Why Do We Need a Trusted Third Party?

Sometimes:
 The sender and receiver do not know each other
 They do not share a secret key
 They need someone trusted to verify identities or distribute keys
So a trusted authority helps them communicate securely.

Faculty- Kamal Tiwari Page 6

 Mewar Institute of Management Network Security

BLOCK CIPHER AND STREAM CIPHER

The plain text is converted into cipher text. In some methods plain text is
treated as humorous is divided units or block and then it is converted into
cipher text. But in some methods, plain text is divided into the method
which converse each single bit to the cipher text. So therefore, there are
two cipher methods (Block Cipher and stream Cipher) in which plain text is
given as input in order to convert them to their corresponding cipher text.

Block Cipher, as the name suggests, takes input (i.e. plain text) and
divides the plain text into number of units or blocks. After receiving input,
plain text as a unit or block is encrypted with the key and converts it to a
cipher text

Advantages of Block Cipher

1. It is faster than stream cipher
2. If any block contains any transmission error them it will not have affect
on other block.
3. Block ciphers can be easier to implement in software
4. Block cipher is more suitable in trading applications.

Disadvantages of Block Cipher

1. If two same unit or blocks of plaintext is there then the cipher produces
same cipher text for units or blocks.
2. It is easy to insert or delete units/blocks.
3. Block encryption may be more susceptible to cryptanalysis attack as
compared to stream cipher as block cipher provides strong hints because
two same units produce same cipher text.
4. Block encryption is more susceptible to replay as compared to stream
encryption.

Faculty- Kamal Tiwari Page 7

 Mewar Institute of Management Network Security

Stream Cipher takes input (i.e. plain text) and divide this plain text into
number of bits (combination of such bits is plain text). After receiving single
bit which represents as a part of plain text is encrypted with the key and
converts it to a cipher text.

Advantages –
1. Suitable for hardware implementation as only encryption & decryption
data one bit at a time.
2. Less susceptible to cryptanalysis than block cipher.
3. Self-synchronous cipher protect against all type of authencity threats.
4. Less vulnerable to insertion or deletion of units.
Disadvantages-
1. During transmission, if any bit is lost or become erroneous, then it is
difficult to re-arrange & collects all the converted cipher text.
2. It is slower than block cipher.
3. It is not suitable for the software

Faculty- Kamal Tiwari Page 8

 Mewar Institute of Management Network Security

Symmetric & Asymmetric Key Algorithms

Symmetric Key Algorithm Asymmetric Key Algorithm

A cryptographic method where the A cryptographic method where two
same key is used for both different keys are used: a public key
encryption and decryption. and a private key.

Only one shared secret key is used. Two keys are used: Public Key +
Private Key.

The key must be securely shared The public key can be shared
between sender and receiver before openly, while the private key
communication. remains secret with the owner.

Very fast because the algorithm is Slower because mathematical

simpler. operations are more complex.

Requires less computational power. Requires more computational

power.
Security depends on keeping the Security depends on mathematical
secret key confidential. relationship between public and
private keys.

Difficult when many users Easier key distribution since public

communicate because each pair keys can be freely distributed.
needs a separate secret key.

Used for bulk data encryption such Used for key exchange, digital
as file encryption and secure signatures, and authentication.
communication.

Plaintext → Encryption using same Plaintext → Encryption using public

key → Ciphertext → Decryption key → Ciphertext → Decryption
using same key → Plaintext. using private key → Plaintext.

Secure but vulnerable if secret key Generally more secure for key
is intercepted. exchange because the private key is
never shared.

Eg: DES,AES Eg: RSA,Diffie–Hellman

Faculty- Kamal Tiwari Page 9

 Mewar Institute of Management Network Security

Data Encryption Standard (DES)

It is a symmetric key cryptography algorithm/. It uses block cipher technique for
encrypting the data i.e. same key is used for encryption & decryption. It was
developed by IBM.
Basic Features:
1. Block size is of 64 bits
2. Key size is of 56 bits
3. No. of rounds = 16

Working: Plain Text(64 bits blocks)

Initial Permutation

16 rounds of processing using 56 bits key

Final Permutation

Cipher Text(64 bits)

Adv:

1. Simple & well structured.

2. Efficient in hardware

Limitations:

1. Small key size of 56 bits. Easily breakable today.

2. Replaced by modern algorithms like AES.

Faculty- Kamal Tiwari Page 10

 Mewar Institute of Management Network Security
RSA Algorithm

It was developed by Ron Rivest, Adi Shami & Leonard Adleman in 1977.
It is asymmetric key algorithm.
It uses block cipher method.
It uses prime numbers.

