Types of Network Firewall

Network firewall is a security system that protects private networks from unauthorized access. It
monitors and controls incoming and outgoing traffic based on predefined security rules.
• Acts as a barrier between internal (trusted) and external (untrusted) networks
• Can be hardware-based, software-based, or both
• Filters traffic using rules, policies, and inspection methods
• Main goal: prevent attacks, malware, and unauthorized access like internet

acts as a security guard, filtering data packets to either: *Accept (allow traffic) , *Reject (block with error

response), *Drop (block silently without response)

Types of Network Firewalls

Below are the main types of network firewalls, organized by how they function and where they're
deployed:

1. Based on Function (How They Filter Traffic)

Network Security is the process of protecting networks, systems, and data from unauthorized
access, attacks, and damage.

a. Packet Filtering Firewall

A basic firewall that checks packet headers like IP, port, and protocol.
• Very fast and lightweight
• Does not inspect data inside packets
• Provides basic security only

b. Stateful Inspection Firewall

Tracks active connections and makes decisions based on traffic context.
• More secure than packet filtering
• Remembers past traffic (state table)
• Blocks suspicious or unexpected packets
c. Proxy (Application-Level) Firewall
Acts as a middleman between user and destination server.
• Filters data at the application layer
• Hides internal network details
• Can block malicious content before it reaches the user

d. Circuit-Level Gateway
Validates session creation (like TCP handshake) without inspecting data.
• Ensures only legitimate sessions start
• Low processing overhead
• Does not detect internal packet threats
e. Next-Generation Firewall (NGFW)
Advanced firewall combining multiple security features.
• Includes intrusion prevention, malware detection
• Can inspect encrypted traffic
• Provides app-level filtering

2. Network Firewall
A Network Firewall secures the perimeter, while a host-based firewall protects the endpoint.

a. Network Firewall
Placed at the network perimeter to protect the whole network.
• Controls inbound & outbound traffic
• First line of defense
• Ideal for organizations
b. Host-Based Firewall
Installed on individual PCs, laptops, or servers.
• Protects a single device
• Monitors local application traffic
• Useful for personal or endpoint security

3. Data Filtering Method

All three of these firewall types work to control network access, but they differ in their placement
and scope.

a. Perimeter Firewall
Placed at the edge to filter traffic between internet and internal network.
 • Central security control
• Blocks external attacks
• Common in corporate environments

b. Internal Firewall
Placed between internal network segments (e.g., departments).
• Prevents insider threats
• Protects sensitive areas (HR, finance)
• Provides micro-segmentation

c. Distributed Firewall
Firewall policies applied on multiple endpoints across the network.
• No single point of failure
• Consistent security across devices
 • Good for large, distributed networks

4. Form Factors
A program installed on a computer or server that protects it from network threats.

a. Hardware Firewall
A physical device installed on the network.
• Strong performance, high reliability
• Best for offices or enterprise networks
• More expensive than software firewalls

b. Software Firewall
Installed as a program on computers or servers.
 • Easy to configure
• Ideal for individuals and virtual environments
• Lower cost compared to hardware solutions

Working of Firewalls
Firewalls inspect packets entering or leaving the network and decide whether to allow or block
them. They compare traffic against rules to keep malicious data out.
• Analyze packet headers and sometimes packet content
• Block viruses, malware, and unauthorized access
• Monitor traffic patterns to detect anomalies
 Advantages and Disadvantages
Advantages Disadvantages
Protects network from unauthorized access Can reduce network speed due to inspection
Prevents malware, attacks, and suspicious traffic Hardware firewalls can be expensive
Easy to enforce security policies May block legitimate tasks by mistake
Works with other security tools Requires ongoing updates & maintenance

firewall is like home boundary wall (dewar) and IDS like alarm system inside boundary, if somehow intrudoser
enters inside boundary alarm start buzzing/alerting (ids doesnot take acction) and helps owner to respond

Intrusion Detection System (IDS)

quickly

An Intrusion Detection System (IDS) is a security tool that monitors network traffic or system
activities to detect unauthorized access or suspicious behavior. Think of it as a "watchdog" that
looks for signs of cyber attacks or security breaches, helping administrators respond quickly before
damage occurs. its doesnt take action only alerts
• Intrusion: Unauthorized access to a system, often by cybercriminals using advanced
techniques.
• IDS Functions: Monitors traffic for unusual activities and alerts administrators when
potential attacks are detected.
• Detection Focus: IDS looks for abnormal behavior that could harm data integrity,
confidentiality or availability.

Common Methods of Intrusion

• Address Spoofing: Hiding the source of an attack by using fake or unsecured proxy servers
making it hard to identify the attacker.
• Fragmentation: Sending data in small pieces to slip past detection systems.
• Pattern Evasion: Changing attack methods to avoid detection by IDS systems that look for
specific patterns.
• Coordinated Attack: Using multiple attackers or ports to scan a network, confusing the
IDS and making it hard to see what is happening.

