TCS 795 - Security Audit and Compliance - II

ASSIGNMENT 1 - OSI/TCP-IP Model and ITU Security Architecture

1. OSI vs. TCP/IP Models:
a. Draw the OSI and TCP/IP models, listing all layers.
Ans.

b. Compare and contrast the functionality of each layer, providing examples of protocols used
at each layer.
Ans.

OSI Model (7 TCP/IP Model (4

Functionality Example Protocols
Layers) Layers)

Provides network services directly to end- HTTP, FTP, SMTP, DNS,

Application Application
users (email, file transfer, web browsing). POP3

(part of Application
Presentation Data translation, encryption, compression. SSL/TLS, JPEG, MPEG
in TCP/IP)

(part of Application Establishes, manages, and terminates

Session NetBIOS, RPC
in TCP/IP) sessions between applications.

Ensures reliable or unreliable delivery, error TCP (reliable), UDP

Transport Transport
detection, segmentation, flow control. (fast, unreliable)

Handles logical addressing and routing of data IP, ICMP, ARP, RIP,
Network Internet
packets across networks. OSPF

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
OSI Model (7 TCP/IP Model (4
Functionality Example Protocols
Layers) Layers)

Provides physical addressing (MAC), framing, Ethernet, PPP,

Data Link Network Access
and error detection. Switches, ARP

Deals with hardware transmission (cables, Hubs, Repeaters,

Physical Network Access
signals, voltages). Physical media

c. From the perspective of security, discuss which OSI/TCP-IP layers are most frequently
targeted by attackers and why.
Ans.

Layer Why It’s Targeted Common Attacks / Threats

SQL Injection, XSS, CSRF,

Closest to end-users, rich attack
Application (OSI 7 / Ransomware, Phishing,
surface, handles user input, web
TCP-IP Application) Malware in HTTP/Email, API
services, and business logic.
abuse

SSL stripping, downgrade

Presentation (OSI 6,
Handles encoding/encryption; if attacks, weak cryptography
merged in TCP-IP
weak, can be bypassed. (RC4, MD5), man-in-the-
Application)
middle (MITM)

Session (OSI 5,
Manages sessions and authentication Session hijacking, cookie theft,
merged in TCP-IP
tokens. replay attacks
Application)

Responsible for connections; TCP SYN Flood (DoS), UDP

Transport (OSI 4 /
attackers exploit open ports and Floods, Port Scanning, Session
TCP-IP Transport)
service weaknesses. reset (RST injection)

IP Spoofing, ICMP Flood, ARP

Network (OSI 3 / Targeted because routing and Poisoning, Routing Attacks
TCP-IP Internet) addressing can be manipulated. (BGP hijacking, OSPF LSA
injection)

MAC Spoofing, ARP Spoofing,

Data Link (OSI 2 / Attackers close to LAN target MAC
VLAN hopping, Switch CAM
TCP-IP Link) & ARP mechanisms.
table overflow

Harder for remote attackers but Wiretapping, signal jamming

Physical (OSI 1 /
vulnerable to insiders or physical (Wi-Fi), hardware keyloggers,
TCP-IP Link)
access. cable tapping

2. ITU Security Architecture:

a. Describe the structure of the ITU-T X.800/X.805 security architecture, including security layers,
planes, and dimensions.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Ans. ITU-T X.800 / X.805 Security Architecture :
The ITU-T X.800 standard defines security services & mechanisms, while X.805 extends it into a security
architecture for networks (esp. Next-Gen Networks).
It organizes security into 3 Security Layers, 3 Security Planes, and 8 Security Dimensions.

1. Security Layers (Where security applies)

Defines which functional layer of a network needs protection:
1. Infrastructure Layer → Protects network resources (routers, switches, physical media).
2. Services Layer → Protects communication & network services (VoIP, VPN, messaging).
3. Applications Layer → Protects end-user applications (email, web apps, e-commerce).

