Lecture Notes on- Network Security (L: T: P:: 3:0:4)

Prepared by: RAKESH. K

Department: Computer Science

Syllabus: III BCA- V Semester- SEP

Course Content Hours

Fundamentals of Network Security - Introduction to Information Security: CIA
triad (Confidentiality, Integrity, Availability), Threats and Attacks: Malware,
phishing, denial of service, man-in-the-middle, Security Services: Authentication,
Unit 1
authorization, non-repudiation, Cryptography Basics: Symmetric vs. asymmetric
11
encryption, hashing, digital signatures, Overview of Security Policies and
Standards (ISO/IEC 27001, NIST).
Cryptography and Secure Communication - Symmetric Key Algorithms: DES,
AES, Asymmetric Key Algorithms: RSA, Diffie-Hellman key exchange, Hash
Unit 2 Functions: MD5, SHA family, Public Key Infrastructure (PKI) and Certificates, 11
Secure Communication Protocols: SSL/TLS, HTTPS, IPSec, VPNs, Email Security:
PGP, S/MIME.
Network Security Tools and Mechanisms - Firewalls: Types (packet filtering,
proxy, stateful inspection), configuration basics, Intrusion Detection and
Unit 3 Prevention Systems (IDS/IPS), Virtual Private Networks (VPNs) and tunneling 11
protocols, Wireless Security: WEP, WPA, WPA2, WPA3, Security in Cloud and IoT
environments, Case Studies: Real-world breaches and lessons learned.
Advanced Topics and Management - Security in Operating Systems and
Applications, Incident Response and Disaster Recovery Planning, Security
Auditing and Vulnerability Assessment, Ethical Hacking and Penetration Testing
Unit 4
basics, Emerging Trends: Zero Trust Architecture, AI in Security, Blockchain for
11
Security, Legal and Ethical Issues: Cyber laws in India, IT Act 2000, GDPR basics.
 UNIT 1

FUNDAMENTALS OF NETWORK SECURITY

SECTION 1: Introduction to Information Security

1.1 The CIA Triad

The CIA Triad is the foundational model of information security. It defines three core properties that
every secure system must maintain. Think of it as the three legs of a stool — remove any one and the
whole structure collapses.

THE CIA TRIAD — Core Pillars of Information Security

🔒 CONFIDENTIALITY ✔ INTEGRITY ⚡ AVAILABILITY

Definition: Ensuring Definition: Ensuring Definition: Ensuring
information is accessible only data is accurate, systems and data are
to those authorized. complete, and unaltered. accessible when needed.
Goal: Prevent unauthorized Goal: Prevent Goal: Prevent denial of
disclosure. unauthorized authorized access.
modification.
Mechanisms: Mechanisms: Mechanisms:
• Encryption • Hashing (SHA-256) • Redundancy /
• Access Controls • Digital Signatures Failover
• Data Masking • Checksums • Load Balancing
• Backups / DR Plans

Example: Encrypting a Example: A bank using Example: Using server

medical database so only checksums to verify a clusters so an e-commerce
doctors can read patient wire transfer amount was site stays online even if
records. not tampered with. one server fails.
Threat: Data breach, Threat: Man-in-the- Threat: Denial of Service
eavesdropping, sniffing. middle attacks, data (DoS), ransomware,
corruption. hardware failure.

CIA Triad — Visual Representation

CIA TRIAD TRIANGLE

INTEGRITY
2
Page

/\

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 / \
/ \
/ CIA \
/ TRIAD \
/___________\
CONFIDENTIALITY AVAILABILITY

All three properties must coexist — weakness in one compromises overall

security.

SECTION 2: Threats and Attacks

A threat is a potential cause of an unwanted incident. An attack is a deliberate action to exploit a

vulnerability. Understanding both is essential to building effective defenses.

Attack What It Is Real-World Example

Type
Malware Malicious software designed to disrupt, WannaCry ransomware (2017)
damage, or gain unauthorized access to a encrypted files of 200,000+
system. computers worldwide.
Phishing A social engineering attack that tricks Attacker sends email posing as
users into revealing credentials or a bank asking users to 'verify'
installing malware via deceptive their password.
emails/websites.
Denial of Flooding a server or network with Mirai botnet (2016) DDoS
Service excessive requests to make it unavailable attack took down major
to legitimate users. websites including Twitter and
Netflix.
Man-in- An attacker secretly intercepts and Attacker intercepts HTTPS
the-Middle potentially alters communications traffic on a public Wi-Fi
between two parties. network to steal login cookies.

2.1 Malware (Malicious Software)

Malware is an umbrella term for any software designed to harm or exploit systems without the
owner's consent.
Type Description Example
Virus Self-replicating code that attaches to legitimate ILOVEYOU virus
programs and executes when the host runs. (2000)
3
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Worm Self-propagating malware that spreads across Morris Worm
networks without needing a host program. (1988)
Trojan Disguised as legitimate software; grants backdoor Zeus banking
Horse access once installed. trojan
Ransomware Encrypts victim's files and demands payment WannaCry,
(ransom) for the decryption key. LockBit
Spyware Secretly monitors user activity and sends data to a Pegasus spyware
remote attacker.
Rootkit Hides malware at the OS/firmware level to avoid Sony BMG rootkit
detection. scandal
Keylogger Records keystrokes to capture passwords and Olympic Vision
sensitive information. keylogger

2.2 Phishing Attacks

Phishing exploits human psychology (social engineering) rather than technical vulnerabilities. The
attacker masquerades as a trustworthy entity to steal credentials, install malware, or commit fraud.

Phishing Attack Flow Diagram

PHISHING ATTACK LIFECYCLE

[Attacker] ──crafts──> [Fake Email / Website]
|
v
[Victim receives email: "Your account is at risk!"]
|
v
[Victim clicks malicious link]
|
v
[Fake login page captures credentials]
|
v
[Credentials sent to Attacker's server]
|
v
[Attacker logs in to real account] <== Account Takeover

Variants: Spear Phishing (targeted), Whaling (executives), Vishing (voice),

Smishing (SMS)
4
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 2.3 Denial of Service (DoS) and Distributed DoS (DDoS)
DoS: A single source overwhelms a server with traffic. DDoS: The attack is distributed across
thousands of compromised machines (a botnet), making it harder to block.

DDoS Attack Architecture Diagram

DDoS ATTACK ARCHITECTURE

[Attacker / Command & Control]
|
+---------------+---------------+
| | |
[Bot/Zombie1] [Bot/Zombie2] [Bot/Zombie3] ... thousands
| | |
+-------+-------+-------+-------+
| |
Flood of requests |
| |
v v
[TARGET SERVER] <====== OVERWHELMED
(Service Down — Legitimate users cannot connect)

2.4 Man-in-the-Middle (MitM) Attack

MitM: The attacker secretly positions themselves between the client and the server, reading and
potentially modifying all communications. Neither party is aware of the interception.