Working IDS
An IDS operates by monitoring network traffic or system activities to detect suspicious or malicious
actions. Here’s how it works:
• Traffic Monitoring: The IDS captures and monitors data flowing through the network.
• Pattern Matching: It compares the incoming data against a set of predefined rules or
patterns that could indicate potential attacks or intrusions.
• Alerting: If the system detects an activity that matches any of these patterns, it triggers an
dont
alert to notify the system administrator.
• Administrator Action: Upon receiving the alert, the administrator can investigate the
source of the potential attack and take necessary actions to mitigate the risk.
Classification of IDS
There are several types of IDS, categorized based on where they operate or how they detect
intrusions:

1. Network Intrusion Detection System (NIDS)

• Function: NIDS is deployed at strategic points within the network to monitor traffic from
all devices.
• Usage: It examines passing traffic across subnets and compares it against known attack
signatures. When an attack is detected, it alerts the administrator.
Example: A NIDS could be placed in front of firewalls to monitor any attempts to crack
the firewall.

2. Host Intrusion Detection System (HIDS)

• Function: HIDS operates on individual devices (hosts) within the network.
• Usage: It monitors traffic and file integrity on that specific host, comparing current system
files with previous snapshots to detect unauthorized changes.
Example: A HIDS is often used on critical systems that should not be modified, like
servers or sensitive machines.

3. Hybrid Intrusion Detection System

• Function: A hybrid IDS combines multiple IDS types to provide more comprehensive
protection.
• Usage: It integrates host-based and network-based monitoring to give a complete view of
network and system activity.
Example: Prelude is a hybrid IDS that combines NIDS and HIDS approaches.
4. Application Protocol-Based IDS (APIDS)
• Function: APIDS monitors and analyzes application-specific protocols to detect potential
attacks targeting specific applications.
• Usage: It tracks communication protocols like SQL to detect malicious activity during
database interactions.
Example: Monitoring SQL queries in a web server environment.

5. Protocol-Based IDS (PIDS)

• Function: PIDS monitors communication protocols between devices (like HTTPS or
HTTP) to detect abnormal activity.
• Usage: It ensures that the communication follows expected patterns, identifying deviations
that may signal an attack.
Example: Monitoring the HTTPS traffic entering a server.

IDS Evasion Techniques

Attackers often use methods to evade detection by IDS systems. Some of the most common evasion
techniques include:
• Fragmentation: An attacker breaks down malicious packets into smaller fragments. Since
IDS systems may only scan the full packet, these fragments can bypass detection.
• Packet Encoding: Attackers encode malicious packets using techniques like Base64 or
hexadecimal encoding to hide malicious content from signature-based IDS systems.
• Traffic Obfuscation: Obfuscating the content of packets by altering the structure or
encoding makes it difficult for the IDS to interpret and detect the attack.
• Encryption: Attackers may use encryption to hide malicious payloads, making it harder for
an IDS to detect attacks hidden within encrypted traffic.

Detection Method of IDS

Signature-Based Detection
This method relies on predefined patterns (signatures) of known attacks. It compares incoming data
to a database of attack signatures.
• Easy to implement and effective for detecting known threats.
• Cannot detect new or unknown attacks unless their signature is added to the database.
Example: Detecting a specific virus or malware pattern.

Anomaly-Based Detection
Anomaly-based IDS uses machine learning or statistical models to define what normal behavior
looks like. Any activity that deviates from this norm is flagged as suspicious.
• Can detect unknown attacks or behaviors.
• High rate of false positives if the model is not fine-tuned.
 Example: Detecting abnormal traffic volume or unusual access patterns on a server.

Comparison of IDS with Firewalls

While both IDS and firewalls play important roles in network security, they serve different
purposes:
• Firewall: A firewall works to prevent unauthorized access by restricting traffic between
networks based on predefined rules. It blocks suspicious inbound or outbound traffic, but it
doesn’t alert you when an attack happens inside the network.
• IDS: An IDS, on the other hand, works by detecting and alerting on suspicious activity after
an attack has occurred. It doesn’t block traffic but instead alerts administrators so they can
respond to potential threats.

Importance of IDS
• Complementary Security Layer: IDS works alongside firewalls and other security
measures to provide comprehensive protection.
• Early Detection: IDS can detect intrusions that bypass primary defenses like firewalls or
VPNs.
• Rapid Response: Alerts from IDS help administrators respond quickly to attacks,
potentially reducing damage.

Placement of IDS
• Behind the Firewall: Placing an IDS behind the firewall allows it to monitor incoming
traffic without receiving internal traffic. This position provides visibility of external threats
but avoids false alarms generated by internal traffic.
• Within the Network: An IDS placed inside the network monitors internal traffic, helping to
detect intrusions after the firewall has been bypassed.
• Advanced IDS: In more sophisticated setups, an IDS may be integrated with the firewall,
allowing for better response and detection of complex attacks entering the network.

