🔐

ESSENTIALS OF

NETWORK SECURITY
Complete Study Notes with PYQs, Tips & Tricks

Topics Covered
Introduction to Information Security • System Security • Basic Arithmetics in Encryption
Symmetric Encryption • Asymmetric Key Encryption • Operating System Security
 UNIT 1
Introduction to Information Security

1. Introduction to Information Security

1.1 What is Information Security?
Information Security (InfoSec) is the practice of protecting information and information systems from
unauthorized access, use, disclosure, disruption, modification, or destruction. It encompasses policies,
processes, and technologies to safeguard data in any form — digital or physical.

The CIA Triad (Core Goals of InfoSec)

🎯 EXAM HOTSPOT
CIA Triad is the MOST ASKED concept in exams. Memorize: Confidentiality, Integrity, Availability —
with full definitions!

Property Definition Example

Confidentiality Ensuring info is accessible only to Encrypting bank transactions
authorized persons
Integrity Ensuring data is accurate and has not Hash verification of file downloads
been tampered with
Availability Ensuring systems and data are RAID storage, backup servers
accessible when needed

Extended Properties (DAD Triad — attacks counterpart)

• — Violation of Confidentiality
• — Violation of Integrity
• — Violation of Availability

💡 TIP
To remember CIA: Think of a secret agent (CIA) keeping things Confidential (C), unaltered/Integrated
(I), and Always Available (A).

1.2 Key Terminology

Term Definition Relevance
Asset Anything of value (data, hardware, What we protect
reputation)
Threat Potential cause of harm to an asset e.g., hacker, malware, fire
 Vulnerability Weakness that can be exploited e.g., unpatched software
Risk Probability × Impact of a threat exploiting Risk = Threat × Vulnerability
a vulnerability
Attack Deliberate action to cause harm Active or Passive
Countermeasure Action taken to reduce risk Firewall, encryption, patching

Risk = Probability of Threat × Impact (Vulnerability)

Used in risk assessment models like CRAMM and OCTAVE

1.3 Types of Attacks

Passive Attacks
The attacker monitors/eavesdrops on communication WITHOUT modifying data.
• — Studying communication patterns to infer info
• — Intercepting data in transit (e.g., packet sniffing)

Active Attacks
The attacker modifies, replaces, or disrupts data/communication.
• — Pretending to be an authorized user
• — Resending captured data to gain unauthorized access
• — Altering message content
• — Flooding a system to make it unavailable

💡 TIP
Passive = Read only (hard to detect). Active = Modify/Disrupt (easier to detect, harder to prevent).

1.4 Security Services (X.800 Standard)

• — Verifying identity of communicating parties
• — Preventing unauthorized use of resources
• — Protection of data from unauthorized disclosure
• — Assurance that data has not been altered
• — Sender/receiver cannot deny sending/receiving a message
• — Systems remain accessible as required

📝 PYQ [5 Marks]: Define Information Security. Explain the CIA triad with examples.

📝 PYQ [4 Marks]: Differentiate between active and passive attacks with examples.

📝 PYQ [6 Marks]: What are the security services defined by X.800? Explain each briefly.
 UNIT 2
System Security

2. System Security
2.1 Introduction to System Security
System Security refers to the protection of computing systems (hardware, software, and data) from
theft, damage, disruption, or unauthorized access. It is the foundation of building secure applications
and networks.

2.2 Types of Security Threats

Malware (Malicious Software)
Malware Type How it Works Key Feature
Virus Attaches to host programs; spreads when Needs user action to spread
executed
Worm Self-replicating; spreads via networks No host needed; spreads fast
autonomously
Trojan Horse Disguised as legitimate software; opens Does not self-replicate
backdoor
Spyware Collects user info without consent Secretly monitors activity
Ransomware Encrypts files; demands ransom for Uses encryption as weapon
decryption key
Rootkit Hides malware presence; modifies OS Very hard to detect
Adware Displays unwanted advertisements Often bundled with free
software
Keylogger Records keystrokes to capture Used for credential theft
passwords/data

🎯 MUST KNOW
Virus vs Worm: Virus needs a HOST + USER ACTION. Worm is SELF-REPLICATING and spreads
automatically. This distinction appears in almost every exam!