MitM Attack Flow Diagram

MAN-IN-THE-MIDDLE ATTACK
WITHOUT ATTACK (Normal):
[Client] <=========================> [Server]
Encrypted communication

WITH MitM ATTACK:

[Client] <-----> [ATTACKER] <-----> [Server]
reads/ intercepts reads/
modifies modifies
traffic traffic

Attack vectors: ARP Spoofing, DNS Spoofing, Rogue Wi-Fi AP

Defense: TLS/SSL, Certificate Pinning, HSTS, VPNs
5
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 SECTION 3: Security Services

Security services are mechanisms that protect against threats and enforce security policies. The three
primary services are Authentication, Authorization, and Non-Repudiation.

🔑 AUTHENTICATION 🛡 AUTHORIZATION 📝 NON-REPUDIATION

Who are you? What can you do? Can you deny it?

3.1 Authentication
Authentication is the process of verifying the identity of a user, device, or system. It answers the
question: "Are you who you claim to be?"

Authentication Factors
Factor Category Description Example
1st Something you Knowledge-based Password, PIN, security question
Factor KNOW credentials.
2nd Something you Physical token or OTP app (Google Auth), smart
Factor HAVE device. card, hardware key
3rd Something you Biometric Fingerprint, retina scan, face
Factor ARE characteristics. recognition
4th Somewhere you Location-based Geo-fencing, IP address allowlist
Factor ARE verification.

Multi-Factor Authentication (MFA) combines 2 or more factors. Example:

📌 MFA ATM requires both a card (have) and a PIN (know). This significantly
reduces the risk of account compromise even if one factor is stolen.

3.2 Authorization
Authorization determines what an authenticated user is permitted to do. It follows authentication and
enforces access control policies.

Authorization Models
Model Description Example
DAC — Resource owner sets Linux file permissions: owner
Discretionary Access permissions. grants read/write to others.
Control
MAC — Mandatory System enforces rules based Military classified document
6

Access Control on labels (Top Secret, systems.

Page

Confidential).

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

RBAC — Role-Based Permissions assigned to HR staff can access payroll;
Access Control roles, users assigned to roles. developers can access code repos.
ABAC — Attribute- Access based on attributes of Allow access only if
Based Access Control user, resource, and [Link] = Finance AND
environment. time = business hours.

3.3 Non-Repudiation
Non-repudiation ensures that a party cannot deny having performed an action. It provides proof of
origin, delivery, and integrity — critical in legal, financial, and compliance contexts.
How it works: Digital signatures, audit logs, and timestamping create cryptographic proof that an
action occurred and who performed it.
Real-World Example: When you sign a digital contract with DocuSign, your signature is tied to your
email, IP address, and a cryptographic certificate. You cannot later deny signing it.
Authentication vs. Authorization vs. Non-Repudiation: Think of it like a hotel — Authentication is
showing your ID at check-in, Authorization is the keycard only opening your room, and Non-
Repudiation is the hotel log showing you unlocked room 204 at 9:42 PM.

SECTION 4: Cryptography Basics

Cryptography is the science of securing information by transforming it into an unreadable format

(ciphertext) that only authorized parties can decode. It is the mathematical backbone of all modern
security.

4.1 Symmetric vs. Asymmetric Encryption

Symmetric Encryption (Secret Key Cryptography)
Both the sender and receiver use the same single key to encrypt and decrypt data. It is fast and
efficient but has a key distribution problem: how do you securely share the key?

SYMMETRIC ENCRYPTION FLOW

SENDER RECEIVER

────────────────────────────────────────────────
[Plaintext] [Plaintext]
| ^
| Encrypt with | Decrypt with
| SECRET KEY [K] | SECRET KEY [K]
v |
[Ciphertext] ─── Network/Channel ──> [Ciphertext]
7
Page

Same key [K] used for both encryption and decryption

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 Key must be securely shared in advance (key distribution problem)

Algorithm Key Size Use Case Status

AES 128/192/256- File encryption, TLS sessions, disk ✅ Current
bit encryption Standard
DES 56-bit Legacy systems (now deprecated) ❌ Insecure
(broken)
3DES 112/168-bit Financial systems (being phased out) ⚠️ Legacy
ChaCha20 256-bit Mobile devices, TLS 1.3 ✅ Modern/Fast

Asymmetric Encryption (Public Key Cryptography)

Uses a key pair: a Public Key (shared freely) and a Private Key (kept secret). Data encrypted with
the public key can only be decrypted with the matching private key. Solves the key distribution
problem.

ASYMMETRIC ENCRYPTION FLOW

SENDER (Alice) RECEIVER (Bob)

────────────────────────────────────────────────────
[Plaintext] [Plaintext]
| ^
| Encrypt with | Decrypt with
| BOB'S PUBLIC KEY | BOB'S PRIVATE KEY
v |
[Ciphertext] ──── Network ──────────> [Ciphertext]

Bob's Public Key: freely distributed (anyone can encrypt)

Bob's Private Key: secret (only Bob can decrypt)

Common Algorithms: RSA, ECC (Elliptic Curve), Diffie-Hellman

Symmetric vs. Asymmetric — Side-by-Side Comparison

Property Symmetric Asymmetric
Number of 1 (shared secret) 2 (public + private key pair)
Keys
8

Speed Fast (hardware-optimized) Slow (computationally expensive)

Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Key Problematic (must share Easy (public key is freely shared)
Distribution securely)
Key Size Smaller (128–256 bits for Larger (2048–4096 bits for RSA)
AES)
Use Case Bulk data encryption, disk Key exchange, digital signatures, TLS
encryption handshake
Examples AES, ChaCha20, 3DES RSA, ECC, DSA, Diffie-Hellman
Scalability Poor (n users need n(n-1)/2 Good (each user has just one key pair)
keys)

4.2 Hashing
Hashing converts input data of any size into a fixed-length string (hash/digest). It is a one-way
function — you cannot reverse-engineer the original data from the hash. Identical inputs always
produce identical outputs.

Properties of a Cryptographic Hash Function

Property Meaning
Deterministic Same input always produces the same hash.
Pre-image Cannot compute the input from the hash (one-way).
Resistance
Avalanche Effect A tiny change in input drastically changes the hash output.
Collision Resistance Computationally infeasible to find two different inputs with the
same hash.
Fixed Output Size SHA-256 always outputs 256 bits regardless of input size.

Input: "hello" → SHA-256 →

📌 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824
Example Input: "Hello" → SHA-256 → 185f8db32921bd46d35e52b37df3d11a...
(completely different hash!)

Common Hash Algorithms

Algorithm Output Size Status Use Case
MD5 128 bits ❌ Broken (collisions found) Legacy file checksums only
SHA-1 160 bits ❌ Deprecated Phased out of TLS/SSL

✅ Secure (Current)
9

SHA-256 256 bits TLS, Bitcoin, password hashing

Page

SHA-3 224–512 bits ✅ Secure (Latest) High-security applications

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

bcrypt 192 bits ✅ Secure (Slow by design) Password storage (salted)

4.3 Digital Signatures

Digital Signatures use asymmetric cryptography to provide three guarantees: authentication (who sent
it), integrity (was it changed), and non-repudiation (they cannot deny sending it).