Benefits of IDS
• Detects Malicious Activity: IDS can detect any suspicious activities and alert the system
administrator before any significant damage is done.
• Improves Network Performance: IDS can identify any performance issues on the network,
which can be addressed to improve network performance.
• Compliance Requirements: IDS can help in meeting compliance requirements by
monitoring network activity and generating reports.
• Provides Insights: IDS generates valuable insights into network traffic, which can be used
to identify any weaknesses and improve network security.
Limitations of IDS
• False Alarms: IDS can generate false positives, alerting on harmless activities and causing
unnecessary concern.
• Resource Intensive: It can use a lot of system resources, potentially slowing down network
performance.
• Requires Maintenance: Regular updates and tuning are needed to keep the IDS effective,
which can be time-consuming.
• Doesn't Prevent Attacks: IDS detects and alerts but doesn’t stop attacks, so additional
measures are still needed.
• Complex to Manage: Setting up and managing an IDS can be complex and may require
specialized knowledge.

Intrusion Prevention System (IPS)

An Intrusion Prevention System (IPS) actively monitors network and system traffic to detect and
block malicious activity in real time. It extends traditional IDS capabilities by not only identifying
threats but also automatically preventing attacks before they cause damage.
• Detects and blocks malicious traffic instantly
• Monitors network and host activities continuously
• Uses signatures, behavior and anomaly analysis
• Prevents intrusions through automated responses
• Enhances security visibility and reduces attack impact

How Does an IPS Work

An IPS works by analyzing network traffic in real-time and comparing it against known attack
patterns and signatures. When the system detects suspicious traffic, it blocks it from entering the
network.

1. Inline Deployment
An IPS is typically deployed in-line, meaning it is placed directly in the path of network traffic
between internal networks and external sources (such as the internet). This placement enables the
IPS to inspect every packet that flows through, allowing it to block any malicious activity before it
can do harm.
• Positioning: The IPS can be placed behind a firewall or directly between the internal
network and external traffic sources.

2. Traffic Preprocessing
Before deep inspection begins, the IPS preprocesses incoming traffic to ensure it's correctly
interpreted:
• Traffic Normalization: It standardizes traffic formats to prevent attackers from using
encoding tricks to evade detection.
• Packet Reassembly: The IPS reassembles fragmented packets to ensure no data is missed
and malicious content isn't hidden in fragments.

3. Layered Packet Inspection

An IPS performs deep packet inspection (DPI) to understand both the structure and intent behind
the network traffic. This analysis occurs at multiple layers of the OSI model:
• Network Layer: Checks packet origins and destinations.
• Transport Layer: Examines the reliability and integrity of the connections.
• Application Layer: Inspects the type of data being transmitted (e.g., login credentials, file
transfers).

4. Detection Mechanisms
The IPS uses various detection mechanisms to identify threats:
• Signature-Based Detection: Compares traffic against known attack patterns or signatures
(like fingerprints of known malware or exploits).
• Anomaly-Based Detection: Flags any behavior that deviates from normal network activity,
such as sudden spikes in traffic or unusual request patterns.
• Behavior-Based Detection: Monitors and tracks actions over time, identifying suspicious
patterns like repeated failed login attempts or unauthorized access attempts.
• Policy-Based Detection: Enforces custom rules defined by administrators (e.g., blocking
traffic from specific countries or blocking certain file types).

5. Automated Response Actions

Once a threat is detected, the IPS can immediately take action to mitigate it:
• Drop Malicious Packets: Discards harmful traffic before it reaches its target.
 • Block Source IP: Prevents further connections from the attacker’s IP address.
• Terminate Sessions: Ends suspicious or unauthorized sessions.
• Trigger Alerts/Logs: Generates alerts or logs for the administrator to review.
• Update Firewall Rules: Automatically adjusts firewall settings to block traffic from
malicious sources.

6. Tuning and Maintenance

An IPS requires regular updates and fine-tuning to stay effective:
• Update Signatures: Regular updates are needed to add new attack signatures and detection
patterns.
• Reduce False Positives: Fine-tuning helps minimize alerts for non-malicious traffic,
ensuring the system only triggers legitimate threats.
• Optimize Performance: Adjust settings to ensure the IPS can handle high traffic loads
without performance degradation.

Types of IPS
IPS systems can be classified into the following types based on their monitoring focus and
deployment:

1. Network-Based Intrusion Prevention System (NIPS)

• Monitors and analyzes network traffic for suspicious activity. It is typically placed at the
network perimeter.
• Protects the entire network from external threats by inspecting inbound and outbound traffic.

2. Host-Based Intrusion Prevention System (HIPS)

• Runs on individual devices (hosts) within the network and monitors the traffic flowing in
and out of those specific devices.
• Provides protection for individual systems and their processes, useful for securing critical
machines.

3. Wireless Intrusion Prevention System (WIPS)

• Monitors wireless network traffic to detect and block suspicious activity targeting wireless
protocols.
• Protects against wireless-specific attacks such as rogue access points or unauthorized
wireless devices.