Intrusion Types
• — Unauthorized user using another's account
• — Authorized user misusing privileges
• — User with supervisory access, bypasses audit controls
2.3 Intruders and Intrusion Detection
Intrusion Detection Systems (IDS)
IDS monitors network/system activities to detect malicious activities or policy violations.

IDS Type How it Works Pros & Cons

Signature-based (Misuse Compares activity against known attack Fast, accurate for known
Detection) patterns/signatures threats; fails on new attacks
Anomaly-based (Behavior Detects deviations from established Detects new attacks; high
Detection) 'normal' baseline behavior false-positive rate
Stateful Protocol Analysis Tracks protocol state and detects Thorough; resource intensive
deviations from RFC specs
HIDS (Host-based IDS) Monitors a single host system for Detailed host data; limited
suspicious activity network visibility
NIDS (Network-based Monitors network traffic across an Broad coverage; can't see
IDS) entire subnet encrypted traffic

💡 TIP
IDS = Detects and ALERTS. IPS (Intrusion Prevention System) = Detects and BLOCKS. IPS is IDS +
prevention capability.

2.4 Firewalls
A firewall is a network security device (hardware or software) that monitors and controls incoming and
outgoing network traffic based on predetermined security rules.

Types of Firewalls
Type OSI Layer Key Characteristics
Packet Filtering Firewall Network (Layer 3) Inspects packets based on IP/port/protocol;
stateless; fast but limited
Stateful Inspection Firewall Transport (Layer 4) Tracks connection state; more intelligent than
packet filtering
Application-Level Gateway Application (Layer Deep inspection; acts as proxy; slow but most
(Proxy) 7) secure
Circuit-Level Gateway Session (Layer 5) Validates TCP handshakes; doesn't inspect
content
Next-Generation Firewall All layers Combines IDS/IPS, DPI, SSL inspection;
(NGFW) modern standard

Firewall Topologies
• — Firewall + bastion host; single-homed or dual-homed
• — Isolates public-facing servers in demilitarized zone; most common
• — Computer with 2 NICs: one to internet, one to LAN
 📝 PYQ [6 Marks]: Explain different types of firewalls with their working. Which is most secure and
why?

📝 PYQ [5 Marks]: What is an Intrusion Detection System? Differentiate signature-based and

anomaly-based IDS.

📝 PYQ [4 Marks]: Differentiate between virus, worm, and Trojan horse.

UNIT 3
Basic Arithmetics in Encryption

3. Basic Arithmetics in Encryption

Modern cryptography is built on mathematical foundations. Understanding these helps in understanding
why encryption algorithms are secure.

3.1 Modular Arithmetic

Modular arithmetic is arithmetic performed on remainders after division. It is the cornerstone of almost
all cryptographic algorithms.

a mod n = r (where 0 ≤ r < n)

Example: 17 mod 5 = 2, because 17 = 3×5 + 2

Key Properties
• (a + b) mod n = ((a mod n) + (b mod n)) mod n
• (a × b) mod n = ((a mod n) × (b mod n)) mod n
• (a - b) mod n = ((a mod n) - (b mod n) + n) mod n

💡 TIP
Mod arithmetic 'wraps around' like a clock. The clock uses mod 12: 10 + 5 = 3 (not 15), because
(10+5) mod 12 = 3.

3.2 Greatest Common Divisor (GCD) and Euler's Theorem

GCD
GCD(a, b) = GCD(b, a mod b) — Euclidean Algorithm
GCD(48, 18) → GCD(18, 12) → GCD(12, 6) → GCD(6, 0) = 6
Co-prime Numbers
Two numbers are co-prime (relatively prime) if their GCD = 1. This is critical for RSA key generation.
GCD(p, q) = 1 ⟹ p and q are co-prime

Euler's Totient Function φ(n)

φ(n) counts the number of positive integers ≤ n that are co-prime to n.
φ(p) = p - 1 (if p is prime)
Example: φ(7) = 6 (1,2,3,4,5,6 are all co-prime with 7)
φ(p×q) = (p-1)(q-1) (if p, q are distinct primes)
Example: φ(21) = φ(3×7) = (3-1)(7-1) = 2×6 = 12

3.3 Fermat's Little Theorem

a^p ≡ a (mod p) — if p is prime
Equivalently: a^(p-1) ≡ 1 (mod p) if GCD(a,p) = 1

Used in RSA for efficient modular exponentiation and primality testing.