2. Security Planes (Who is affected)

Defines which entity/role requires protection:
1. Management Plane → Protects network management functions (configuration, monitoring, updates).
2. Control Plane → Protects signaling & routing functions (call setup, routing protocols,
authentication).
3. User Plane → Protects actual user data/traffic being transmitted.
3. Security Dimensions (What type of protection)
Defines aspects of security that must be enforced across all layers/planes:
1. Access Control → Prevent unauthorized use of resources.
2. Authentication → Verify identity of users, devices, entities.
3. Non-repudiation → Prevent denial of actions (digital signatures, logs).
4. Data Confidentiality → Ensure privacy (encryption).
5. Communication Security → Protect data flows (VPN, IPSec, TLS).
6. Data Integrity → Prevent alteration of data (hashing, checksums).
7. Availability → Ensure resources/services are available (anti-DoS, redundancy).
8. Privacy → Protect personal/user information from disclosure.
b. How does the ITU security architecture guide the design of secure communication systems? Provide
one practical application scenario (e.g., secure VoIP, secure cloud storage).
Ans. Role of ITU Security Architecture in Designing Secure Systems :
The ITU-T X.805 framework provides a structured approach to security by answering:
• Where to apply security → Security Layers (Infrastructure, Services, Applications)
• Who/What to protect → Security Planes (User, Control, Management)

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
• What protections are needed → Security Dimensions (8 core aspects: Access Control, Authentication,
Non-repudiation, Confidentiality, Communication Security, Integrity, Availability, Privacy)
This ensures that no aspect is missed when building secure communication systems.

Practical Scenario: Secure VoIP (Voice over IP)

Problem: VoIP is vulnerable to eavesdropping, spoofing, denial-of-service, and call hijacking.
Applying ITU Security Architecture:
1. Security Layers
o Infrastructure Layer: Secure routers/switches with firewalls, IPSec tunnels.
o Services Layer: Protect SIP signaling (TLS), RTP streams (SRTP).
o Application Layer: VoIP client authentication, encrypted voicemail.
2. Security Planes
o User Plane: Encrypt voice traffic (SRTP) → prevents eavesdropping.
o Control Plane: Protect SIP call setup with TLS → prevents spoofing/hijacking.
o Management Plane: Role-based access for VoIP server admins, logs for auditing.
3. Security Dimensions Applied
o Access Control: Only registered users can initiate calls.
o Authentication: SIP Digest Authentication, certificates.
o Confidentiality: End-to-end encryption of RTP streams.
o Integrity: SIP message integrity checks.
o Availability: Redundant VoIP servers to prevent DoS.
o Privacy: Caller ID masking.

Alternative Example: Secure Cloud Storage

• Infrastructure Layer: Protect physical servers and virtualization.
• Services Layer: Secure APIs, encrypted storage.
• Application Layer: User authentication & access control.
• Planes:
o User Plane → secure file transfers (HTTPS, SFTP).
o Control Plane → secure API keys.
o Management Plane → admin access logging.
• Dimensions: Confidentiality (AES encryption), Integrity (hash checks), Availability (replication,
backup), Privacy (GDPR compliance).
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
4. Reflect: You are asked to secure data transmission across a public network for a government
agency. Using the OSI/TCP-IP reference models and the ITU security architecture, outline a
multi-layered defense strategy.
Ans. Multi-Layered Defense Strategy for Government Data Transmission :

Layer Defense Strategy Examples / Tools

Strong passwords, MFA, digital signatures,

Application (OSI 7 / Secure applications &
secure coding, API security, intrusion
TCP-IP Application) user authentication
detection at app-level

Presentation (OSI 6 / Encrypt & encode SSL/TLS, AES encryption, PKI certificates,
merged in TCP-IP App) sensitive data data compression with integrity checks

Session (OSI 5 / merged Secure sessions to Session tokens, Kerberos, secure cookies,
in TCP-IP App) prevent hijacking timeout policies

Transport (OSI 4 / TCP- Ensure reliable, TLS over TCP, VPN tunnels, port hardening,
IP Transport) confidential transport DoS/DDoS protection