DIGITAL SIGNATURE PROCESS

SIGNING (Sender — Alice):
[Message] → Hash Function → [Message Digest (Hash)]
|
Encrypt with ALICE'S PRIVATE KEY
|
v
[Message] + [Digital Signature] ──────────────────> Network

VERIFICATION (Receiver — Bob):

Received: [Message] + [Digital Signature]
| |
| Hash Function | Decrypt with ALICE'S PUBLIC KEY
v v
[Computed Hash] vs. [Original Hash]
| |
+──── MATCH? ──────────+
YES → Verified (authentic + unmodified)
NO → Rejected (tampered or forged)

SECTION 5: Security Policies and Standards

Security policies define the rules and procedures for maintaining information security. International
standards provide tested frameworks to guide organizations in implementing these policies effectively.

5.1 ISO/IEC 27001 — Information Security Management System (ISMS)

ISO/IEC 27001 is the world's leading international standard for information security management. It
provides a systematic approach to managing sensitive information using a risk-based framework.
Key Features Details
Published by ISO (International Organization for Standardization) & IEC
Scope Any organization, any size, any sector worldwide
10

Certification Organizations can be officially certified by accredited bodies

Core Principle Risk management — identify, assess, treat information security
Page

risks

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Annex A Controls 114 controls across 14 domains (access control, cryptography, HR
security, etc.)
Companion ISO/IEC 27002 provides implementation guidance for the controls
Standard
Review Cycle Must be continually improved; typically reviewed annually

ISO 27001 — Plan-Do-Check-Act (PDCA) Cycle

ISO 27001 — PDCA CYCLE (Continual Improvement)

┌──────────────────────────────┐
│ PLAN │
│ Define scope, risk assess, │
│ set security objectives │
└──────────┬───────────────────┘
│
┌──────────────────────┐ │
┌──────────────────────────┐
│ ACT │ │ │ DO │
│ Continual │ │ │ Implement controls, │
│ Improvement, │ │ │ training, awareness, │
│ corrective actions │ │ │ incident response plans │
└──────────────────────┘ │
└──────────────────────────┘
^ │ |
│ │ v
│ ISMS │ ┌───────────────────┐
│ Core │ │ CHECK │
└──────────────── ──────────│ Monitor, audit, │
│ review, measure │
└───────────────────┘

5.2 NIST Cybersecurity Framework (CSF)

NIST (National Institute of Standards and Technology) developed the CSF to help organizations
manage and reduce cybersecurity risk. It is widely adopted by US federal agencies and private sector
organizations globally.

NIST CSF Core Functions

Function Goal Key Activities Example
11

IDENTIFY Understand Asset management, risk Create inventory of all

assets & risks assessment, governance hardware/software assets
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

PROTECT Safeguard Access control, awareness Implement MFA, encrypt
critical services training, data security data at rest
DETECT Discover Anomaly detection, security SIEM alerts on unusual
security events monitoring, log analysis login patterns
RESPOND Act on detected Incident response planning, Execute IR plan; isolate
incidents communications, analysis infected systems
RECOVER Restore normal Recovery planning, Restore from clean backups;
operations improvements, publish post-mortem
communications

5.3 ISO 27001 vs. NIST CSF — Comparison

Attribute ISO/IEC 27001 NIST CSF
Origin International (ISO/IEC) United States (NIST)
Type Certifiable standard Voluntary framework (no certification)
Focus Formal ISMS — people, Risk management across 5 core functions
process, technology
Applicability Global — all sectors Primarily US critical infrastructure (but
widely adopted globally)
Mandate Voluntary (some sectors Mandatory for US federal agencies
require it)
Structure Requirements + 114 Annex A 5 Functions → 23 Categories → 108
controls Subcategories
Best Used Formal certification, Assessing and improving cybersecurity
For regulatory compliance posture

SECTION 6: Quick Reference Summary

Key Terms Glossary

Term Definition
CIA Triad Confidentiality, Integrity, Availability — the three core pillars of
information security.
Threat A potential cause of an unwanted incident that may harm systems
or data.
Vulnerability A weakness in a system that can be exploited by a threat.
12

Attack A deliberate action that exploits a vulnerability to compromise

security.
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Malware Malicious software designed to disrupt, damage, or gain
unauthorized access.
Phishing Social engineering attack using deceptive communications to steal
credentials.
DoS / DDoS Denial of Service / Distributed DoS — flooding targets to deny
legitimate access.
MitM Man-in-the-Middle — secret interception of communications
between two parties.
Authentication Verifying the identity of a user or system.
Authorization Determining what permissions an authenticated entity has.
Non-Repudiation Preventing a party from denying they performed an action.
Encryption Transforming plaintext into unreadable ciphertext to protect
confidentiality.
Symmetric Same key used for both encryption and decryption (e.g., AES).
Encryption
Asymmetric Key pair (public + private) used for encryption/decryption (e.g.,
Encryption RSA).
Hash Function One-way function that maps data to a fixed-length digest (e.g.,
SHA-256).
Digital Signature Cryptographic mechanism providing authentication, integrity, and
non-repudiation.
ISO/IEC 27001 International standard for Information Security Management
Systems (ISMS).
NIST CSF US framework for managing cybersecurity risk via 5 functions:
Identify, Protect, Detect, Respond, Recover.
RBAC Role-Based Access Control — permissions assigned based on user
roles.
MFA Multi-Factor Authentication — using two or more authentication
factors.

13
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 UNIT: 2
CRYPTOGRAPHY AND SECURE COMUNICATION

1. SYMMETRIC KEY ALGORITHMS

Definition
Symmetric key cryptography uses a single shared secret key for both encryption and decryption. Both
sender and receiver must securely possess the same key before communication begins.

1.1 DES (Data Encryption Standard)

• Block cipher operating on 64-bit blocks of plaintext.
• Uses a 56-bit effective key (64 bits with 8 parity bits).
• Structure: Feistel network with 16 rounds of substitution and permutation.
• Each round uses a subkey generated via the key schedule algorithm.
• Weakness: 56-bit key is vulnerable to brute-force attacks with modern hardware.
• Triple DES (3DES) applies DES three times with two/three keys to strengthen it, though it is now
considered legacy.

Plaintext(64-bit) --> [Initial Permutation]

|
+----v----+ Round 1..16 (Feistel Function + Subkey Ki)
| L | R | Li = Ri-1 ; Ri = Li-1 XOR f(Ri-1, Ki)
+----+----+
|
[Final Permutation] --> Ciphertext(64-bit)

1.2 AES (Advanced Encryption Standard)

• Block cipher operating on 128-bit blocks; replaced DES as the federal standard in 2001.
• Supports key sizes of 128, 192, or 256 bits (AES-128 / AES-192 / AES-256).
• Structure: Substitution-Permutation Network (SPN), not Feistel.
• Number of rounds depends on key size: 10 rounds (128-bit), 12 (192-bit), 14 (256-bit).
• Each round consists of: SubBytes, ShiftRows, MixColumns, AddRoundKey (MixColumns omitted
in the final round).
• Much faster and more secure than DES; no practical brute-force attack exists today.