3.4 Euler's Theorem

a^φ(n) ≡ 1 (mod n) — if GCD(a,n) = 1
Generalization of Fermat's theorem; foundation of RSA decryption

3.5 Modular Inverse

The modular inverse of a (mod n) is a number x such that:
a × x ≡ 1 (mod n)
Exists only if GCD(a, n) = 1. Used in RSA decryption key computation.

Extended Euclidean Algorithm

Used to compute the modular inverse. If GCD(a, n) = 1, then:
ax + ny = 1 → x is the inverse of a mod n

3.6 Prime Numbers and Primality Testing

• A prime number has exactly 2 factors: 1 and itself.
• — RSA, Diffie-Hellman, ElGamal all rely on large primes being hard to factor
• — Probabilistic primality test used in practice
• — Simple but impractical for large numbers
Worked Example — RSA Key Generation Setup
Step-by-Step RSA Arithmetic Example
Let p = 3, q = 11
n = p × q = 3 × 11 = 33
φ(n) = (p-1)(q-1) = 2 × 10 = 20
Choose e: GCD(e, 20) = 1 → e = 3
Find d: d × e ≡ 1 (mod 20) → 7 × 3 = 21 ≡ 1 (mod 20) → d = 7
Public Key: (e=3, n=33) | Private Key: (d=7, n=33)

📝 PYQ [5 Marks]: Explain modular arithmetic with properties and examples relevant to cryptography.

📝 PYQ [6 Marks]: State Euler's theorem and Fermat's little theorem. How are they used in RSA?

📝 PYQ [4 Marks]: Using extended Euclidean algorithm, find the inverse of 3 mod 11.

UNIT 4
Symmetric Encryption Algorithm

4. Symmetric Encryption
4.1 Overview of Symmetric Encryption
In symmetric (secret-key) encryption, the SAME key is used for both encryption and decryption. Both
sender and receiver must share this secret key securely before communication begins.

🎯 KEY CONCEPT
Symmetric = SAME key for encryption AND decryption. The key distribution problem: How do you
securely share the key? — This is why asymmetric crypto was invented!

Aspect Details Example

Key Usage Same key for encrypt + decrypt AES-128 with key '0x2b7e...'
Speed Very fast (hardware optimized) AES: billions of bytes/sec
Key Size Smaller keys needed (128-256 bits) AES-128 is considered secure
Key Distribution Biggest challenge — must share key Out-of-band key exchange
securely needed
Scalability n users need n(n-1)/2 keys 10 users need 45 keys
4.2 Classical Symmetric Ciphers
Substitution Ciphers
• — Shifts each letter by fixed number. E(x) = (x + k) mod 26
◦ Example: k=3 → A→D, B→E, Z→C
◦ Weakness: Only 25 possible keys → brute-force trivial
• — Each letter mapped to unique different letter (26! possible keys)
◦ Still vulnerable to frequency analysis
• — Encrypts pairs of letters (digrams) using 5×5 key matrix
• — Polyalphabetic; uses keyword to apply multiple Caesar ciphers
◦ C_i = (P_i + K_i) mod 26 → harder to break with frequency analysis

Transposition Ciphers
• — Characters written diagonally in rows, read row by row
• — Message written in rows, columns reordered by key word

Caesar: C = (P + K) mod 26 Decrypt: P = (C - K + 26) mod 26

K=3: 'HELLO' → 'KHOOR' | Decrypt: 'KHOOR' → 'HELLO'

4.3 Data Encryption Standard (DES)

DES is a symmetric block cipher developed by IBM, standardized by NIST in 1977. It was the dominant
encryption standard for two decades.