Network (OSI 3 / TCP- Secure routing & IPSec, firewalls, intrusion prevention (IPS),
IP Internet) addressing BGP/OSPF authentication

Data Link (OSI 2 / Control access at LAN MAC filtering, VLAN segmentation, ARP
TCP-IP Link) level inspection, switch security

Physical (OSI 1 / TCP- Secure physical Restricted access to cables/servers, CCTV,

IP Link) infrastructure shielding, anti-tampering devices

2. ITU-T X.805 Security Architecture Perspective :

a. Security Layers
• Infrastructure Layer → Protect government routers, firewalls, data centers with hardened OS,
patches.
• Services Layer → Protect communication services (VPN, DNSSEC for secure name resolution,
email gateways).
• Applications Layer → Secure apps used by government employees (secure email, encrypted
document sharing, classified portals).
b. Security Planes
• User Plane → End-to-end encryption of all government traffic (VPN/IPSec + TLS).
• Control Plane → Protect routing protocols and signaling (OSPF/BGP authentication, TLS for SIP if
VoIP is used).
• Management Plane → Secure admin access (role-based access, MFA, secure logging, SIEM
monitoring).
c. Security Dimensions (all 8 applied)

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
1. Access Control → RBAC, firewalls, network segmentation.
2. Authentication → Smart cards, MFA, PKI-based digital certificates.
3. Non-repudiation → Digital signatures, audit logs.
4. Confidentiality → AES-256, TLS, IPSec VPNs.
5. Communication Security → VPN tunnels, secure routing, anti-jamming.
6. Data Integrity → Hashing (SHA-256), file integrity monitoring.
7. Availability → Redundant servers, load balancers, anti-DDoS.
8. Privacy → Data minimization, compliance with national privacy laws.

3. Integrated Defense-in-Depth Strategy

• End-to-End Encryption → Data encrypted at application layer (TLS, PKI) and transport layer (IPSec
VPN).
• Segmentation & Firewalls → Network divided into zones (public DMZ, internal LAN, classified
LAN).
• Intrusion Detection & Monitoring → IDS/IPS at network layer + SIEM in management plane.
• Authentication & Authorization → PKI smart cards, MFA for employees, role-based access.
• Resilience → Redundant data centers, DDoS mitigation, disaster recovery plans.

Assignment 2: Zero Trust and Network Security Management

1. Zero Trust Model :

a. Define the Zero Trust security Model.
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Ans. The Zero Trust Security Model is a cybersecurity framework based on the principle of “never
trust, always verify.”
• Unlike traditional perimeter-based security (which trusts everything inside the network), Zero Trust
assumes that no user, device, or application should be trusted by default, even if it is already inside
the organizational network.
• Access is granted based on continuous verification of identity, device health, context, and least-
privilege principles.

b. List and explain at least three core principles.

