IPSec is made up of two protocols, which can be used separately or together:
AH (Authentication Header)
o adds digital signature to packet to protect against spoofing
o verifies that packet headers have not been modified
o no encryption, nor confidentiality
o signs whole packet
ESP (Encapsulating Security Payload)
o provides confidentiality by encrypting the data
o encrypts packet headers and data
There are two modes of operation for both AH and ESP
Transport mode
o is used to encrypt data inside a tunnel
o provides end-to-end security, all the way from the sending computer to the
final destination
Tunnel mode
o is used to create a virtual private network
o provides gateway protection
Below is summary of some jargon of security protocols.
plain-text - the original message
clear-text - the original message
cipher-text - the coded message
cipher - algorithm for transforming plaintext to ciphertext
key - info used in cipher, known only to sender/receiver
encipher (encrypt):- converting plaintext to ciphertext
decipher (decrypt): reconverting ciphertext to plaintext
cryptography: study of encryption methods
cryptanalysis:- the study of methods of deciphering ciphertext without knowledge
of enciphering details
cryptology: the field of both cryptography and cryptanalysis
authenticity: verification of the identity of the sender
integrity: assurance that the data was not changed in transit
confidentiality: secrecy, encryption of the data so that it can’t be read by anyone
who doesn’t have the correct key
The purpose of a DMZ is to add an additional layer of security to an organization's Local
Area Network (LAN) so that an external attacker only has access to equipments in the
DMZ, rather than the whole of the network. ( TRUE or FALSE)
A good security policy must:
Be able to be implemented through system administration procedures, publishing of
acceptable use guidelines, or other appropriate methods
Be able to be enforced with security tools, where appropriate, and with sanctions,
where actual prevention is not technically feasible
Clearly define the areas of responsibility for the users, the administrators, and the
managers
Be communicated to all once it is established
Be flexible to the changing environment of a computer network since it is a living
document
Risk
[Link]
[Link]
[Link]
Types of attack
[Link] of data (DOD)
[Link] of data(COD)
[Link] of service(DOS)
Strategy Function
[Link] expiry date are not exceeded
[Link] Provide a Signal
[Link] Repair Recovery
–--------------- includes all the hardware and software items including PCs, servers,
network
devices, accessories, software licenses, updates, and in-house developed software
________ can make web sites temporarily unavailable and is designed to bring the
network to its knees by flooding it with useless traffic.
_______ can be malicious or non-malicious, physical, technical or operational, and may
even originate from inside an organization.
Vulnerabilities are weakness of a system that could be accidentally or intentionally
exploited to damage _______.
Operating system security
OS software integrity
User access control
Authorized users have sufficient privileges to perform their work and nothing more
Block unnecessary services (e.g. finger, telnet)
To run mail server and web server, better to put them on different computers
Avoid OS with lots of defaults and options
The more complex, the more likely to be abused by user
Network infrastructure security
Service-blocking (e.g. port)
Encryption
Authentication protocol
Digital watermarking which is protect information on web sites from unauthorized
use, prevent users from downloading the information and sharing it with others
Terminology
Firewall
Trojan Horse
Virus
Worm
At the root prompt, encrypt the password using grub2-mkpasswd-pbkdf2:
Firewall is a system designed to prevent unauthorized access to or from a private
network.
Firewalls can be implemented in both hardware and software, or a combination of both.
Firewall types
[Link]-based firewall
[Link] filtering firewall
[Link] inspection firewall
[Link] host
[Link]-based firewall
A proxy is a process that sits between a client process and a server process.
A company wants to make some pages of its web server accessible to all external users
but it wants to restrict certain of the pages to corporate users at one or more remote sites.
Which types of firewall can be implemented in this case.?
[Link] filtering firewall
An IP packet filter firewall allows you to create a set of rules that either discard or
accept
traffic over a network connection.
a packet filter can only discard traffic
Packet filtering firewalls operate on Layer3 of the OSI model, the Network layer.
Packet filters usually permit or deny network traffic based on:
[Link] IP address
[Link] ports
[Link] IP addresses
[Link] ports
[Link] protocols such as TCP, UDP or ICMP
Common “iptables –L”
[Link] inspection firewall
A stateful firewall is a firewall that keeps track of the state of network connections (such
as
TCP streams, UDP communication) traveling across it.
“keepalive” messages are sent periodically in order to stop a firewall from dropping the
connection during periods of no user-activity.
[Link] host
A bastion host is a computer on the network that provides a single entrance and exit
point to
the Internet from the LAN and vice versa.
bastion host is a mail gateway which is located in DMZ and the mail server is
located in LAN.
Symmetric key – DES
A symmetric key (sometimes called private, secret key, or single key) system uses a
single
key. That key is used both to encrypt and to decrypt information. A symmetric key
cryptosystem uses the one key to encrypt and decrypt messages.
The DES - Data Encryption Standard is a symmetric key algorithm
Public key – RSA
[Link] key cryptosystem
[Link]
[Link] key cryptosystem
A public key (sometimes called asymmetric key or two key) system uses two keys: a
public
key and a private key