Parameter Value Notes

Block Size 64 bits Processes 64 bits at a time
Key Size 56 bits (64 bits with Only 56 bits are used for encryption
parity)
Number of Rounds 16 Each round uses a different 48-bit subkey
Structure Feistel Network Block split into L and R halves; 16 rounds
Security Status BROKEN (1998) EFF's Deep Crack broke it in 22 hours

DES Algorithm Steps

• Initial Permutation (IP) — Rearranges 64 bits using fixed table
• 16 Rounds of Feistel — Each round: R(i) = L(i-1) XOR f(R(i-1), K(i))
• 32-bit swap — L and R halves are exchanged after round 16
• Inverse Initial Permutation (IP⁻¹) — Final permutation to get ciphertext

Feistel Round: L(i) = R(i-1) R(i) = L(i-1) XOR f(R(i-1), K(i))

⚠️IMPORTANT
DES is NO LONGER SECURE. Its 56-bit key can be brute-forced. Triple DES (3DES) was introduced
as a stopgap but is also being phased out. AES is the current standard.
Triple DES (3DES)
• Uses 3 DES operations: Encrypt-Decrypt-Encrypt (EDE) with 2 or 3 keys
C = E(K3, D(K2, E(K1, P)))
EDE with 3 independent keys: effective key length = 112 bits

4.4 Advanced Encryption Standard (AES)

AES (Rijndael) replaced DES in 2001. It is the current U.S. federal standard and is widely used globally
for everything from disk encryption to TLS.

Parameter AES-128 AES-192 / AES-256

Block Size 128 bits 128 bits (same for all)
Key Size 128 bits 192 bits / 256 bits
Rounds 10 12 / 14
State Size 4×4 byte matrix 4×4 byte matrix
Security Very Secure Extremely Secure

AES Round Operations (Each Round has 4 steps)

• — Non-linear substitution using S-box lookup table (adds confusion)
• — Rows of state matrix are cyclically shifted left by 0,1,2,3 positions
• — Each column multiplied by fixed polynomial in GF(2^8) (adds diffusion)
• — XOR state with round key (derived via key schedule)

Note: Final round skips MixColumns step.

💡 TIP
AES memory trick: 'SSMA' — SubBytes, ShiftRows, MixColumns, AddRoundKey. Last round: 'SSA'
(no MixColumns)

4.5 Block Cipher Modes of Operation

Mode Full Name Key Feature & Use Case
ECB Electronic Code Book Each block encrypted independently; same plaintext →
same ciphertext; INSECURE for patterns
CBC Cipher Block Chaining XOR with previous ciphertext block; IV needed; most
common classic mode
CFB Cipher Feedback Converts block cipher to stream cipher; errors
propagate
OFB Output Feedback Keystream generated independently; bit errors don't
propagate
CTR Counter Mode Uses counter value as input; parallelizable; good for
 random access
GCM Galois/Counter Mode CTR + authentication; provides encryption AND
integrity; used in TLS

CBC: C(i) = E(K, P(i) XOR C(i-1)) C(0) = IV (Initialization

Vector)

4.6 Stream Ciphers

Stream ciphers encrypt one bit/byte at a time using a pseudo-random keystream XORed with plaintext.
• — Variable key-size stream cipher; used in WEP, SSL (deprecated due to vulnerabilities)
• — Modern secure stream ciphers; used in TLS 1.3, WireGuard VPN
C = P XOR Keystream P = C XOR Keystream
XOR is its own inverse — same operation for encrypt and decrypt

📝 PYQ [7 Marks]: Explain DES algorithm in detail. What are its weaknesses?

📝 PYQ [7 Marks]: Describe AES encryption. Explain all four operations performed in each round.

📝 PYQ [6 Marks]: What are block cipher modes of operation? Compare ECB, CBC, and CTR
modes.

📝 PYQ [4 Marks]: How does Triple-DES improve over DES? Write its encryption formula.