Ans . Core Principles of Zero Trust :
1. Verify explicitly → Authenticate and authorize every request using strong identity (MFA, biometrics,
PKI).
2. Least privilege access → Give users/devices only the minimum access required, with just-in-time
and just-enough-access.
3. Assume breach → Design as if attackers are already in the network; segment, monitor, and log
everything.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
[Link] a Zero Trust-based security architecture for a university campus network using a labeled
diagram.
Ans. Core Principles in Action (University Context):
1. Never Trust, Always Verify:
o No device, user, or application is inherently trusted, regardless of whether it's connecting
from a campus lab, a dorm room, or off-campus.
o Every access request to any resource (e.g., academic servers, student info system, library
database) must be explicitly authenticated and authorized.
2. Explicitly Verify (Who, What, Where, When, How):
o User Identity:
▪ Students: Valid university ID, password, and MFA (e.g., DUO Push, Google
Authenticator).
▪ Faculty/Staff: University ID, stronger password policies, MFA, and potentially
biometric checks for highly sensitive systems.
▪ Guests: Limited access via sponsored accounts or self-registration with stricter usage
policies.
o Device Health/Posture:
▪ Before allowing access, checks are performed: Is the device university-owned or
personal? Is antivirus software updated? Is the OS patched? Is there disk encryption?
▪ Non-compliant devices are either denied access or placed in a remediation zone until
issues are resolved.
o Location & Context: Access policies can vary based on the user's location (on-campus vs.
off-campus), time of day, and the sensitivity of the resource being accessed.
o Resource Sensitivity: A student accessing their grades might have different requirements than
a researcher accessing confidential patient data.
3. Least Privilege Access:
o Role-Based Access Control (RBAC): Access is granted based on the user's role (e.g.,
"Undergraduate Student," "Physics Faculty," "HR Staff").
o Just-Enough Access (JEA): A student only gets access to academic portals, course materials,
and their personal records. They don't have access to faculty HR data.
o Just-in-Time Access (JIT): An IT support technician might only get elevated access to a
specific server for a limited time to perform maintenance.
4. Assume Breach (Micro-segmentation):
o The entire campus network is segmented into isolated zones (micro-segments).
o Examples of Segments:
▪ Student Wi-Fi (Eduroam)
▪ Faculty/Staff Network
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
▪ Research Labs (highly isolated)
▪ Student Information System (SIS) servers
▪ Academic Department Servers
▪ Library Resources
▪ IoT Devices (HVAC, cameras)
o If an attacker breaches one segment (e.g., a student's compromised laptop on the Wi-Fi), they
are contained and cannot easily move laterally to sensitive systems like the SIS.
5. Multi-Factor Authentication (MFA) Everywhere:
o MFA is enforced for all access points, especially for critical applications and services. This
significantly reduces the risk of compromised passwords.
6. Continuous Monitoring & Analytics:
o SIEM (Security Information and Event Management): Collects and analyzes logs from all
network devices, endpoints, and applications.
o UBA (User Behavior Analytics): Detects unusual user behavior (e.g., a student trying to
access financial records, or logging in from an unusual location).
o Threat Detection: Real-time analysis for malware, intrusions, and policy violations. This
helps in rapid response to potential threats.
Key Components in the Diagram:
• Identities (Users & Devices): Represents all entities requesting access.
• Identity & Access Management (IAM): Manages user identities, roles, and device health/posture
checks. Integrates with university directories (e.g., LDAP, Active Directory).
• Multi-Factor Authentication (MFA): Adds an extra layer of security for user verification.
• Policy Decision Point (PDP) / Security Orchestrator: The "brain" of the Zero Trust model. It takes all
contextual information (user, device, resource, location, time) and decides whether to grant, deny, or
restrict access based on defined policies.
• Policy Enforcement Point (PEP): Actively enforces the decisions made by the PDP (e.g., firewalls,
micro-segmentation gateways, API gateways).
• Campus Resources: The various servers, applications, and networks that users want to access.
• Micro-segmentation: The logical division of the network into smaller, isolated security zones
around specific resources.
• Continuous Monitoring & Analytics: Constantly observing the network for anomalies, threats,
and policy violations. This feeds back into the PDP for dynamic policy adjustments.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
2. LAN Management & Operating Systems:
a. List common LAN management tasks, with emphasis on securing resources and monitoring
performance.
Ans.
Common LAN Management Tasks :
1. User & Access Management
• User account creation & deletion
• Assigning roles and privileges (least privilege principle)
• Enforcing authentication methods (passwords, MFA, biometrics)
• Access control lists (ACLs) to secure shared folders, printers, and applications

2. Resource Security
• Configuring file/folder permissions and shared drive security
• Implementing firewalls and intrusion detection/prevention systems (IDS/IPS)
• Applying encryption (SSL/TLS, VPN) for sensitive traffic
• Regular patch management for OS and LAN devices
• Protecting network devices (routers, switches) with strong admin passwords & role-based access

3. Performance Monitoring
• Monitoring network traffic and bandwidth usage
• Using SNMP (Simple Network Management Protocol) or tools like Nagios, PRTG, SolarWinds
• Identifying bottlenecks or misconfigured devices
• Tracking uptime/downtime of LAN resources
• Monitoring QoS (Quality of Service) for VoIP, video conferencing, etc.