Plaintext(128-bit) --> AddRoundKey

Repeat (Nr-1) times:
14

SubBytes -> ShiftRows -> MixColumns -> AddRoundKey

Final Round:
Page

SubBytes -> ShiftRows -> AddRoundKey

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 --> Ciphertext(128-bit)

DES vs AES — Comparison

Feature DES AES
Block Size 64 bits 128 bits
Key Size 56 bits (effective) 128 / 192 / 256 bits
Structure Feistel Network Substitution-Permutation
Network
Rounds 16 10 / 12 / 14
Security Today Broken (brute-forceable) Secure, current standard
Speed Slower in software Fast, hardware-accelerated
(AES-NI)

Example: A VPN client and server both hold the same AES-256 key; the client encrypts a
file before upload and the server decrypts it using that identical key.

Conclusion: Symmetric algorithms like AES offer fast, strong encryption for bulk data but require a
secure way to share the key beforehand — a limitation solved by asymmetric cryptography.

2. ASYMMETRIC KEY ALGORITHMS

Definition
Asymmetric (public-key) cryptography uses a mathematically linked key pair — a public key (shared
openly) and a private key (kept secret). Data encrypted with one key can only be decrypted with the
other.

2.1 RSA (Rivest–Shamir–Adleman)

• Security based on the difficulty of factoring the product of two large prime numbers.
• Key generation: choose primes p, q → compute n = p×q and φ(n) = (p-1)(q-1) → choose public
exponent e → compute private exponent d such that e·d ≡ 1 (mod φ(n)).
• Public key = (e, n); Private key = (d, n).
• Used for encryption, digital signatures, and key exchange.
• Typical key sizes: 2048 or 4096 bits for modern security.
15

🔑 Encryption: C = M^e mod n Decryption: M = C^d mod n

Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

2.2 Diffie-Hellman (DH) Key Exchange
• Allows two parties to derive a shared secret key over an insecure channel without ever transmitting
the key itself.
• Security relies on the difficulty of the discrete logarithm problem.
• Both parties agree publicly on a large prime p and base g.
• Each generates a private value, computes a public value, and exchanges it; both sides compute the
same shared secret independently.
• Vulnerable to man-in-the-middle attacks unless combined with authentication (e.g., digital
signatures).

Alice (private a) Bob (private b)

A = g^a mod p ---- A ---->
<---- B ---- B = g^b mod p
Shared Key = B^a mod p = A^b mod p = g^(ab) mod p

RSA vs Diffie-Hellman — Comparison

Feature RSA Diffie-Hellman
Primary Purpose Encryption & digital Secure key exchange only
signatures
Mathematical Basis Integer factorization Discrete logarithm problem
Output Ciphertext / signature Shared symmetric key
MITM Protection Yes (with certificates) No (needs added
authentication)

Example: TLS handshakes often use Diffie-Hellman (or ECDHE) to establish a session key,
then use RSA-signed certificates to authenticate the server.
3. HASH FUNCTIONS

Definition
A cryptographic hash function takes an input of any size and produces a fixed-size output (digest). It is a
one-way function: easy to compute forward, computationally infeasible to reverse, and any change in
input drastically changes the output (avalanche effect).

Key Properties
• Deterministic — same input always produces the same hash.
• Pre-image resistance — infeasible to recover input from the hash.
16

• Collision resistance — infeasible to find two inputs with the same hash.
Page

• Avalanche effect — a small input change drastically alters the output.

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

3.1 MD5 (Message Digest 5)
• Produces a 128-bit hash value, usually shown as a 32-character hexadecimal string.
• Once widely used for checksums and password storage.
• Now considered cryptographically broken — practical collision attacks have been demonstrated
since 2004.
• Should not be used for security purposes today, only for non-security checksums.

3.2 SHA Family (Secure Hash Algorithm)

• SHA-1: produces a 160-bit hash; deprecated after collision attacks were shown (SHAttered, 2017).
• SHA-2: family including SHA-224, SHA-256, SHA-384, SHA-512; currently the industry standard.
• SHA-3: newest standard (Keccak algorithm), based on a different internal structure (sponge
construction) for extra resilience.
• SHA-256 is the most widely used variant, e.g., in TLS certificates and blockchain (Bitcoin uses
SHA-256).

MD5 vs SHA Family — Comparison

Feature MD5 SHA-1 SHA-256
Digest Size 128 bits 160 bits 256 bits
Security Status Broken Deprecated Secure (current
standard)
Typical Use Today Non-crypto Legacy systems only TLS, blockchain,
checksums only digital signatures

Example: A software download page publishes a SHA-256 checksum so users can verify the
file was not corrupted or tampered with.

Conclusion: Hash functions underpin data integrity checks, password storage, and digital signatures;
only members of the SHA-2/SHA-3 families should be used in security-sensitive systems today.

17
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 4. PUBLIC KEY INFRASTRUCTURE (PKI) & CERTIFICATES

Definition
PKI is a framework of policies, roles, hardware, software, and procedures used to create, manage,
distribute, use, store, and revoke digital certificates, enabling trusted exchange of public keys.

Key Components
• Certificate Authority (CA) — trusted entity that issues and signs digital certificates.
• Registration Authority (RA) — verifies the identity of entities requesting certificates.
• Digital Certificate — binds a public key to an identity, signed by the CA (commonly X.509
format).
• Certificate Revocation List (CRL) / OCSP — mechanisms to check if a certificate has been
revoked.
• Root & Intermediate CAs — form a chain of trust from a trusted root down to the end-entity
certificate.

How a Certificate is Used

Entity generates key pair --> sends CSR (public key + identity) --> CA
CA verifies identity --> signs certificate with CA's private key
Certificate distributed --> Browser/Client verifies signature
using CA's public key (already trusted in OS/browser store)

Benefits
• Establishes authentication, confidentiality, integrity, and non-repudiation.
• Enables secure e-commerce, HTTPS browsing, and email signing.
• Provides a scalable trust model without needing to exchange keys manually.

Example: When a browser connects to a bank's website, it checks the site's X.509 certificate
against a trusted root CA to confirm the site's identity before displaying the padlock icon.

Conclusion: PKI provides the trust infrastructure that lets strangers on the internet exchange public
keys with confidence, forming the backbone of protocols like SSL/TLS and secure email.
18
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 5. SECURE COMMUNICATION PROTOCOLS

5.1 SSL/TLS
• SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) provide encrypted
communication over a network.
• TLS handshake: client and server negotiate a cipher suite, authenticate via certificates, and establish
a shared session key (often via Diffie-Hellman).
• After the handshake, symmetric encryption (e.g., AES) secures the actual data transfer for
performance.
• Current standard is TLS 1.3, which simplified the handshake and removed outdated weak ciphers.