UNIT 5
Asymmetric Key Encryption

5. Asymmetric Key Encryption (Public Key Cryptography)

5.1 Concept and Overview
Asymmetric cryptography uses a mathematically linked KEY PAIR: a Public Key (shared openly) and a
Private Key (kept secret). Data encrypted with the public key can ONLY be decrypted with the
corresponding private key, and vice versa.

Aspect Symmetric Asymmetric

Keys Same key (shared secret) Key pair (public + private)
Speed Very Fast Much Slower (100-1000x)
Key Distribution Problematic (secure channel Easy (public key can be shared
needed) openly)
Key Size 128-256 bits (AES) 2048-4096 bits (RSA)
 Use Case Bulk data encryption Key exchange, digital signatures,
small data
Examples AES, DES, 3DES, ChaCha20 RSA, ECC, ElGamal, DSA

🎯 REAL-WORLD USAGE
In PRACTICE: Asymmetric crypto is used to securely exchange a symmetric key, then symmetric
crypto encrypts the actual data. This 'hybrid' approach gives best of both worlds. Used in HTTPS/TLS!

5.2 RSA Algorithm

RSA (Rivest–Shamir–Adleman, 1977) is the most widely used public-key cryptosystem. Its security
relies on the computational difficulty of factoring large numbers.

RSA Key Generation — Full Steps

RSA Key Generation Algorithm

1. Select two large distinct prime numbers p and q
2. Compute n = p × q (n is the modulus)
3. Compute φ(n) = (p-1) × (q-1) (Euler's totient)
4. Choose e: 1 < e < φ(n) and GCD(e, φ(n)) = 1 (public exponent)
5. Compute d: d × e ≡ 1 (mod φ(n)) (private exponent, via extended
Euclidean)
Public Key = {e, n} → Share openly
Private Key = {d, n} → Keep secret!

Encryption: C = M^e mod n Decryption: M = C^d mod n

Full Worked RSA Example

Worked Example: p=5, q=11, M=9
n = 5 × 11 = 55
φ(55) = (5-1)(11-1) = 4 × 10 = 40
e = 7 (since GCD(7,40) = 1) ✓
d = 23 (since 7 × 23 = 161 = 4×40 + 1 ≡ 1 mod 40) ✓
Public Key = {7, 55}, Private Key = {23, 55}
Encrypt: C = 9^7 mod 55 = 4782969 mod 55 = 14
Decrypt: M = 14^23 mod 55 = 9 ✓ (original message recovered!)

5.3 Diffie-Hellman Key Exchange

Diffie-Hellman (DH) allows two parties to establish a SHARED SECRET over an insecure channel
without ever transmitting the secret. It is a key agreement protocol, NOT an encryption algorithm.
DH Algorithm Steps

Diffie-Hellman Key Exchange Protocol

PUBLIC: Agree on prime p and primitive root g (both known to everyone)
Alice: picks private a → computes A = g^a mod p → sends A to Bob
Bob: picks private b → computes B = g^b mod p → sends B to Alice
Alice computes shared key: K = B^a mod p = g^(ab) mod p
Bob computes shared key: K = A^b mod p = g^(ba) mod p = SAME K! ✓

💡 TIP
DH Security: An eavesdropper sees p, g, A=g^a, B=g^b but computing g^(ab) from these requires
solving the Discrete Logarithm Problem — computationally infeasible for large p.

DH Vulnerability: Man-in-the-Middle (MITM) Attack

DH is vulnerable to MITM if the parties don't authenticate each other. An attacker can intercept and
substitute their own values. Solution: Use authenticated DH (e.g., with certificates/signatures).

5.4 ElGamal Encryption

ElGamal is based on DH. It provides both encryption and digital signatures.
• — Public key = (p, g, y = g^x mod p), Private key = x
• — Choose random k; C1 = g^k mod p; C2 = M × y^k mod p; Send (C1, C2)
• — M = C2 × (C1^x)^(-1) mod p
• — Based on Discrete Logarithm Problem

5.5 Elliptic Curve Cryptography (ECC)

ECC uses the mathematics of elliptic curves over finite fields. It achieves equivalent security to RSA
with much SHORTER key sizes.
Security Level RSA Key Size ECC Key Size
80-bit security 1024 bits 160 bits
112-bit security 2048 bits 224 bits
128-bit security 3072 bits 256 bits
256-bit security 15360 bits 512 bits

💡 TIP
ECC offers SAME security as RSA with ~6x shorter keys → faster, less power consumption. Used
extensively in mobile devices and TLS 1.3.