4. Network Behavior Analysis (NBA)

• Monitors network traffic patterns to identify anomalies that could signify a threat, such as
Distributed Denial of Service (DDoS) attacks or malware outbreaks.
• Detects abnormal traffic flows and network behaviors that could indicate a potential attack.
Why Do You Need an IPS
An IPS is an essential tool for network security. Here are some reasons why:
• Protection Against Known and Unknown Threats: An IPS can block known threats and also
detect and block unknown threats that haven't been seen before.
• Real-Time Protection: An IPS can detect and block malicious traffic in real-time, preventing
attacks from doing any damage.
• Compliance Requirements: Many industries have regulations that require the use of an IPS
to protect sensitive information and prevent data breaches.
• Cost-Effective: An IPS is a cost-effective way to protect your network compared to the cost
of dealing with the aftermath of a security breach.
• Increased Network Visibility: An IPS provides increased network visibility, allowing you to
see what's happening on your network and identify potential security risks.

Comparison of Intrusion Prevention System Technologies

Each IPS type is designed to monitor different parts of an IT environment, providing specialized
protection based on where threats occur. Understanding these differences helps in selecting the right
combination of technologies for a stronger security posture.
• Coverage varies from entire networks to individual hosts and wireless environments
• Detection approaches include signature-based, anomaly-based and behavior-based analysis
• Some IPS types are better suited for identifying large-scale attacks like DDoS, while others
focus on endpoint-level threats NBA
• Using multiple IPS technologies together helps reduce security gaps and improve overall
defense
IPS vs. IDS
The main distinction between an Intrusion Prevention System (IPS) and an Intrusion Detection
System (IDS) lies in their functionality

IDS (Intrusion Detection System)

• Detection Only: An IDS is a passive system that detects potential intrusions and generates
alerts.
• Function: It does not block or prevent attacks but informs administrators so they can take
action.
IPS (Intrusion Prevention System)
• Detection and Prevention: An IPS is an active system that detects threats and prevents
them by blocking malicious traffic in real-time.
• Function: It can take automatic actions like dropping packets, blocking IP addresses and
resetting connections.

Authentication
Authentication is the process of confirming the identity of a user, device, or system by validating
provided credentials before granting access to a network or its resources.
• It prevents unauthorized usage of systems username & password eg

• It ensures secure interaction within a network environment

• It maintain security, reliability, and trust within the system

Authentication Methods
Authentication can be implemented using different techniques based on the type of credentials used.
The commonly used methods are:

1. Password-Based Authentication
• The most commonly used authentication technique
• Each user is assigned a unique username and password
• During login, the entered password is compared with the stored (usually hashed) password
• If the credentials match, access is granted; otherwise, access is denied
• Security depends on password strength and protection against attacks like guessing or
phishing

2. Physical Identification
• Uses physical objects such as ID cards, badges, tokens, or smart cards
• The system verifies possession of the physical item to authenticate the user
• Often combined with passwords or PINs to increase security
• Smart cards can store authentication data internally
• Commonly used in ATMs, offices, and restricted access areas
• Loss or theft of the card can pose a security risk

3. Biometric Authentication finger, face recognition iris recognition

• Relies on unique biological or behavioral characteristics of individuals

• Eliminates the need to remember passwords or carry physical tokens
• Difficult to replicate, providing higher security
• Requires specialized hardware and accurate data capture
Common biometric techniques:
• Facial recognition – analyzes facial features
 • Fingerprint recognition – uses ridge patterns of fingers
• Hand geometry – measures shape and size of the hand
• Retinal pattern recognition – scans the eye structure
• Signature verification – analyzes writing style
• Voice recognition – matches voice frequency patterns

Types of Authentication
Authentication systems are classified based on the number of independent factors used to verify a
user’s identity. Increasing the number of factors improves security by reducing reliance on a single
credential.

1. Single-Factor Authentication (SFA)

• Single-Factor Authentication relies on one form of verification, typically a username and
password
• The system grants access when the entered credential matches the stored value
• It is widely used in systems where ease of access is prioritized over high security
• Security is entirely dependent on password strength and user practices
Advantages:
• Simple and quick to use
• Easy to implement and manage
• Cost-effective for basic systems
Disadvantages:
• Provides limited protection
• Easily compromised through weak passwords, phishing, or brute-force attacks

2. Two-Factor Authentication (2FA)

• Two-Factor Authentication requires two different authentication factors to confirm identity
• Typically combines something the user knows (password) with something the user has
(OTP, token, smart card)
• Even if one factor is compromised, the second factor helps prevent unauthorized access
 mpay login and transfer password +otp

• Commonly used in online banking, email services, and enterprise systems

Advantages:
• Offers significantly improved security over SFA
• Reduces the impact of stolen or leaked passwords
Disadvantages:
• Adds an extra step during login
• Depends on additional devices or network connectivity

3. Multi-Factor Authentication (MFA)

• Multi-Factor Authentication uses two or more independent factors for identity verification
• It may combine passwords, physical devices, and biometric traits
• Designed for environments where data sensitivity and security are critical
• Provides layered protection against advanced attacks
Advantages:
• Strong protection against unauthorized access
• Minimizes risks from credential compromise
Disadvantages:
• More complex to deploy and manage
• Higher cost and possible dependency on third-party services

Applications
Authentication is widely used in computer networks and systems to ensure secure and controlled
access to resources. Its common applications include:
• User Login Systems: Verifies user identity in operating systems, websites, and applications
before access is granted.
• Banking and Financial Systems: Secures ATMs, mobile banking, and online transactions
using PINs, OTPs, and biometric authentication.
• Network Access Control: Restricts access to private and enterprise networks to authorized
users and devices only.
• Email and Cloud Services: Protects sensitive user data using password-based and multi-
factor authentication mechanisms.
• Enterprise and Organizational Systems: Controls access to internal servers, applications,
and confidential organizational resources.