Client Hello --------------------> Server

<-------------------- Server Hello + Certificate
Key Exchange (DH) & Verify Cert
<-------------------->
[Secure Symmetric Session Established]

5.2 HTTPS
• HTTPS = HTTP running over TLS; encrypts web traffic between browser and server.
• Protects against eavesdropping, tampering, and impersonation of websites.
• Indicated in browsers via the padlock icon and '[Link] prefix.

5.3 IPSec (Internet Protocol Security)

• Operates at the network layer to secure IP packets between hosts or gateways.
• Two main modes: Transport mode (encrypts payload only) and Tunnel mode (encrypts entire
packet, used for site-to-site VPNs).
• Two core protocols: AH (Authentication Header — integrity & authentication) and ESP
(Encapsulating Security Payload — confidentiality, integrity & authentication).
• Key management typically handled by IKE (Internet Key Exchange).

5.4 VPNs (Virtual Private Networks)

• Creates an encrypted tunnel over a public network so remote users/sites can communicate as if on a
private network.
• Commonly built using IPSec or SSL/TLS as the underlying security protocol.
• Provides confidentiality, remote access, and masking of the user's real IP address/location.

Protocol Comparison
Protocol OSI Layer Primary Use
19

SSL/TLS Session/Transport Securing application traffic

(web, email, etc.)
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 Protocol OSI Layer Primary Use
HTTPS Application Secure web browsing (HTTP
+ TLS)
IPSec Network Securing IP packets, site-to-
site VPNs
VPN Varies (uses TLS/IPSec) Secure remote access / private
tunnel

Example: A remote employee connects to the company network through an IPSec VPN
client, encrypting all traffic between their laptop and the corporate gateway.

Conclusion: These protocols layer encryption at different levels of the network stack — from securing a
single web session (TLS/HTTPS) to protecting entire network links (IPSec/VPN) — together forming the
backbone of secure internet communication.

6. EMAIL SECURITY

Definition
Email security protocols use cryptographic techniques to ensure confidentiality, integrity, authentication,
and non-repudiation of email messages, since standard SMTP transmits messages in plaintext.

6.1 PGP (Pretty Good Privacy)

• Combines symmetric encryption (for speed) with asymmetric encryption (for secure key exchange).
• Message is encrypted with a random session key (symmetric); the session key itself is encrypted
with the recipient's public key.
• Uses a 'Web of Trust' model — users sign each other's public keys instead of relying on a central
CA.
• Also supports digital signatures for sender authentication and message integrity.

6.2 S/MIME (Secure/Multipurpose Internet Mail Extensions)

• Also combines symmetric and asymmetric cryptography for encryption and digital signatures.
• Relies on a centralized PKI/CA model rather than a web of trust — requires certificates issued by a
trusted CA.
• Widely integrated into corporate email clients (Outlook, etc.) due to its CA-based trust model.

PGP vs S/MIME — Comparison

Feature PGP S/MIME
20

Trust Model Web of Trust (peer signing) Centralized PKI (CA-issued

certs)
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 Feature PGP S/MIME
Typical Use Individual/personal email Enterprise/corporate email
encryption systems
Key Distribution Public key servers / manual Certificates issued by CA
exchange

Setup Complexity Higher for casual users Easier within managed

organizations

Example: A journalist uses PGP to encrypt sensitive emails to a source, while a company
uses S/MIME with CA-issued certificates so all employee emails are signed and encrypted
automatically.

Conclusion: PGP and S/MIME both secure email through hybrid encryption, differing mainly in their
trust models — PGP is decentralized and user-driven, while S/MIME depends on formal PKI
infrastructure, making it more suited to enterprise deployment.

21
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 UNIT: 3
NETWORK SECURITY TOOL AND MECHANISMS

1. Firewalls

Definition
A firewall is a network security device or software that monitors and controls incoming and outgoing
traffic based on predefined security rules, acting as a barrier between a trusted internal network and
untrusted external networks such as the Internet.

1.1 Types of Firewalls

(a) Packet Filtering Firewall
Operates at the Network layer; examines each packet's header (source/destination IP, port, protocol)
against an Access Control List (ACL) and allows or blocks it without inspecting the payload or
connection state.
(b) Proxy Firewall (Application-Level Gateway)
Acts as an intermediary between client and server; terminates the client connection and creates a new
connection to the destination, inspecting traffic at the Application layer. Hides internal network
addresses from outside.
(c) Stateful Inspection Firewall
Maintains a state table of active connections and makes filtering decisions based on the context of traffic
(e.g., whether a packet belongs to an established session), combining speed of packet filtering with
deeper awareness of connection state.

Internet ---> [ FIREWALL ] ---> Internal Network

| Rule Base |
| ACL Table |
| State Table|
+-----------+
Packet Filter : checks header only
Proxy : checks full application payload
Stateful : checks header + connection state

1.2 Comparison of Firewall Types

Feature Packet Filtering Proxy Stateful Inspection

OSI Layer Network (L3/L4) Application (L7) Network + Transport
Speed Fast Slower Moderate to Fast
22

Header + session
Inspection Depth Header only Full payload
Page

state

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 Feature Packet Filtering Proxy Stateful Inspection
Security Level Low High Medium-High
Resource Usage Low High Moderate

1.3 Configuration Basics

• Define a default-deny policy: block all traffic except what is explicitly permitted.
• Create ACL rules specifying source/destination IP, port, and protocol.
• Segment the network into zones (e.g., DMZ, internal LAN, external).
• Enable logging and regularly audit firewall rule sets.
• Keep firmware/software patched and disable unused ports/services.

Example: A corporate firewall configured to block all inbound traffic except HTTPS (port
443) to the web server and SSH (port 22) only from the admin's IP address.

Conclusion
Firewalls form the first line of defense in network security; choosing the right type and configuring rules
carefully balances security with performance.

2. Intrusion Detection and Prevention Systems (IDS/IPS)

Definition
An IDS monitors network or system activity for malicious behavior or policy violations and alerts
administrators, whereas an IPS goes further by actively blocking or preventing detected threats in real
time.

2.1 Types
• Network-based IDS/IPS (NIDS/NIPS): monitors traffic across the entire network segment.
• Host-based IDS/IPS (HIDS/HIPS): monitors activity on an individual host/endpoint.
• Signature-based detection: matches traffic against known attack patterns.
• Anomaly-based detection: flags deviations from a baseline of normal behavior.

Traffic ---> [ SENSOR ] ---> [ ANALYSIS ENGINE ] ---> Alert / Block

| Signature DB |
| Anomaly Model|
IDS : detects + alerts (passive, out-of-line)
23

IPS : detects + blocks (active, in-line)

Page

Aspect IDS IPS

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 Placement Out-of-line (passive tap) In-line (active)
Response Generates alert only Blocks/drops malicious traffic
Impact on Traffic None (monitoring only) Can introduce latency
False positives can block legit
Risk Threat may reach target
traffic

Example: Snort configured as a NIPS to automatically drop packets matching a known SQL-
injection signature.