1. Assume 2 prime numbers p & q.

2. Ф=(p-1)(q-1)
3. Public exponent(e) : 1 < e < Ф
Gcd(e, Ф) = 1
4. de % Ф(n) = 1
5. Public Key = (n,e)
6. Private Key = (n,d)
7. Encryption = ( me % n) where m: message
8. Decryption = (cd % n)

Q: Assume two prime numbers p=7 & q=19. Use RSA Algorithm to show the
encryption & decryption keys. Also encrypt & decrypt with message=”6”.
Q: Assume two prime numbers p=3 & q=5. Use RSA Algorithm to find the public &
private keys.

Faculty- Kamal Tiwari Page 11

 Mewar Institute of Management Network Security
Digital Signature

A digital signature in network security is like a secure electronic signature that

proves:

1. Who sent the message(Authentication)

2. The message has not changed(Integrity)
3. The sender can’t deny sending it. (Non-repudiation)
4. It doesn’t provide the confidentiality.
This means the hackers can read the message but can’t change it secretly.
Hence, for complete security. It is used together with encryption.

How digital signature works:

1. A message to be sent is created by the sender.

2. The system uses a hash function to convert the message into a short fixed
code. This is called a hash value.
3. Now, this hash value is encrypted using sender’s private key & thus digital
signature is produced.
4. The sender sends the original message along with the digital signature to
the receiver through the network.
5. Receiver receives the message & digital signature & decrypts the digital
signature using its public key & gets original hash. Receiver hashes the
received message again using hash function. If both hashes match, then the
message is authentic & unchanged.

Since, Digital Signature doesn’t guarantee the confidentiality. Hence, it

should be used with encryption of message for better security.

Faculty- Kamal Tiwari Page 12

 Mewar Institute of Management Network Security
Diffie Hellman Key Exchange Algorithm

This algorithm is used to exchange keys between sender & receiver.

This is not an encryption-decryption algorithm.

It uses Asymmetric Key Cryptography i.e. private & public keys for key exchange.

Algorithm:

1. Consider a prime number q.

2. Select primitive root (α) such that α<q
3. Assume A is the sender & B is the receiver.
4. Assume XA is private key of A, XA<q & YA is public key of A.
Calculate : YA = αXA mod q

5. Assume XB is private key of B, XB < q & YB is public key of B.

Calculate : YB = αXB mod q

6. Calculate secret keys K1 & K2 for exchange.

K1= (YB)XA mod q if k1 = k2
K2= (YA) XB mod q Key exchange successful.

Faculty- Kamal Tiwari Page 13

 Mewar Institute of Management Network Security
KERBEROS UNIT-2

It is a network authentication protocol that helps users & systems prove their
identity securely over an insecure network like internet.
It was developed at Massachusetts Institute of Technology(MIT).Kerberos uses a
trusted third party to verify identities & allows secure communication without
sending passwords over the network.
 It is secure. It never sends a password unless it is encrypted.
 Only a single login is required per session. Credentials defined at login are
then passed between resources without the need of additional logins.
 This Concept depends on a trusted third party – a Key Distribution
Center(KDC). The KDS is aware of all systems in the network & is trusted by
all of them.
 It performs mutual authentication, where a client proves its identity to the
server & the server proves its identity to the client.

Kerberos introduces the concept of Ticket Granting Server(TGS) . A client that

wishes to use a service has to receive a ticket giving it access to the server.
Kerberos also requires an Authentication Server to verify clients.
TGS & AS both are combined to make KDC.