Access Control in Computer Network

Access control is a security strategy that controls who or what can view or utilize resources in a
computer system. It is a fundamental security concept that reduces risk to the company or
organization. In this article, we are going to discuss every point about access control. In this article,
we will learn about Access control and its authentication factors, components of access control,
types of access control, and the Difference between Authentication and Authorization.

What is Access Control?

Access Control is a method of limiting access to a system or resources. Access control refers to the
process of determining who has access to what resources within a network and under what
conditions. It is a fundamental concept in security that reduces risk to the business or organization.
Access control systems perform identification, authentication, and authorization of users and
entities by evaluating required login credentials that may include passwords, pins, bio-metric scans,
or other authentication factors. Multi-factor authentication requires two or more authentication
factors, which is often an important part of the layered defense to protect access control systems.

Authentication Factors
• Password or PIN
• Bio-metric measurement (fingerprint & retina scan)
• Card or Key
For computer security, access control includes the authorization, authentication, and audit of the
entity trying to gain access. Access control models have a subject and an object

Components of Access Control

• Authentication: Authentication is the process of verifying the identity of a user. User
authentication is the process of verifying the identity of a user when that user logs in to a
computer system.
• Authorization: Authorization determines the extent of access to the network and what type
of services and resources are accessible by the authenticated user. Authorization is the
method of enforcing policies.
• Access: After the successful authentication and authorization, their identity becomes
verified, This allows them to access the resource to which they are attempting to log in.
• Manage: Organizations can manage their access control system by adding and removing
authentication and authorization for users and systems. Managing these systems can be
difficult in modern IT setups that combine cloud services and physical systems.
• Audit: The access control audit method enables organizations to follow the principle. This
allows them to collect data about user activities and analyze it to identify possible access
violations.

How Access Control Works?

Access control involves determining a user based on their credentials and then providing the
appropriate level of access once confirmed. Credentials are used to identify and authenticate a user
include passwords, pins, security tokens, and even biometric scans. Multifactor authentication
(MFA) increases security by requiring users to be validated using more than one method. Once a
user's identity has been verified, access control policies grant specified permissions, allowing the
user to proceed further. Organizations utilize several access control methods depending on their
needs.

Types of Access Control

• Attribute-based Access Control (ABAC): In this model, access is granted or declined by
evaluating a set of rules, policies, and relationships using the attributes of users, systems and
environmental conditions.
• Discretionary Access Control (DAC): In DAC, the owner of data determines who can
access specific resources.
• History-Based Access Control (HBAC): Access is granted or declined by evaluating the
history of activities of the inquiring party that includes behavior, the time between requests
and content of requests.
• Identity-Based Access Control (IBAC): By using this model network administrators can
more effectively manage activity and access based on individual requirements.
• Mandatory Access Control (MAC): A control model in which access rights are regulated
by a central authority based on multiple levels of security. Security Enhanced Linux is
implemented using MAC on the Linux operating system.
• Organization-Based Access control (OrBAC): This model allows the policy designer to
define a security policy independently of the implementation.
• Role-Based Access Control (RBAC): RBAC allows access based on the job title. RBAC
eliminates discretion on a large scale when providing access to objects. For example, there
should not be permissions for human resources specialist to create network accounts.
• Rule-Based Access Control (RAC): RAC method is largely context based. Example of this
would be only allowing students to use the labs during a certain time of day.
Different access control models are used depending on the compliance requirements and the
security levels of information technology that is to be protected. Basically access control is of 2
types:
• Physical Access Control: Physical access control restricts entry to campuses, buildings,
rooms and physical IT assets.
• Logical Access Control: Logical access control limits connections to computer networks,
system files and data.

Challenges of Access Control

• Distributed IT Systems: Current IT systems frequently combine internet and on-premise
networks. These systems may be distributed geographically and comprise various devices,
assets, and virtual machines. Access is allowed to all of these devices, and keeping track of
them can be challenging.
• Policy Management: Policy makers within the organization create policies, and the IT
department converts the planned policies into code for implementation. Coordination
between these two groups is essential for keeping the access control system up to date and
functioning properly.
 • Monitoring and Reporting: Organizations must constantly check access control systems to
guarantee compliance with corporate policies and regulatory laws. Any violations or
changes must be recognized and reported immediately.
• Access Control Models: Access control mechanisms provide varying levels of precision.
Choosing the right access control strategy for your organization allows you to balance
acceptable security with employee efficiency.