Conclusion
IDS/IPS provide continuous monitoring and active response capability, complementing firewalls by
detecting threats that bypass perimeter defenses.

3. Virtual Private Networks (VPNs) and Tunnelling Protocols

Definition
A VPN creates a secure, encrypted 'tunnel' over a public network (such as the Internet), allowing remote
users or sites to access a private network as though directly connected, ensuring confidentiality and
integrity of data in transit.

3.1 Types of VPN

• Remote Access VPN: connects an individual user to a private network.
• Site-to-Site VPN: connects entire networks (e.g., branch offices) to each other.

3.2 Common Tunneling Protocols

• PPTP (Point-to-Point Tunneling Protocol): fast but weak, outdated encryption.
• L2TP/IPSec: combines L2TP tunneling with IPSec encryption for stronger security.
• IPSec: operates at the network layer; provides authentication and encryption (AH and ESP).
• SSL/TLS VPN: works at the application/transport layer; commonly used for browser-based access.
• WireGuard: modern, lightweight protocol with strong cryptography and high performance.

[Remote User] --(Encrypted Tunnel)--> [VPN Gateway] --> Private Network

Internet (untrusted)
Tunneling wraps original packet inside a new encrypted packet
so data remains confidential while crossing public networks.
24

Example: An employee working from home uses an SSL VPN client to securely access the
company's internal file server.
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Conclusion
VPNs and tunneling protocols extend private network security over public infrastructure, making secure
remote work and inter-office connectivity possible.

4. Wireless Security: WEP, WPA, WPA2, WPA3

Definition
Wireless security protocols protect data transmitted over Wi-Fi networks from eavesdropping and
unauthorized access through encryption and authentication mechanisms, evolving over time to address
discovered weaknesses.

4.1 Evolution and Comparison

Protocol Encryption Key Weakness Status

WEP RC4 (static key) Weak IV, easily cracked Obsolete/Insecure
Still vulnerable to some
WPA TKIP (dynamic keys) Deprecated
attacks
KRACK attack
WPA2 AES-CCMP Widely used
(implementation flaw)
AES-GCMP, SAE
WPA3 Newer; fewer known flaws Current standard
handshake

Key Points
• WEP used a static shared key and weak Initialization Vectors (IVs), making it crackable within
minutes.
• WPA introduced TKIP to dynamically change keys, improving on WEP but still flawed.
• WPA2 introduced AES-based CCMP encryption, becoming the long-standing industry standard.
• WPA3 replaces the WPA2 PSK handshake with Simultaneous Authentication of Equals (SAE),
resisting offline dictionary attacks and providing forward secrecy.

Example: A home router upgraded from WPA2 to WPA3 to protect against offline password-
guessing (dictionary) attacks.

Conclusion
Each generation of wireless security addressed weaknesses of the previous one; WPA3 is currently
recommended for robust protection of wireless networks.
25
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

5. Security in Cloud and IoT Environments

Definition
Cloud security involves protecting data, applications, and infrastructure hosted on cloud platforms,
while IoT security focuses on securing the large number of interconnected smart devices, both of which
introduce unique risks beyond traditional network boundaries.

5.1 Cloud Security Concerns

• Shared Responsibility Model: cloud provider secures infrastructure; customer secures
data/access/configuration.
• Data breaches due to misconfigured storage (e.g., open S3 buckets).
• Identity and Access Management (IAM): least-privilege access, multi-factor authentication.
• Data encryption at rest and in transit.
• Compliance with regulations (GDPR, ISO 27001).

5.2 IoT Security Concerns

• Devices often have weak or default passwords and limited processing power for encryption.
• Lack of regular firmware updates leaves known vulnerabilities unpatched.
• Large attack surface due to sheer number and diversity of connected devices.
• Botnets can hijack insecure IoT devices for large-scale DDoS attacks.

Example: The Mirai botnet (2016) exploited IoT devices with default credentials to launch a
massive DDoS attack against DNS provider Dyn.

Conclusion
Cloud and IoT environments expand the attack surface beyond the traditional perimeter, requiring strong
identity controls, encryption, and device-hardening practices.

6. Case Studies: Real-World Breaches and Lessons Learned

(a) Target Data Breach (2013)

Attackers stole an HVAC vendor's network credentials to access Target's internal network, ultimately
compromising 40+ million payment card records.
• Lesson: Third-party vendor access must be tightly restricted and segmented from critical systems.
(b) Equifax Breach (2017)
Attackers exploited an unpatched Apache Struts vulnerability, exposing personal data of about 147
million people.
• Lesson: Timely patch management is critical to prevent exploitation of known vulnerabilities.
26

(c) Mirai Botnet / Dyn Attack (2016)

Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Insecure IoT devices with default credentials were hijacked to form a botnet that launched a massive
DDoS attack, disrupting major websites.
• Lesson: IoT devices must enforce strong unique credentials and regular firmware updates.
(d) WannaCry Ransomware (2017)
Exploited the EternalBlue SMB vulnerability in unpatched Windows systems, spreading globally and
disrupting hospitals and businesses.
• Lesson: Regular patching and network segmentation limit the spread of self-propagating malware.

27
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 UNIT 4
ADVANCED TOPICS AND MANAGEMENT
1. Security in Operating Systems and Applications
Operating system (OS) and application security form the foundation on which all higher-level network
security controls are built. Even the strongest network defences are ineffective if the underlying host can
be compromised through a weak OS configuration or a vulnerable application.
Operating System Security
Operating system security refers to the mechanisms used to protect the OS from threats, misuse, and
unauthorised modification, ensuring confidentiality, integrity, and availability (CIA) of system resources.

Key OS Security Mechanisms

• Authentication and Authorization – verifying user identity (passwords, biometrics, smart cards) and
controlling access rights.
• Access Control Models – Discretionary Access Control (DAC), Mandatory Access Control (MAC),
Role-Based Access Control (RBAC).
• Process Isolation – preventing one process from accessing another process's memory space.
• File System Security – permissions (read/write/execute), ownership, and encryption (e.g., NTFS
permissions, EFS, LUKS).
• Auditing and Logging – recording system events (login attempts, file access) for accountability.
• Patch Management – regularly updating the OS to fix known vulnerabilities.
• User Account Control (UAC) / Least Privilege – restricting users and processes to the minimum
privileges required.
• Antivirus / Anti-malware and Host-based Firewalls – detecting and blocking malicious software
and unauthorised connections.

Common OS Security Threats

Threat Description

Malware Viruses, worms, trojans, ransomware that

damage or exploit the system

Privilege Escalation Exploiting a flaw to gain higher-level access

than authorised

Buffer Overflow Writing data beyond allocated memory to

28

execute arbitrary code

Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Threat Description

Rootkits Hidden software that grants continued

privileged access while evading detection

Denial of Service (DoS) Overloading system resources to make

services unavailable

1.2 Application Security

Application security involves building, testing, and maintaining software so that it is resistant to threats
that arise from insecure design, coding errors, or misconfiguration.