5.6 Digital Signatures

Digital signatures provide Authentication, Integrity, and Non-repudiation using asymmetric
cryptography.
How RSA Digital Signature Works
• — Sender hashes message → encrypts hash with PRIVATE key → signature
• — Receiver decrypts signature with SENDER'S PUBLIC key → compare with hash of received
message
Sign: S = Hash(M)^d mod n Verify: Hash(M) == S^e mod n

⚠️COMMON EXAM CONFUSION

Digital signature uses PRIVATE key to SIGN and PUBLIC key to VERIFY — opposite of encryption!
Encryption uses PUBLIC to encrypt, PRIVATE to decrypt.

DSA — Digital Signature Algorithm

A NIST standard for digital signatures based on the Discrete Logarithm Problem. DSA can only SIGN; it
cannot encrypt. It's specifically designed for signing documents.

5.7 Hash Functions in Cryptography

Cryptographic hash functions take any input and produce a fixed-size digest. They are one-way
(irreversible) functions.
Hash Function Output Size Status / Use
MD5 128 bits BROKEN — collision attacks found; avoid for
security
SHA-1 160 bits WEAK — deprecated; SHAttered collision attack
(2017)
SHA-256 256 bits SECURE — part of SHA-2 family; widely used in
TLS, Bitcoin
SHA-512 512 bits VERY SECURE — stronger variant of SHA-2
SHA-3 (Keccak) 224-512 bits CURRENT STANDARD — based on sponge
construction

📝 PYQ [10 Marks]: Explain RSA algorithm with key generation, encryption and decryption with a
numerical example.

📝 PYQ [6 Marks]: Describe Diffie-Hellman key exchange. What is its vulnerability?

📝 PYQ [5 Marks]: What is a digital signature? How does RSA-based digital signature work?

📝 PYQ [5 Marks]: Compare RSA and ECC in terms of key size, security, and applications.

UNIT 6
Operating System Security
6. Operating System Security
6.1 Introduction to OS Security
Operating System security refers to measures and processes implemented to protect the OS from
threats, vulnerabilities, and attacks. The OS is the foundation of all software — if it is compromised,
everything running on it is at risk.

6.2 OS Security Goals

• — Processes must not interfere with each other's data or execution
• — OS controls all access to hardware and resources
• — OS kernel and data must not be tampered with
• — One user cannot read another user's private data
• — OS services must be accessible and not susceptible to DoS

6.3 Access Control

Access control determines WHAT resources an authenticated user can access and what
OPERATIONS they can perform.

Access Control Models

Model How it Works Best For
DAC — Discretionary Resource owner grants/revokes Commercial systems,
Access Control permissions at their discretion. Used in general OS
most OS (Unix file permissions)
MAC — Mandatory Access System enforces policy based on Military, government, high-
Control security labels (classification levels). security systems
Users cannot override policy
RBAC — Role-Based Permissions assigned to ROLES, users Enterprise systems,
Access Control assigned to roles. Principle of least databases, web apps
privilege
ABAC — Attribute-Based Access based on attributes of user, Cloud systems, fine-grained
Access Control resource, and environment control

Access Control Matrix

A theoretical model representing all permissions: rows = subjects (users), columns = objects
(files/resources), cells = permitted operations.

Subject / Object File A File B Printer

Alice Read, Write Read Print
Bob Read Read, Write —
6.4 Buffer Overflow Attacks
A buffer overflow occurs when a program writes more data to a buffer (memory area) than it can hold,
overwriting adjacent memory. This is one of the oldest and most dangerous vulnerabilities.