Types of Authentication Mechanism

• Two-factor authentication
• Multi-factor authentication
• one-time password
• Three-factor authentication
• Biometrics
• Hard Tokens
• Soft Tokens
• Contextual Authentication
• Device identification

What Are Some Methods for Implementing Access Control?

Virtual Private Networks are one of the most commonly used techniques to implement access
controls. This allows users to safely access resources remotely, which is critical when working away
from the actual workplace. VPNs can be used by businesses to offer safe access to their networks
when workers are spread out across the globe. While this is great for security reasons, it may cause
performance concerns, such as latency. Other techniques of access control include identity
repositories, monitoring and reporting apps, password management tools, provisioning tools, and
security policy enforcement services.

Difference between Authentication and Authorization

Authentication Authorization

Authorization determines the extent of access to the

Authentication is the process of
network and what type of services and resources are
verifying the identity of a user.
accessible by the authenticated user.

It is done before the authorization While this process is done after the authentication
process. process.

It needs usually the user’s login details. While it needs the user’s privilege or security levels.

The authentication credentials can be The authorization permissions cannot be changed by user
changed in part as and when required by as these are granted by the owner of the system and only
the user. he/she has the access to change it.

Authentication determines whether the While it determines What permission does the user have?
 e.g a student login into a system e.g student can only view their own record

Authentication Authorization

person is user or not.

The user authentication is visible at user

The user authorization is not visible at the user end.
end.

The user authentication is identified with The user authorization is carried out through the access
username, password, face recognition, rights to resources by using roles that have been pre-
retina scan, fingerprints, etc. defined.

Conclusion
Access control is an essential part of computer networks. They contribute to limiting access to
network resources and preventing unauthorized access. Firewalls, biometric authentication,
password policies, RBAC, ABAC, MFA, VPNs, intrusion detection systems, and data encryption
are examples of access control measures. Organisations can assure network security and protect
themselves from security threats by using access control.

HyperText Transfer Protocol Secure - HTTPS

HTTPS stands for HyperText Transfer Protocol Secure. It is the most common protocol for sending
data between a web browser and a website. HTTPS is the secure variant of HTTP and is used to
communicate between the user's browser and the website, ensuring that data transfer is encrypted
for added security.

Note: Any website, especially those requiring login details, should use HTTPS. You can
see a padlock icon in the URL bar, which means the page is secure. Browsers, like
Google Chrome, treat HTTPS seriously and mark non-HTTPS websites as "Not
Secure."
Working of HTTPS
HTTPS establishes the communication between the browser and the web server. It uses the Secure
Socket Layer (SSL) and Transport Layer Security (TLS) protocol for establishing communication.
The new version of SSL is TLS(Transport Layer Security).

data sent across the HTTP in plain text

HTTP usename:usename

password: password

browser
with SSL/TLS
web server

data sent across the HTTP is encrypted

HTTPS usename:avbtsc974fjhgdhjgxgjjffzdlnfe

password:grhkugASsdAWQg@@@Cgn

browser

• HTTPS uses the conventional HTTP protocol and adds a layer of SSL/TLS over it.
• The workflow of HTTP and HTTPS remains the same, the browsers and servers still
communicate with each other using the HTTP protocol.
• However, this is done over a secure SSL connection. The SSL connection is responsible for
the encryption and decryption of the data that is being exchanged to ensure data safety.

Why HTTPS Matters and What Happens Without It?

• HTTPS is important because it keeps the information on websites safe from being easily
viewed or stolen by anyone who might be spying on the network.
• When a website uses regular HTTP, data is sent in small chunks called packets that can
easily be intercepted using free software.
• This makes communication, especially over public Wi-Fi, very vulnerable to attacks.
• On the other hand, HTTPS encrypts the data, so even if someone manages to intercept the
packets, they will appear as random, unreadable characters.
Example
Before encryption: "This is a string of text that is completely readable"
After encryption:
"ITM0IRyiEhVpa6VnKyExMiEgNveroyWBPlgGyfkflYjDaaFf/Kn3bo3OfghBPDWo6AfSHlNtL8
N7ITEwIXc1gU5X73xMsJormzzXlwOyrCs+9XCPk63Y+z0="
Secure Socket Layer (SSL)
The main responsibility of SSL is to ensure that the data transfer between the communicating
systems is secure and reliable. It is the standard security technology that is used for encryption and
decryption of data during the transmission of requests.
• HTTPS is basically the same old HTTP but with SSL.
• For establishing a secure communication link between the communicating devices, SSL uses
a digital certificate called SSL certificate.

Roles of the SSL layer

• Ensuring that the browser communicates with the required server directly.
• Ensuring that only the communicating systems have access to the messages they exchange.

Encryption in HTTPS
HTTP transfers data in a hypertext format between the browser and the web server, whereas HTTPS
transfers data in an encrypted format. As a result, HTTPS protects websites from having their
information broadcast in a way that anyone eavesdropping on the network can easily see.
• During the transit between the browser and the web server, HTTPS protects the data from
being accessed and altered by hackers.
• Even if the transmission is intercepted, hackers will be unable to use it because the message
is encrypted.
• It uses an asymmetric public key infrastructure for securing a communication link.