How Kerberos Works:

Step 1:The user logs on to the workstation & requests service on the host. The
workstation sends a message to the Kerberos Server requesting a ticket granting
ticket(TGT).

Step 2: The Kerberos server verifies the user’s access rights in the user database
& creates a TGT & session key. The Authorization Server encrypts the results using
a key derived from user’s password & sends the message back to the user
workstation. The Kerberos server knows encrypted passwords of all the clients &
servers under its control.

Step 3: The workstation prompts the user for a password & uses the password to
decrypt the incoming message. When decryption succeeds, the user will be able to
use the TGT to request a service

Step 4: Whenever the user wants to access a service, the workstation client
application sends a request to requested application server with the TGT &
Authenticator

Step 5: The Application server verifies that the ticket & authenticator match &
then grants access to the service.

Faculty- Kamal Tiwari Page 14

 Mewar Institute of Management Network Security
X.509
It is a standard used to create & manage digital certificates. These certificates are
like online ID Cards that prove the identity of a website, server or person over the
internet.
These certificates are issued by the trusted organizations called Certificate
Authorities like DigiCert, Let’s Encrypt & Global Sign etc.

An X.509 certificate contains important information such as :

a. Owner’s identity
b. Public key used for encryption
c. Issuer (Certificate authority like DigiCert, Let’s Encrypt)
d. Validity period(Start & Expiry date)
e. Digital signature to ensure it’s authenticity.

How X.509 works:

1. We open a website like [Link] on the browser
2. The website first sends its X.509 certificate to the browser.
3. The browser checks:
a. Is it issued by a trusted Certificate Authority?
b. Is it valid or expired?
c. It is tampered?
4. If anything fails/found invalid, then a warning message is shown to the user
before opening the webste
5. If everything is valid, then a secure HTTPS connection is established for the
website.

Where X.509 is used?

a. In HTTPS website
b. Email Security(S/MIME)
c. VPN Connections
d. Digital Signatures

Faculty- Kamal Tiwari Page 15

 Mewar Institute of Management Network Security
PGP(Pretty Good Privacy)

It is a method used to secure emails & files by providing:

a. Encryption : to keep the data private.

b. Digital Signatures : To prove sender’s identity
c. Integrity : To ensure that the data is not altered.

It was created by Phil Zimmermann in 1991.

PGP uses hybrid encryption that is both the Symmetric & Asymmetric Encryption
are used. Symmetric Encryption is used for large amount of data whereas
Asymmetric encryption is used for secure key exchange.

How PGP Works:

1. User writes a message to be sent to the receiver.

2. A random session key is created & the message is encrypted using session
key(Symmetric encryption).
3. The session key is now encrypted using receiver’s public key
4. Sender creates a digital signature using private key.
5. Now, the final packet is sent with the encrypted message, encrypted session
key & digital signature.
6. The receiver decrypts the message using the session key.
7. The receiver decrypts the hash using sender’s public key & compare with the
newly generated hash. If matched then the message is authentic.

Features/Services of PGP:

1. Authentication :User verification is done

2. Confidentiality :The messages & the session key are properly encrypted.
3. Integrity : To check whether a message has been altered or not
4. Compression : PGP compresses the message before its encryption.
5. E-mail compatibility : PGP works smoothly with normal email systems
without breaking their ASCII format.

Faculty- Kamal Tiwari Page 16

 Mewar Institute of Management Network Security
S/MIME (Secure / Multipurpose Internet Email Extensions)

It is a standard used to secure email communication by providing:

 Encryption:protects email content from hackers.

 Digital Signature: To prove sender’s identity & integrity of the message.

S/MIME uses digital certificates based on the X.509 standard.

What MIME does?

MIME encodes non-ASCII data like pictures, audio, video, non-english text into
ASCII data so that it can be transmitted through SMTP Servers which support only
text data.

Basically, MIME adds a MIME header with the email messages before transmitting
them to through SMTP. Within the header, two types of information is included:
MIME type & subtype

The MIME type describes the general file type such as images, ext, video, audio
etcwhereas the subtype carries the specific file type such as jpeg,gif, mp4 or so
on. The body part defiens the email message/content.

