Computer Security Technologies

Dr. Mohammed Al Saleh

Email: MHDALSALEH@[Link]

1
 Firewall

• A firewall is a barrier between two computers or computer

systems.
• The most common place to encounter a firewall is between
your network and the outside world.
• Firewalls on individual computers and between network
segments are also quite common.
• At a minimum, a firewall will filter incoming packets based on
certain parameters such as packet size, source IP address,
protocol, and destination port.

2
 Benefits and Limitation of Firewalls

• A firewall is a critical piece of your security strategy.

• However, it is not a cure for security because it cannot block
every attack.
• A firewall won’t stop you from downloading a Trojan horse. It
also cannot stop internal attacks.
• A firewall can be an excellent way to stop a denial of service
(DoS) attack or to prevent a hacker from scanning the internal
details of your network.

3
 Firewall Types

• There are numerous types of firewalls and variations on those

types. But most firewalls can be grouped into one of the
following three families of firewalls.
Packet inspection
Stateful packet inspection
Application

4
 Packet Filtering

• Basic packet filtering is the simplest form of firewall. It looks at

packets and checks to see if each packet meets the firewall
rules.
1. Is this packet using a protocol that the firewall allows?
2. Is this packet destined for a port that the firewall allows?
3. Is the packet coming from an IP address that the firewall has not
blocked?

• In packet filtering firewall, each packet is treated as a singular

event without reference to the preceding conversation. That
makes packet filtering firewalls quite susceptible to some DoS
attacks, such as SYN floods.

5
 Stateful Packet Inspection

• The firewall will examine each packet, denying or permitting

access based not only on the examination of the current packet,
but also on data derived from previous packets in the
conversation.
• This means that the firewall is aware of the context in which a
specific packet was sent. This makes these firewalls far less
susceptible to ping floods and SYN floods, as well as less
susceptible to spoofing.
• Most high-end firewalls use the stateful packet inspection
method; when possible, this is the recommended type of firewall.

6
 Application Gateway

• An application gateway (also known as application proxy or

application-level proxy) is a program that runs on a firewall.
• When a client program, such as a web browser, establishes a
connection to a destination service, such as a web server, it
connects to an application gateway, or proxy.
• The client then negotiates with the proxy server in order to gain
access to the destination service. In effect, the proxy establishes
the connection with the destination behind the firewall and acts
on behalf of the client, hiding and protecting individual computers
on the network behind the firewall.
• This process actually creates two connections. There is one
connection between the client and the proxy server and another
connection between the proxy server and the destination.

7
 Commercial and Free Firewall Products

• There is a variety of commercial firewall products from which you

can choose.
• If all you want is a basic packet-filtering solution, many software
vendors offer this. Major antivirus software vendors often offer
the firewall software as a bundled option with their antivirus
software.
• Companies, such as Zone Labs , sell firewall and intrusion
detection software (IDS). Zone Labs offers a free download of
the ZoneAlarm firewall protection.
• Outpost Firewall is a product designed for the home or small
office user. Like the Zone Labs product, it has both a free
version and an enhanced commercial version.

8
 IDS (Intrusion Detection System)

• An IDS will inspect all inbound and outbound port activity on your
machine/firewall/system and look for patterns that might indicate
an attempted break-in.
• For example, if the IDS finds that a series of ICMP packets were
sent to each port in sequence, this probably indicates that your
system is being scanned by network-scanning software.
• There are a number of vendors who supply IDS systems, each
with its own strengths and weaknesses; One popular open-
source IDS is Snort, which can be downloaded for free from
[Link]/

9
 Digital Certificates

• We mentioned that the public key can be disseminated widely

since it can only be used to encrypt messages to us.
• How does one provide people with a public key?
• The most common method is via a digital certificate. The digital
certificate contains the user’s public key, along with other
information such as means for authenticating that the holder of
the certificate is who she claims to be.
• X.509 is the most common type of digital certificate in the world.
It is a digital document that contains a public key signed by the
trusted third party that is known as a certificate authority, or
CA.