Keys for Encryption:

• Private Key: It is used for the decryption of the data that has been encrypted by the public
key. It resides on the server-side and is controlled by the owner of the website. It is private in
nature.
• Public Key: It is public in nature and is accessible to all the users who communicate with
the server. The private key is used for the decryption of the data that has been encrypted by
the public key.
Note: HTTPS uses the following algorithms for encryption and hashing purposes:

• RSA: Used during the TLS/SSL handshake to securely exchange keys between
client and server. It’s an asymmetric encryption algorithm.
• SHA-256: Used for data integrity in digital signatures and certificates. It’s a
hashing algorithm, not for encrypting the actual traffic.

HTTP vs HTTPS
Here are some key differences between HTTP and HTTPS:

HTTP HTTPS

HTTP stands for HyperText Transfer HTTPS stands for HyperText Transfer Protocol Secure
 HTTP HTTPS

Protocol

URL begins with "[Link] URL starts with "[Link]

HTTP Works at the Application

Also works at the Application Layer (HTTP over TLS)
Layer.

Data is sent in plain text Data is encrypted using TLS

No encryption or security Provides encryption, authentication, and integrity

Nearly same speed in modern systems (TLS optimized,

Faster in theory (no encryption)
HTTP/2 & HTTP/3 support)

Secure Socket Layer (SSL)

Secure Sockets Layer (SSL) is an Internet security protocol that encrypts data to ensure secure
communication between devices over a network. Originally developed by Netscape in 1995, SSL
provides privacy, authentication and data integrity for online communications. SSL is the
predecessor of TLS (Transport Layer Security), which is now the standard protocol for secure
communications on the Internet.

Note: Websites using SSL/TLS display "HTTPS" in their URLs instead of "HTTP,"
indicating that communications are encrypted and secure.
Working of SSL
SSL ensures secure communication through three main mechanisms:
1. Encryption: Data transmitted over the network is encrypted, preventing unauthorized
parties from reading it. If intercepted, encrypted data appears as an unreadable jumble of
characters.
2. Authentication: SSL uses a handshake process to authenticate both the client and server,
ensuring each party is legitimate and not an imposter.
3. Data Integrity: SSL digitally signs transmitted data to detect any tampering, ensuring that
the data received is exactly what was sent.

Importance of SSL
Before SSL, web data was transmitted in plaintext, making it vulnerable to interception. SSL solves
this by:
• Encrypting sensitive information such as login credentials, financial transactions and
personal data.
• Authenticating web servers to prevent users from connecting to fraudulent websites.
• Ensuring data integrity so transmitted information cannot be modified during transit.
Note: SSL protects against cyber threats by providing confidentiality, authentication and
integrity for online communications.

SSL Protocols
SSL consists of several protocols, each handling a different aspect of secure communication

1. SSL Record Protocol

• Provides confidentiality and message integrity.

 • Application data is divided into fragments, optionally compressed and appended with a
Message Authentication Code (MAC).
• The data is then encrypted and transmitted with an SSL header.

2. Handshake Protocol
Establishes SSL sessions and authenticates clients and servers.

Four phases:
• Client and server exchange hello packets, protocol versions and cipher suites.
• Server sends its certificate and server key information.
• Client responds with its certificate and key exchange.
• Change Cipher Spec finalizes the handshake, activating secure communication.

3. Change-Cipher Spec Protocol.

• Signals that pending cryptographic parameters from the handshake should now become
active.
• Consists of a single 1-byte message.
4. Alert Protocol

• Communicates SSL-related warnings or errors.

• Warning alerts (level 1): Non-critical issues, such as expired or unsupported certificates.
• Fatal alerts (level 2): Critical errors, such as handshake failures, bad record MAC or illegal
parameters, which terminate the connection.

Versions of SSL/TLS
Version Release Year Notes
SSL 1 Never released Insecure
SSL 2 1995 First public release
SSL 3 1996 Improved security
TLS 1.0 1999 Successor to SSL 3.0
TLS 1.1 2006 Improved encryption and security
TLS 1.2 2008 Widely adopted, strong encryption
TLS 1.3 2018 Modern, efficient, secure protocol
Note: Today, TLS has replaced SSL, but the term "SSL" is still commonly used.

SSL Certificates
SSL certificates are digital certificates issued by trusted Certificate Authorities (CAs) to secure and
verify websites.

Key Features
• Encryption: Protects sensitive information during transmission.
• Authentication: Confirms the identity of the website or service.
• Integrity: Ensures transmitted data is not altered.
• Non-repudiation: Prevents denial of transmitted messages.
• Public-key cryptography: Facilitates secure key exchange.
• Session management: Allows resumption of secure sessions after interruptions.

Types of SSL Certificates

1. Single-Domain: Secures one domain.
2. Wildcard: Secures one domain and all its subdomains.
3. Multi-Domain: Secures multiple unrelated domains in one certificate.

Validation Levels
• Domain Validation (DV): Confirms domain ownership.
 • Organization Validation (OV): Confirms the organization's identity.
• Extended Validation (EV): Rigorous verification, highest trust level, often indicated by a
green address bar.