Overall, in this entire process, MIME doesn’t provide any security services.

Hence S/MIME was introduced to add security services with [Link] adds two
cryptographic elements :Encryption& Digital Signature.

S/MIME supports 3 public key algorithms to encrypt session keys for transmission
with the message :Diffie Hillman key exchange, RSA Algorithm & Triple DES
algorithm.

Faculty- Kamal Tiwari Page 17

 Mewar Institute of Management Network Security
IP SECURITY (IPSec) UNIT-3

IPSec is a group of protocols designed to secure communications over the IP

networks such asthe internet. It operates at the Network layer (Layer-3) of OSI
model, meaning that it protects all the data that travels between devices,
regardless of the application being used.

In simple terms, IPSec acts like a secure tunnel that protects data while it is being
transmitted from one device to another. Without IPSec, data sent over the
internet can be intercepted, modified or spoofed by attackers. IPsec prevents this
by providing three major security services:

a. Confidentiality is achieved through encryption, ensuring that only authorized

users can read the data.
b. Integrity ensures that the data has not been altered during the transmission.
c. Authentication verifies the identity of the sender & the receiver.

IPSec Mainly uses two protocols:

1. Authentication Header(AH) : It provides security without hiding the [Link]

main job is to make sure that the data being sent is authentic &[Link]
acts like a tamper-proof seal on a [Link] tells the receiver:
 The data really came from the correct sender(authentication)
 AH doesn’t encrypt the data which means anyone can read the data
but cannot change it withut being detected.

2. Encapsulating Security Payload(ESP) :It is the most commonly used IPSec

protocol because it provides complete security – including encryption,
authentication & integrity, making it more widely used in real world
[Link] also adds extra information (headers & trailers) to protect
the packet & verify its safety at the receiving end.
Another important component of IPSec is Internet Key Exchange(IKE), which is
responsible for securely exchanging cryptographic keys & establishing a Security
Association between communicating parties.

Faculty- Kamal Tiwari Page 18

 Mewar Institute of Management Network Security
Applications of IPSec:

IPSec is widely used in modern networking for secure communication:

1. VPNs : It creates a secure tunnel over the public networks, allowing safe
data transfer between users &organizations.
2. Site to Site Connectivity: It connects multiple office networks securely over
the internet.
3. Remote Access: It enables employees to securely access office systems from
home or remote locations.
4. Cloud Security: It protects data exchange between users & the cloud
platforms.

Security Associations in IPSec

It is a set of rules or an agreement between two devices that defines how they will
securely communicate. It is like a security contract between two computers that
tells how to protect their data.

It includes all the information needed for secure communication:

 Encryption Algorithm : How the data will be hidden.

 Authentication Method – How the identity will be verified.
 Secret Keys – Used for encryption/decryption
 Security Parameter Index: A unique ID
 Lifetime : How long the security association is valid.
Security Associations operate in two modes:

1. Transport Mode: In this mode, only the data is encrypted, while the header
remains [Link] is used for end to end communication between devices.
2. Tunnel Mode: The entire IP packet(header+data) is encrypted &
encapsulated inside a new [Link] mode is commonly used in VPNs.

Faculty- Kamal Tiwari Page 19

 Mewar Institute of Management Network Security
Key Management in IPSec:

It is a protocol used in IPSec to setup a secure connection between two devices by

exchanging keys & agreeing on security rules. It performs the following tasks:

 Key Exchange: It generates & shares secret keys securely.

 Authentication: It verifies identity of both devices.
 Creates Security Associations for communication
 Manages connections- renew keys when needed.

Phases of Key Mnagement:

Phase 1 : Establish Secure Channel

 Creates a secure connection between 2 devices.

 Uses techniques like Diffie Hellman for key exchange
 Builds a Security Associations

Phase 2 : Creates IPSec Security

 Uses the secure chaneel from Phase-1

 Negotiates IPSec settings
 Creates IPSec Security Association

Faculty- Kamal Tiwari Page 20

 Mewar Institute of Management Network Security
Web Security UNIT-4

It refers to the measures & practices used to protect websites, web applications &
users from cyber threats. It ensures that the data exchanges between a
user(browser) & a website(server) is safe& private. It is like a shield that protects
websites & users from hackers, data theft & attacks.
Common Web threats:

 Phishing – fake website tricks users into giving credentials.