10
 Basic items in an X.509 certificate

• Version: This is the version of X.509 that this certificate complies with.
• Certificate holder’s public key: This is the primary way of getting
someone’s public key from his X.509 certificate.
• Serial number: This is a unique identifier for this certificate.
• Certificate holder’s distinguished name: This is often a domain
name or email associated with a certificate.
• Certificate’s validity period: One year is the most common validity
period.
• Unique name of certificate issuer: This is the certificate authority
that issued this certificate.
• Digital signature of issuer: This field , and the next, are used to
verify the certificate itself.
• Signature algorithm identifier: Identifies the actual digital signature
algorithm used
11
 How X.509 this works in a common scenario

• You visit your bank’s website. In order to get the bank’s public
key, your browser will download that bank’s digital certificate.
But there is a problem.
• Could someone have set up a fake site, claiming to be your
bank?
• Could that person have also generated a fake certificate
claiming to be the bank?

Yes, it’s possible

12
 How X.509 this works in a common scenario

• Your browser will look at the certificate issuer listed on the

certificate and first ask if that is a CA that your browser trusts.
• Assuming it is, then your browser communicates with that CA to
get that CA’s public key.
• The browser uses that CA public key to verify the CA signature
on the certificate. If this is a fake certificate, the digital signature
won’t be recognized.

13
 Trusted certificate authorities

• Comodo, Symantec, Digicert, GoDaddy, Verisign, and Thawte

are all well-known certificate authorities.
• When you purchase a certificate from one of these vendors,
they first verify who you are.
• That can be as simple as matching your credit card with the
domain you are buying the certificate for, or it can be far more
involved.
• Since verifying a certificate user can be time consuming, many
CAs offload that process to a registration authority (RA), who
will then notify the CA to issue the certificate (or not).

14
 SSL/TLS

• When visiting websites that have an HTTPS at the beginning,

rather than HTTP, the S denotes secure.
• That means traffic between your browser and the web server is
encrypted. This is usually done with either SSL (Secure Sockets
Layer) or TLS (Transport Layer Security) .
• SSL, the older of the two technologies, was developed by
Netscape. SSL and TLS are both asymmetric systems.
• SSL was developed for transmitting private documents via the
Internet.
• By convention, URLs that require an SSL connection start with
https instead of http.

15
SSL/TLS handshake process

16
 SSL/TLS handshake process

1. The client sends the server information what algorithms it is capable

of, what hashing algorithms it can use for message integrity, and
related information.
2. The server responds by selecting the best encryption and hashing
that both client and server are capable of and sends this information
to the client. The server also sends its own certificate, and if the
client is requesting a server resource that requires client
authentication, the server requests the client’s certificate.
3. The client uses the information sent by the server to authenticate the
server. This means authenticating the digital certificate with the
appropriate CA. If this fails the browser warns the user that the
certificate cannot be verified.
4. Using all data generated in the handshake thus far, the client creates
the pre-master secret for the session, encrypts it with the server’s
public key that it received from the server’s X.509 certificate, and
then sends the encrypted pre-master secret to the server.

17
 SSL/TLS handshake process

5. If the server has requested client authentication, then the

server will also authenticate the client’s X.509 certificate.
6. Both the client and the server use the master secret to
generate the session keys. These are symmetric keys (such
as AES) that will be used throughout the session to encrypt
information between the client and the server.
7. The client sends a message to the server informing it that
future messages from the client will be encrypted with the
session key.
8. The server sends a message to the client informing it that
future messages from the server will be encrypted with the
session key.

18
 VPN (Virtual Private Networks)

• This is essentially a way to use the Internet to create a virtual

connection between a remote user or site and a central
location.
• The packets sent back and forth over this connection are
encrypted, thus making it private.

19
 VPN

• VPN creates an encrypted connection that is called VPN

tunnel, and all Internet traffic and communication is passed
through this secure tunnel.
• Types of Virtual Private Network (VPN) Protocols
Internet Protocol Security (IPSec)
Layer 2 Tunneling Protocol (L2TP)
Point–to–Point Tunneling Protocol (PPTP)

20
IPSEC Framework

21
 Commercial VPN

• A VPN creates a connection between your computer and one of

VPN providers servers, which are located around the world.
• You are able to hide your IP address and your actual location,
displaying instead one of the IP addresses and a virtual location of
anywhere that the providers have a server.
• Websites that you visit won't see your real IP address or your
location; they'll see the IP and location of the VPN provider
gateway that you connect through.
• Your ISP will only see encrypted information. A VPN is a great
way to prevent marketers or your ISP from tracking your history
and online activity.
• Your information is encrypted so hackers cannot gain access to
your usernames, passwords, emails, and other sensitive
information they may use to steal your identity, place unauthorized
purchases, or harm you in other ways.
22
 Commercial VPN Examples

• Windscribe
• Hotspot Shield
• ExpressVPN

23