How Buffer Overflow Works

• — Program allocates a fixed-size buffer (e.g., 100 bytes) on the stack
• — Attacker provides input larger than the buffer (e.g., 200 bytes)
• — Overflow overwrites the return address on the stack
• — Return address is changed to point to attacker's malicious code
• — When function returns, CPU jumps to attacker's code (shellcode)

🎯 EXAM IMPORTANT
Buffer overflow is the #1 vulnerability type. Classic example: Morris Worm (1988) used buffer overflow
in fingerd. Modern countermeasures: Stack Canaries, ASLR, NX Bit.

Defenses Against Buffer Overflow

• — Random value placed before return address; checked on function return
• — Randomizes memory addresses making it hard to predict where to jump
• — Marks data regions as non-executable; injected code cannot run
• — Use bounds-checked functions: fgets() instead of gets(), strncpy() instead of strcpy()

6.5 Memory Protection and Virtual Memory

• — Divides memory into segments; each has base address and limit
• — Divides memory into fixed-size pages; provides isolation between processes
• — Each process has its own virtual address space; OS maps to physical memory
• — Ring 0 = kernel (full access), Ring 3 = user applications (restricted)

6.6 Authentication in Operating Systems

Password-based Authentication
Traditional OS authentication uses usernames and passwords. Passwords are NOT stored in plaintext
— they are stored as hashed values.

• — OS computes hash(password) and stores it. During login, hash(input) is compared

• — Random value appended to password before hashing; prevents rainbow table attacks
Stored Value = Hash(Password + Salt)
Example: Unix /etc/shadow stores: $6$salt$hash

Password Attack Types

Attack Type Method Defense
Brute Force Try all possible combinations Long, complex passwords; account
 lockout
Dictionary Attack Try common words from wordlist Avoid dictionary words; use
passphrases
Rainbow Table Pre-computed hash → password Salted hashes (salt destroys
table rainbow tables)
Phishing Trick user into revealing password User education; 2FA

Multi-Factor Authentication (MFA)

• — Password, PIN
• — Hardware token, smart card, OTP app
• — Fingerprint, retina, face recognition (biometrics)

💡 TIP
2FA = Two-Factor Authentication = any 2 of the above 3 factors. MFA = 2 or more factors. Always
more secure than passwords alone.

6.7 Trusted OS and Security Kernels

• — The combination of hardware, firmware, and software that is critical to security policy
enforcement
• — Core of TCB; enforces the reference monitor concept
• — Abstract machine that mediates ALL access requests; must be: always invoked, tamperproof,
verifiable
• — International standard for evaluating security of IT products (EAL 1-7 assurance levels)
• — U.S. DoD standard; security levels: D, C1, C2, B1, B2, B3, A1

6.8 Windows vs Unix/Linux Security Model

Feature Windows Security Unix/Linux Security
User Account Control UAC: runs apps as standard user; sudo: grant temporary root
prompts for elevation privileges
File Permissions ACL-based (Access Control Lists) rwx permissions: owner, group,
per user/group others
Privilege Model Token-based; SID (Security UID/GID based; root = UID 0
Identifiers)
Logging Windows Event Log; Security syslog, /var/log/*; auditd
Auditing
Hardening Tools Group Policy, Windows Defender, SELinux, AppArmor,
BitLocker iptables/nftables

📝 PYQ [6 Marks]: Explain buffer overflow attack with steps. What are the countermeasures?

📝 PYQ [6 Marks]: Compare DAC, MAC, and RBAC access control models.