 Malware – Harmful software injected into the websites.
 SQL Injection – attackers manipulate database queries.
 Cross site Scripting – injects malicious scripts into web pages
 Man in the middle attack
Web Security Considerations:

To build a secure website, developers &organizations must consider the following:

1. Strong Authentication &Authorization

 Use strong passwords, OTP or Multifactor authentication
 Ensure only authorized users can access the resources
2. Data Encryption
 Use HTTPS to encrypt data during transmission.
 Encrypt sensitive data stored in databases.
3. Input Validation
 Validate user inputs to prevent attacks like SQL injection
4. Secure Coding Practices
 Follows best coding standards
 Avoid vulnerabilities in code
5. Regular Updates & Patching
 Keep the softwares, plugins & servers always updates
6. Use of firewalls & security tools
 Web application firewalls filter malicious traffic
 Antivirus & Intrusion Detection systems (IDS) add extra protection
7. Backup & Recovery
 Regular backups to prevent data loss
 Helps recover cyber attacks
8. Monitoring & logging
 Track the activity of all users
 Detect suspicious activity as early as possible.

Faculty- Kamal Tiwari Page 21

 Mewar Institute of Management Network Security
SSL(Secure Socket Layer)

It is a security protocol used to protect data sent over the [Link] creates a
secure & encrypted connection between a user’s browser & a website server. SSL
is like a secret tunnel that keeps the data saf while travelling over the internet.

Why SSL is neede?

When we visit a website using HTTP (Without SSL)

 The data is sent in plain text where hackers can read it or steal it.

When we visit a website using HTTPS(With SSL)

 All the data to be sent is encrypted. It can’t be modified & also the website
identity is verified.

Where SSL is used?

 Secure website(HTTPsS)
 Online Payments
 Login Pages
 Email Communication

SSL Handshake:

It is the process that happens before secure communication starts between a

client(Browser) & a webserver. Its main goal is to establish trust & create a secure
encrypted connection.

In Simple words: SSL Handshake is like a secret meeting where two people decide
how to talk securely befre starting the actual conversation. Before sending
sensitive data, both sides must:

 Verify each other

 Agree on encryption method
 Senate a shared secret key

1. Client Hello
The browser sends a message to the server asking supported SSL/TLS
versions, Encryption methods & generates a random number.
2. Server Hello

Faculty- Kamal Tiwari Page 22

 Mewar Institute of Management Network Security
The server replies with the selected SSL/TLS version, Chosen encryption
method, SSL Certificate & its own random number.
3. Certificate Verification
Browser checks the server’s certificate that
 whether it is issued by a trusted authority?
 Is it expired?
 Does it match the website?

If everything fund Valid then continue else warning

4. Key Exchange
Browser generates a pre-master secret key
Encryts it using servers public key
Sends it to the server
Only the server can decrypt it using its private key.
5. Session Key Creation
Both client & server use Pre-master secret key & random numbers to
generate the same session key
6. Secure communication starts.

SSL is outdated. It has been replaced by TLS(Transport Layer Security)

TLS(Transport Layer Security)

It is a security protocol that protects data when it is sent over the internet. It is
the modern & improved version of SSL & today almost all websites are using TLS.
It ensures data privacy, integrity & authentication between applications commonly
browsers & servers preventing eavesdropping or tampering by third parties. TLS
is the modern successor of SSL.

How it works:

1. Handshake:The client & server agree on security settings,verify certificates

& generate session keys.
2. Record Protocol: Uses the session keys for symmetric encryption to secure
data transmission.
3. Modern standards:TLS 1.3 is the most recent & secured version, offering
aster & more secure connections than previous versions.