Key Practices
• Secure Software Development Life Cycle (SSDLC) – integrating security at every phase: design,
coding, testing, deployment.
• Input Validation – sanitising user input to prevent injection attacks (SQL Injection, XSS).
• Authentication & Session Management – secure login mechanisms, strong session tokens, timeouts.
• Error Handling – avoiding disclosure of sensitive information in error messages.
• Code Review and Static/Dynamic Analysis (SAST/DAST) – identifying vulnerabilities before and
during runtime.
• Encryption – protecting data in transit (TLS/SSL) and data at rest.
• Regular Updates and Patching of third-party libraries and frameworks.

Common Application Vulnerabilities (OWASP Top 10 examples)

1. Broken Access Control
2. Cryptographic Failures
3. Injection (SQL, Command, LDAP)
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentication Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures
10. Server-Side Request Forgery (SSRF)
29

Incident Response and Disaster Recovery Planning

2. Incident Response and Disaster Recovery Planning
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

No system is completely immune to attacks or failures. Organisations must be prepared to detect, respond
to, and recover from security incidents and disasters in a structured, efficient manner.
2.1 Incident Response (IR)
Incident Response is an organised approach to addressing and managing the aftermath of a security breach
or cyberattack, with the goal of limiting damage and reducing recovery time and cost.

Incident Response Life Cycle (NIST Model)

1. Preparation – developing IR policies, forming a response team (CSIRT), training, and setting
up tools.
2. Identification (Detection & Analysis) – recognising that an incident has occurred through
monitoring, alerts, and logs.
3. Containment – isolating affected systems to prevent further damage (short-term and long-term
containment).
4. Eradication – removing the root cause of the incident (malware, unauthorised access,
vulnerabilities).
5. Recovery – restoring and validating systems to normal operation, and monitoring for
recurrence.
6. Lessons Learned (Post-Incident Review) – documenting the incident and improving future
response.

Incident Response Team (CSIRT/CERT)

A Computer Security Incident Response Team (CSIRT) or Computer Emergency Response Team (CERT)
is a dedicated group responsible for handling security incidents. In India, CERT-In (Indian Computer
Emergency Response Team) is the national nodal agency.
Disaster Recovery Planning (DRP)
Disaster Recovery Planning is a documented, structured approach describing how an organisation can
quickly resume operations after an unplanned incident such as a natural disaster, cyberattack, or hardware
failure.

Key Concepts

Term Meaning

RTO (Recovery Time Objective) Maximum acceptable time to restore a

system/service after disruption

RPO (Recovery Point Objective) Maximum acceptable amount of data loss

measured in time
30
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Term Meaning

Business Continuity Plan (BCP) Broader plan to keep essential business

functions running during a disruption

Backup Site (Hot/Warm/Cold) Alternate facility used to resume operations;

differ in readiness and cost

Steps in Disaster Recovery Planning

1. Risk Assessment and Business Impact Analysis (BIA)
2. Defining recovery strategies (data backup, redundant systems, cloud DR)
3. Developing the DR plan document (roles, responsibilities, procedures)
4. Testing the plan (tabletop exercises, simulations, full-scale drills)
5. Maintenance and periodic review/updating

Backup Strategies
• Full Backup – complete copy of all data.
• Incremental Backup – only data changed since the last backup.
• Differential Backup – all data changed since the last full backup.
• 3-2-1 Rule – 3 copies of data, on 2 different media, with 1 copy offsite.

Exam Tip: Incident Response deals with the immediate handling of a security event; Disaster Recovery
deals with restoring systems and operations afterward. Both work together within an overall Business
Continuity strategy.

3. Security Auditing and Vulnerability Assessment

Security auditing and vulnerability assessment help organisations proactively identify weaknesses before
attackers can exploit them, and verify compliance with security policies and standards.
3. Security Auditing and Vulnerability Assessment

3.1 Security Auditing

A security audit is a systematic evaluation of an organisation's information system to measure how well
it conforms to a set of established security criteria (policies, standards, regulations).

Types of Security Audits

31

• Internal Audit – conducted by the organisation's own staff.

Page

• External Audit – conducted by an independent third-party auditor.

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 • Compliance Audit – checks adherence to standards like ISO 27001, PCI-DSS, or laws like the IT
Act 2000/GDPR.
• Technical Audit – reviews configurations, access controls, and system logs.

Security Audit Process

1. Planning and scoping the audit
2. Data/evidence collection (logs, configurations, interviews)
3. Vulnerability identification and risk analysis
4. Reporting findings and recommendations
5. Follow-up and remediation verification

3.2 Vulnerability Assessment (VA)

Vulnerability Assessment is the process of identifying, quantifying, and prioritising (ranking)
vulnerabilities in a system. Unlike penetration testing, VA typically does not exploit the vulnerabilities —
it focuses on discovery and reporting.

Vulnerability Assessment Process

1. Asset identification – determine what needs to be assessed
2. Vulnerability scanning – using automated tools to detect known weaknesses
3. Risk analysis – assign severity (e.g., using CVSS score)
4. Remediation and mitigation planning
5. Re-assessment / verification

Common Tools

Tool Purpose

Nessus Comprehensive vulnerability scanning

OpenVAS Open-source vulnerability scanner

Nmap Network discovery and port scanning

Qualys Cloud-based vulnerability management

Wireshark Network protocol analyser / packet capture

Note: CVSS (Common Vulnerability Scoring System) provides a standardised numeric score (0–10) to
communicate the severity of vulnerabilities.
32
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Exam Tip: Security Audit = broad compliance/process review; Vulnerability Assessment = technical
scan for known weaknesses; Penetration Testing (next unit) = actively exploiting weaknesses to prove
real-world risk.
4. Ethical Hacking and Penetration Testing Basics

Ethical hacking involves authorised attempts to gain unauthorised access to a system, application, or data
by simulating the strategies and actions of malicious attackers, in order to identify and fix security
weaknesses.

4.1 Ethical Hacking – Key Concepts

• Performed with explicit written permission from the system owner.
• Follows a defined scope and rules of engagement (ROE).
• Aims to strengthen security, not cause harm.
• Practitioners are often called 'White Hat' hackers.

Types of Hackers

Type Description

White Hat Ethical hacker, authorised to test and

improve security

Black Hat Malicious hacker who exploits systems for

personal gain or harm

Grey Hat Operates between ethical and unethical

boundaries, often without explicit
authorisation

Script Kiddie Uses existing tools/scripts without deep

technical knowledge

Hacktivist Hacks to promote a political or social cause

4.2 Penetration Testing (Pen Testing)

Penetration testing is a simulated, authorised cyberattack against a system to evaluate its security by
actively exploiting vulnerabilities, going beyond assessment to demonstrate real impact.