SSL vs TLS
• SSL: Older protocol, no longer considered secure.
• TLS: Updated and more secure version of SSL.
• Despite TLS being the standard, the term "SSL" is still widely used in marketing and casual
references.

Transport Layer Security (TLS)

Last Updated : 10 Apr, 2026
•
Transport Layer Security (TLS) is a cryptographic protocol designed to provide security at the
transport layer. It was derived from a security protocol called Secure Socket Layer (SSL). TLS
ensures that no third party can eavesdrop on or tamper with any message transmitted between a
client and a server.
• It helps to secure transmitted data using encryption, ensuring that sensitive information
remains confidential.
• It works seamlessly with most web browsers, including Microsoft Internet Explorer, and
operates across a wide range.
• Since TLS/SSL operates beneath the application layer, most of its processes are completely
invisible to the client.

Working
SSL/TLS works through a process called a handshake, which establishes a secure and encrypted
connection between a client and a server over TCP.
 • Client Hello: The client initiates the connection and sends supported SSL/TLS version, list
of cipher suites and compression methods.
• Server Selection: The server checks the highest compatible SSL/TLS version and selects a
suitable cipher suite and compression method from the client’s list.
• Server Authentication: The server sends its digital certificate to the client, which is verified
using a trusted Certificate Authority to confirm the server’s identity.
• Key Exchange: After verification, both client and server exchange information such as the
public key or the PreMasterSecret to securely generate encryption keys.
• Session Key Generation: Both parties compute the same session key, which will be used
for symmetric encryption during communication.
• Secure Communication: Once the handshake is complete, encrypted communication
begins, ensuring the confidentiality and integrity of transmitted data.
• Connection Termination: If the TCP connection closes improperly, the connection ends
securely without compromising the encrypted data.

Enhanced Security Features

• Uses AES (Advanced Encryption Standard) for fast and secure symmetric encryption.
• Uses RSA and Diffie–Hellman for secure key exchange and encryption.
• Supports hash functions such as SHA-256 to maintain message integrity.
• Ensures data remains confidential and protected from unauthorized modification.
• Protects communication from common cyber attacks.

Certificate-Based Authentication
• Server provides a digital certificate containing its public key and identity details.
• Certificate is verified using trusted root certificates.
• Certificate Authority (CA) confirms authenticity of the server.
• Prevents man-in-the-middle attacks.
• Establishes trust between client and server before data transmission.
Enhanced Security Features
• Uses symmetric encryption algorithms such as AES (Advanced Encryption Standard) for
fast and secure data protection.
• Uses asymmetric algorithms such as RSA and Diffie–Hellman for secure key exchange.
• Supports hash functions like SHA-256 to maintain message integrity.
• Ensures confidentiality and prevents unauthorized modification of data.
• Protects communication from common cyber threats.

Certificate-Based Authentication
• Server provides a digital certificate containing public key and identity details.
• Certificate is verified using trusted root certificates stored on the client system.
• Certificate Authority (CA) confirms authenticity of the certificate.
• Helps prevent man-in-the-middle attacks.
• Establishes trust between client and server before data exchange.

Forward Secrecy
This is a security feature in TLS that ensures previously transmitted data remains secure even if the
server’s private key is compromised in the future. It works by generating temporary session keys for
each communication session, which are not stored permanently and cannot be reused.
• Generates unique session keys for every session.
• Prevents attackers from decrypting past communications.
• Uses temporary keys that are not stored permanently.
• Provides stronger protection for sensitive data.
• Reduces impact of private key compromise.

TLS Handshake Protocol

This is the process through which the client and server establish a secure connection by agreeing on
encryption methods and exchanging cryptographic information required for secure communication.
• Negotiates TLS version supported by both client and server.
• Selects suitable cipher suite for encryption.
• Exchanges cryptographic parameters securely.
• Generates session keys for encryption and decryption.
• Establishes secure communication channel.

Perfect Forward Secrecy (PFS)

This is an advanced security feature in TLS that protects past communication even if long-term
private keys are compromised. It works by generating independent session keys for each
connection, ensuring that the compromise of one key does not affect the security of previous
sessions.
• Generates separate session keys for each communication session.
• Protects previously transmitted data from decryption.
 • Reduces risk caused by private key compromise.
• Provides stronger confidentiality for sensitive information.

TLS Deployment Best Practices

Organizations should follow proper configuration and management practices to ensure maximum
security when using TLS.
• Regularly update TLS versions and configurations.
• Disable outdated algorithms and weak cipher suites.
• Use strong key lengths in digital certificates.
• Maintain proper certificate chain and renewal process.
• Ensure secure implementation of cryptographic protocols.

Continual Evolution
TLS continues to improve over time to address new vulnerabilities and emerging cyber threats
through ongoing research and development by standard organizations.
• Updated regularly to handle new security risks.
• Developed and maintained by organizations like IETF.
• Adapts to modern cryptographic requirements.
• Provides stronger protection against advanced attacks.
• Ensures secure communication standards remain effective