Faculty- Kamal Tiwari Page 23

 Mewar Institute of Management Network Security
Where TLS is used:

 HTTPS websites
 Online banking & payments
 Email services
 Mobile Applications
 Cloud platforms

Difference between SSL & TLS

Feature SSL TLS

Version Older Protocol Newer & Improved
Security Less secure(Has vulnerabilities) More secure & advanced
Encryption Basic encryption methods Strong encryption algorithms
Handshake Slower & less efficient Faster & more secure
Use Not used anymore Widely used everywhere

Difference between HTTP & HTTPS

Feature HTTP HTTPS

Full Form HyperText Transfer HyperText Transfer
Protocol Protocol Secure
Secure Not Secure Secure
Encryption No Encryption Use TLS Encryption
Data Safety Can be Intercepted Protected from hackers
URL http:// https://
Port 80 443
Certificate Not required Require SSL/TLS
certificate
Use Case Basic Websites Banking, login, payment
pages

Faculty- Kamal Tiwari Page 24

 Mewar Institute of Management Network Security

Network Management Security UNIT-5

Simple Network Management Protocol (SNMP)

SNMP (Simple Network Management Protocol) is a standard protocol used to

monitor and manage network devices such as routers, switches, servers,
printers, and even IoT [Link] of SNMP like a remote control + reporting
system for a network administrator.

The Simple Network Management Protocol has become the popular standard for
internetwork management. Because it is a simple solution, requiring little code to
implement, vendors can easily build SNMP agents to their products. SNMP is
extensible, allowing vendors to easily add network management functions to their
existing products.

SNMP Architecture:

SNMP is based on the manager/agent model consisting of a manager, an agent, a

database of management information, managed objects and the network protocol.
The manager provides the interface between the human network manager and the
management system. The agent provides the interface between the manager and
the physical device(s) being managed.
 SNMP Manager (NMS - Network Management System)
This is the main control system (like a dashboard).
Example: Network admin software.

 SNMP Agent
Installed on devices (router, server, etc.).
It collects data and sends it to the manager.

 MIB (Management Information Base)

A database of all measurable parameters (like CPU usage, memory,
bandwidth).

 OID (Object Identifier)

Unique ID for each parameter in MIB.

Faculty- Kamal Tiwari Page 25

 Mewar Institute of Management Network Security
SNMP Messages:

SNMP uses five basic messages (GET, GET-NEXT, GET-RESPONSE, SET, and
TRAP) to communicate between the manager and the agent.

The GET and GETNEXT messages allow the manager to request information for a
specific variable.

The agent, upon receiving a GET or GET-NEXT message, will issue a GET-
RESPONSE message to the manager with either the information requested or an
error indication as to why the request cannot be processed.

A SET message allows the manager to request a change to be made to the value
of a specific variable in the case of an alarm remote that will operate a relay.

The agent will then respond with a GET-RESPONSE message indicating the change
has been made or an error indication as to why the change cannot be made.

The TRAP message allows the agent to spontaneously inform the manager of an
‘important’ event.

SNMPv1 (First Version)

SNMPv1 is the original version of SNMP introduced in the late 1980s. It was
designed to be simple and easy to implement, which made it widely adopted in
early networking environments.

Key Features:

 Uses community strings (like passwords)

 Supports basic operations: GET, SET, TRAP
 Works over UDP (fast but unreliable)

Security: Security in SNMPv1 is very weak.

 Uses plain text passwords (community strings)

Example: "public" (read-only), "private" (read-write)
 No encryption
 No authentication mechanism

This means anyone who knows the community string can access the device.

Faculty- Kamal Tiwari Page 26

 Mewar Institute of Management Network Security
Working Example:

 Manager sends: “GET CPU usage”

 Includes community string "public"
 Agent checks string → sends response

Limitations:

 No data encryption → vulnerable to hacking

 No user authentication
 No message integrity checking
 Cannot confirm if message is altered
Today, SNMPv1 is mostly obsolete and used only in very old systems.