📝 PYQ [5 Marks]: How are passwords stored and protected in an OS? Explain salted hashing and
rainbow table attacks.
📝 PYQ [5 Marks]: What is the Reference Monitor concept? Explain TCB and Security Kernel.
 QUICK REVISION
Key Formulas, Comparisons & Memory Tricks

7. Quick Revision Summary

7.1 Essential Formulas to Memorize
Caesar Cipher: C = (P + K) mod 26 | P = (C - K + 26) mod 26

RSA Encrypt: C = M^e mod n | Decrypt: M = C^d mod n

RSA Key: n = p×q | φ(n) = (p-1)(q-1) | d×e ≡ 1 (mod φ(n))

DH Shared Key: K = g^(ab) mod p (Alice: K=B^a mod p, Bob: K=A^b mod
p)

Feistel (DES): L(i) = R(i-1) | R(i) = L(i-1) XOR f(R(i-1), K(i))

CBC Mode: C(i) = E(K, P(i) XOR C(i-1)) | C(0) = IV

Risk = Probability of Threat × Impact (Vulnerability)

7.2 Algorithm Comparison Table

Algorithm Type Key/Block Size Security Status Based On
DES Block/ 56-bit key, 64-bit ❌ BROKEN Feistel +
Symmetric block permutation
3DES Block/ 112/168-bit key, 64- ⚠️ Triple DES (EDE)
Symmetric bit block Weak/Deprecate
d
AES Block/ 128/192/256-bit key, ✅ SECURE Substitution-
Symmetric 128-bit block Permutation
RSA Asymmetric 2048-4096 bit keys ✅ SECURE Integer factorization
(large keys)
Diffie-Hellman Key Exchange 2048+ bit primes ✅ SECURE Discrete logarithm
(large p)
ECC Asymmetric 256-521 bit keys ✅ Very Secure Elliptic curve DLP
ElGamal Asymmetric Variable ✅ SECURE Discrete logarithm
MD5 Hash 128-bit digest ❌ BROKEN Merkle-Damgard
SHA-1 Hash 160-bit digest ❌ WEAK Merkle-Damgard
SHA-256 Hash 256-bit digest ✅ SECURE Merkle-Damgard

7.3 Mnemonic Memory Tricks

🧠 MNEMONIC
CIA Triad: 'Cops Investigate Always' → Confidentiality, Integrity, Availability

🧠 MNEMONIC
AES Rounds: 'SSMA' → SubBytes, ShiftRows, MixColumns, AddRoundKey. Last round: drop
MixColumns → 'SSA'

🧠 MNEMONIC
RSA steps: 'Pick-n-Phi-E-D' → Pick primes, compute n, compute φ(n), choose e, derive d

🧠 MNEMONIC
Access control: 'DMR' → DAC=Discretionary(owner decides), MAC=Mandatory(policy decides),
RBAC=Role(role decides)

🧠 MNEMONIC
Attack types: 'PASS = Read-only, ACTIVE = Modify/Break'. Passive is hard to DETECT. Active is hard
to PREVENT.

7.4 Common Exam Mistakes to Avoid

❌ MISTAKE #1
1. DES uses 56-bit KEY (not 64-bit). Total is 64 bits including 8 parity bits.

❌ MISTAKE #2
2. In digital signatures: SIGN with PRIVATE key, VERIFY with PUBLIC key. (Opposite of encryption!)

❌ MISTAKE #3
3. Diffie-Hellman is for KEY EXCHANGE only — it is NOT an encryption algorithm.

❌ MISTAKE #4
4. Passive attacks violate CONFIDENTIALITY. Active attacks violate INTEGRITY and AVAILABILITY.

❌ MISTAKE #5
5. AES final round has only 3 steps (no MixColumns). All other rounds have 4 steps.
7.5 Top PYQ Topics (High Frequency)
Topic Frequency Typical Marks
RSA Algorithm (key gen + numerical) ★★★★★ 7-10
DES Algorithm and Feistel Structure ★★★★★ 7
AES Round Operations ★★★★ 7
CIA Triad ★★★★ 5
Buffer Overflow Attack & Defenses ★★★★ 5-6
Diffie-Hellman Key Exchange ★★★★ 5-6
Types of Firewalls ★★★ 5-6
Digital Signatures ★★★ 5
Access Control Models (DAC/MAC/RBAC) ★★★ 5-6
Active vs Passive Attacks ★★★ 4
Hash Functions (MD5, SHA) ★★★ 4
Block Cipher Modes (ECB, CBC, CTR) ★★★ 5-6

Best of Luck on Your Exam! 🎓

Essentials of Network Security — Complete Study Notes