Phases of Penetration Testing

33

1. Reconnaissance (Information Gathering) – passive/active collection of target information.

Page

2. Scanning – identifying live hosts, open ports, and services (e.g., using Nmap).

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 3. Gaining Access (Exploitation) – exploiting identified vulnerabilities.
4. Maintaining Access – simulating persistence techniques an attacker might use.
5. Covering Tracks – (in ethical testing, this phase demonstrates the risk without causing real
damage).
6. Reporting – documenting findings, evidence, and remediation recommendations.

Types of Penetration Testing

• Black Box Testing – tester has no prior knowledge of the system.
• White Box Testing – tester has full knowledge (source code, architecture).
• Grey Box Testing – tester has partial knowledge (e.g., user-level credentials).

Common Tools

Tool Use

Kali Linux Penetration testing operating system with

pre-installed tools

Metasploit Exploitation framework

Burp Suite Web application security testing

John the Ripper Password cracking

Nikto Web server vulnerability scanner

Important: Unauthorised hacking or penetration testing without written consent is illegal under laws
such as the IT Act, 2000 (India) and equivalent cyber laws worldwide, even if intentions are good.

5. Emerging Trends in Security

The security landscape constantly evolves. Modern organisations are adopting new architectures and
technologies to counter increasingly sophisticated threats.

5.1 Zero Trust Architecture (ZTA)

Zero Trust is a security model based on the principle 'never trust, always verify' — no user or device is
trusted by default, whether inside or outside the network perimeter.

Core Principles
• Verify explicitly – authenticate and authorise based on all available data points (identity, device,
34

location).
• Use least privilege access – limit user access with just-in-time and just-enough access.
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 • Assume breach – design systems assuming an attacker may already be inside, minimising blast
radius through micro-segmentation.

Key Components
• Multi-Factor Authentication (MFA)
• Micro-segmentation of networks
• Continuous monitoring and validation
• Identity and Access Management (IAM)
Unlike traditional perimeter-based security ('trust but verify inside the castle wall'), Zero Trust treats every
access request as though it originates from an untrusted network.

5.2 AI in Security
Artificial Intelligence and Machine Learning are increasingly used to enhance both defensive and
offensive cybersecurity capabilities.

Applications of AI in Security
• Threat Detection – identifying anomalies and patterns indicative of attacks in real time.
• Behavioural Analytics – detecting insider threats through deviations from normal user behaviour
(UEBA).
• Automated Incident Response (SOAR) – triggering predefined responses without human
intervention.
• Phishing Detection – analysing email content and sender behaviour using NLP techniques.
• Malware Classification – using ML models to detect previously unseen ('zero-day') malware
variants.

Challenges
• Adversarial AI – attackers using AI to craft evasive malware or deepfake-based social engineering.
• False positives/negatives affecting trust in automated systems.
• Need for large, high-quality training datasets.

5.3 Blockchain for Security

Blockchain is a decentralised, distributed ledger technology that maintains a continuously growing list of
records (blocks) secured using cryptography, offering properties useful for security applications.

Security Benefits of Blockchain

• Immutability – once recorded, data cannot be altered without consensus, aiding tamper-evident
35

logging.
• Decentralisation – no single point of failure, reducing risk of centralised attacks.
Page

• Transparency and Traceability – all transactions are auditable across the network.

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 • Smart Contracts – self-executing agreements that can automate secure, trustless transactions.

Use Cases in Security

• Secure identity management and authentication
• Supply chain integrity verification
• Secure and tamper-proof audit logs
• Decentralised DNS and reducing DDoS attack surfaces

6. Legal and Ethical Issues

Cybersecurity professionals must operate within the boundaries of applicable laws and regulations. This
section covers key Indian and international legal frameworks.

6.1 Cyber Laws in India

Cyber law refers to the legal framework that deals with the internet, cyberspace, and related legal issues,
covering crimes such as hacking, data theft, identity theft, and cyberterrorism.

Key Regulatory Bodies

• CERT-In (Indian Computer Emergency Response Team) – national agency for responding to
cybersecurity incidents.
• Ministry of Electronics and Information Technology (MeitY) – formulates IT policy.
• National Critical Information Infrastructure Protection Centre (NCIIPC) – protects critical
infrastructure.

6.2 The Information Technology Act, 2000 (IT Act)

The IT Act, 2000 is India's primary law dealing with cybercrime and electronic commerce, providing legal
recognition to electronic records and digital signatures.

Important Provisions

Section Provision

Section 43 Penalty for unauthorised access, damage to

computer systems/data (civil liability,
compensation)

Section 66 Punishment for computer-related offences

(hacking) — imprisonment up to 3 years
and/or fine

Identity theft — fraudulent use of another's

36

Section 66C
identification (password, digital signature)
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

Section Provision

Section 66D Cheating by personation using computer

resources (online fraud)

Section 66E Violation of privacy — capturing/publishing

private images without consent

Section 66F Cyberterrorism — acts threatening unity,

integrity, or security of India

Section 67 Publishing/transmitting obscene material in

electronic form

Section 69 Government power to intercept, monitor, or

decrypt information for security reasons

Section 70 Protection of Critical Information

Infrastructure (protected systems)

Section 72 Penalty for breach of confidentiality and

privacy

Section 43A Compensation for failure to protect sensitive

personal data (corporate liability)

The IT (Amendment) Act, 2008 expanded the scope of the original act to include cyberterrorism, data
protection, and intermediary liability, and introduced digital/electronic signature provisions.

6.3 GDPR Basics (General Data Protection Regulation)

The GDPR is a comprehensive data protection law enacted by the European Union (effective from 25
May 2018) that governs how personal data of EU residents is collected, processed, and stored — even by
organisations outside the EU that handle EU citizens' data.

Key Principles of GDPR

• Lawfulness, Fairness, and Transparency – personal data must be processed legally and
transparently.
• Purpose Limitation – data collected only for specified, legitimate purposes.
• Data Minimisation – only necessary data should be collected.
• Accuracy – data must be kept accurate and up to date.
37

• Storage Limitation – data retained only as long as necessary.

• Integrity and Confidentiality – data must be processed securely.
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K

 • Accountability – organisations must demonstrate compliance.

Key Rights of Data Subjects

• Right to Access – individuals can request a copy of their data.
• Right to Rectification – correct inaccurate data.
• Right to Erasure ('Right to be Forgotten') – request deletion of personal data.
• Right to Data Portability – transfer data between service providers.
• Right to Object – opt out of certain types of processing (e.g., marketing).

Important Terms

Term Meaning

Data Controller Entity that determines the purpose and

means of processing personal data

Data Processor Entity that processes data on behalf of the

controller

Data Protection Officer (DPO) Person responsible for overseeing GDPR

compliance

Personal Data Breach A security incident leading to

accidental/unlawful data loss or exposure

Non-compliance with GDPR can result in significant fines — up to €20 million or 4% of annual global
turnover, whichever is higher.
Note: India's Digital Personal Data Protection Act (DPDP), 2023 is India's own comprehensive data
protection law, conceptually similar to GDPR, governing the processing of digital personal data.

— End of Notes —
38
Page

GOVT. FIRST GRADE COLLEGE FOR WOMEN, BYRAPURA RAKESH K