SNMPv2 (Improved Version)

SNMPv2 was introduced to overcome the limitations of SNMPv1 and improve

performance, functionality, and error handling.
There are multiple variants:

 SNMPv2c (community-based, most common)

 SNMPv2u, SNMPv2p (less used)

Key Improvements:

1. Better performance
2. Bulk data transfer (GETBULK)
→ Retrieve large data in one request
3. Improved error handling
4. New commands:
o GETBULK
o INFORM

Security:

 SNMPv2c still uses community strings

 Same weakness as SNMPv1 (no encryption)

So security is still poor

Faculty- Kamal Tiwari Page 27

 Mewar Institute of Management Network Security
Example:

Instead of asking:

 “Give me CPU usage”

 “Give me memory usage”
 “Give me bandwidth”

SNMPv2 can say:

“Give me ALL these values in one request” (GETBULK)

Advantages:

 Faster than SNMPv1

 Efficient in large networks
 Reduces network traffic

Limitations:

 Security still weak

 Community string-based access is risky

SNMPv2c is still used in some environments but being replaced.

Faculty- Kamal Tiwari Page 28

 Mewar Institute of Management Network Security

SNMPv3 (Secure Version – Modern Standard)

SNMPv3 is the latest and most secure version of SNMP. It was designed to
solve all security problems of previous versions.

Major Security Features:

1. Authentication
o Verifies the identity of the user
o Uses protocols like MD5, SHA
2. Encryption (Privacy)
o Data is encrypted (DES, AES)
o Prevents data theft
3. Integrity : Ensures message is not modified

User-Based Security Model (USM):

Instead of community strings, SNMPv3 uses:
 Username
 Password
 Encryption keys

Security Levels:
1. noAuthNoPriv :No authentication, no encryption
2. authNoPriv : Authentication only
3. authPriv : Authentication + Encryption (most secure)

Example:
 Manager sends request with username + encrypted message
 Agent verifies identity
 Sends encrypted response

Advantages:
 Strong security
 Data protection
 Trusted communication

Limitations:
 More complex to configure
 Requires more resources

Recommended for modern networks

Faculty- Kamal Tiwari Page 29

 Mewar Institute of Management Network Security

SET (Secure Electronic Transaction)

It is a security protocol designed to make online payments using credit/debit cards
safe & secure. It was developed by Visa & MasterCard. It protects online card
payments by encrypting data & verifying both the buyer & seller.
How SET works or SET Encryption Process
1. Customer places an order online.
2. Payment details are encrypted.
3. Customer & merchant identities are verified using digital certificates.
4. Bank checks & approves the transaction.
5. Payment is completed securely by informing the banks of both the customer &
merchant about the transaction.
Advantages:
1. Privacy via Cryptography technique that makes the messages unreadable by
the unauthorized users.
2. Integrity of messages so that messages will be delivered without alterations.
3. Authentication via digital signatures.

Limitation:
1. SET is very secure but complex too, so today it is rarely used. Modern
systems use simpler technologies like:
SSL/TLS(used in HTTPS websites) & Payment Gateways
2. Slow & Expensive
3. It is not portable

Faculty- Kamal Tiwari Page 30

 Mewar Institute of Management Network Security
SYSTEM SECURITY UNIT-6

Firewall
A firewall is a software or hardware based network security system that controls
the incoming & outgoing network traffic by analyzing the data packets &
determining whether they should be allowed through or not based on applied rules
or security policy. A firewall establishes a barrier between a trusted, secure
internal network called Internet and other public, unsecure network called
Internet.

Design goals of a firewall:

1. All the traffic from inside to outside & vice versa, must pass through the
firewall.
2. Only authorized traffic, as defined by the security policy will be allowed to
pass.
3. The private network users can use the services of Internet but not the vice
versa.
4. The firewall itself is immune to penetration.
5. A firewall defines a single check point that keeps unauthorized users out of
the protected network.
Limitations of firewall:

1. The firewall cannot protect against attacks that bypass the firewall.
2. The firewall cannot protect against the internal threats.
3. The firewall cannot protect against the transfer of virus infected programs or
files.
Types of Firewall:

1. Packet Filtering Firewall

This is the simple& oldest type of firewall. It examines individual packets of
data & decides whether to allow or block them based on rules. It is very fast
& simple to configure.
It doesn’t remember the connection & hence stateless.

How it works:
a. A packet arrives at the firewall.
b. Firewall reads the header fields like Sender IP, Destination IP, Protocol,
Sender Port, Destination port etc.

Faculty- Kamal Tiwari Page 31

 Mewar Institute of Management Network Security
c. It compares these with the Access control list(ACL) rules.
d. Takes a decision i.e if the ACL rules are matched then allow the packets
else deny the packets.

Disadvantages: It cannot detect spoofed packets & session hijacking.

2. Stateful Inspection Firewall

It remembers the connections & track their state. Hence, called Stateful.
It is more secure than the packet filtering firewall as it prevents from fake
packets & unauthorized access.
How it works:
a. Connection establishment: When the client sends a connection(TCP)
request, firewall records the sender IP &port, Destination IP &port,
connection state into a state table.
b. Session Tracking: Firewall monitors the entire TCP handshake & marks
connection as established.
c. Packet validation: Incoming packets are allowed only if they belong to an
existing session or they match the state table.

Disadvantages:

 It is slightly slower than packet filtering

 It can be vulnerable to state table attacks.

3. Circuit Level Gateway:

It ensures that a connection is legitimate/legal or not but doesn’t inspect the
actual data.
It has fast performance & simple design
How it works?
a. Client requests a TCP Connection
b. Firewall verifies the TCP Handshake validity & the session establishment
c. If the connection is valid then allows communication

Disadvantages

 No payload/data inspection
 Cannot detect malware
 Limited security

Faculty- Kamal Tiwari Page 32

 Mewar Institute of Management Network Security
Stateful Firewall: It tracks the entire communication (before the connection
establishmenet+after the connection establishment check packets during the
communication)

Circuit level: It only checks if the connection is valid at the beginning not during &
after.

4. Proxy Firewall / Application Level Gateway

A proxy firewall acts as a middleman, completely separating client & server.
A client never directly communicates with the server. Unlike other firewall
types, it inspects the data also.
How it works:
a. Client sends request to the proxy firewall.
b. Proxy firewall analyses the request’s URL, data content, application
protocols like HTTP, FTP SMTP etc.
c. If safe then proxy forwards request to the internet server
d. Internet server sends the response back to the proxy
e. Proxy server sends the response to the client

Advantages:

 Highest security level due to content filtering & malware detection

 Hides internal network IP

Disadvantages: Slower & complex configuration.

Faculty- Kamal Tiwari Page 33

 Mewar Institute of Management Network Security

Intrusion Detection System(IDS)

An IDS is a security system used to monitor computers, networks or systems for

suspicious activities, attacks or unauthorized access.
It works like a security guard or alarm system for the computer network. If
someone tries to hack, steal data or damage the system, IDS detects it & sends
an alerts to the security administrator.
Main Functions of IDS:
 Monitor network traffic & system activities
 Detect attacks or unusual behaviour
 Alert administrators
 Help prevent data loss & damage
 Keep records of attacks for future analysis.

Types of IDS:

1. Host Based IDS : This IDS is installed on an individual computer or server. It

monitors files, programs, user activities etc.
Advantages:
a. Detects internal attacks
b. Checks file changes
c. Monitors specific computer
Disadvantages:
a. Must install on each computer

2. Network Based IDS : This IDS is placed in the network to monitor all
incoming & outgoing traffic. It watches all the data packets, suspicious
traffic & unauthorised access attempts.
Advantages:
a. Protect many devices at once
b. Detects external attacks
Disadvantages:
a. Hard to inspect encrypted traffic
b. Heavy traffic may reduce performance

3. Signature Based IDS: This IDS detects attacks by comparing with known
attack patterns/signatures. It works like anti-viruses who detects the known
viruses by their patterns.
Advantage: Accurate for known attacks
Disadvantage: Cannot detect new attacks

Faculty- Kamal Tiwari Page 34

 Mewar Institute of Management Network Security
4. Anomaly Based IDS: This IDS detects unusual behaviour different from
normal system activity. For example: A user suddenly downloads huge data
at midnight. This is an abnormal activity.
Advantage: It can detect new attacks
Disadvantage: It may give false alarms.

Faculty- Kamal Tiwari Page 35