4. Fault Management
• Detecting, isolating, and resolving LAN faults quickly
• Maintaining logs of incidents for auditing
• Setting up alert systems for outages or suspicious activities

5. Configuration & Change Management

• Standardizing device configurations (routers, switches, servers)
• Documenting all changes (for auditing and rollback)
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
• Using automated tools for configuration backups

6. Backup & Recovery

• Regular data backups (local + offsite/cloud)
• Disaster recovery plans to ensure business continuity
• Testing restoration procedures

b. Discuss how operating system security features (user permissions, auditing, process isolation)
support LAN security.
Ans.
How OS Security Features Support LAN Security :
1. User Permissions (Access Control)
• OS manages who can access what in the LAN.
• Permissions on files, folders, printers, and applications prevent unauthorized access.
• Supports least privilege principle → users only get access to resources they need.
• Example:
o In Windows Active Directory, admins set NTFS permissions & group policies for LAN users.
o In Linux, chmod/chown ensures only authorized LAN users can access shared directories.
LAN Impact: Protects sensitive resources from insider misuse or accidental changes.

2. Auditing & Logging

• OS keeps event logs (logins, file access, configuration changes).
• Helps detect suspicious behavior, unauthorized access, or malware activity.
• Supports accountability and non-repudiation (who did what, when).
• Example:
o Windows Event Viewer logs failed login attempts.
o Linux syslog or auditd tracks user commands.
LAN Impact: Enables monitoring and forensic analysis of LAN security incidents.

3. Process Isolation
• OS ensures each process runs in its own protected memory space.
• Prevents one compromised process (e.g., a malicious app) from interfering with others.
• Supports sandboxing for untrusted applications.
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
• Example:
o Web browser processes are isolated, so a compromised tab cannot affect the LAN file server.
o In Linux, chroot jails/containers isolate services exposed to the LAN.
LAN Impact: Containment of threats → limits spread of malware or attacks across LAN services.

4. Case Study: A university experiences lateral movement of malware within its LAN. Use Zero
Trust and advanced LAN management controls to propose a step-by-step mitigation plan.
Ans.
Case Study: Mitigation Plan for Malware Lateral Movement :
Scenario:
• A university’s LAN has malware spreading laterally between computers, servers, and network
devices.
• Goal: Contain and prevent further spread, while securing resources.

Step 1: Immediate Containment

1. Segment the Network
o Divide LAN into zones (students, faculty, servers, labs).
o Isolate infected segments to prevent further malware spread.
o Use VLANs and ACLs on switches and routers.
2. Quarantine Infected Machines
o Temporarily disconnect infected endpoints from LAN.
o Notify users and IT team.

Step 2: Identify and Assess

1. Monitor Traffic & Logs
o Use SNMP, NetFlow, or SIEM tools to detect abnormal lateral connections.
o Analyze logs from servers, switches, and firewalls.
2. Scan and Detect Malware
o Run endpoint security tools, antivirus, and EDR solutions.
o Identify malware types, affected machines, and entry points.

Step 3: Apply Zero Trust Principles

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
1. Verify Explicitly
o Enforce strong authentication (MFA) for all LAN users.
o Re-authenticate all devices and users before allowing access to sensitive zones.
2. Least Privilege Access
o Limit users and devices to only required resources.
o Temporarily revoke unnecessary privileges for infected segments.
3. Assume Breach / Continuous Monitoring
o Continuous monitoring of endpoint behavior.
o Apply behavioral analytics to detect unusual lateral movement.

Step 4: Strengthen LAN Management Controls

1. User & Access Management
o Review and update user accounts, disable unused accounts.
o Implement role-based access control (RBAC) across LAN resources.
2. Patch Management & Hardening
o Apply OS and application patches to all endpoints.
o Hardening servers, switches, and routers.
3. Process & Device Isolation
o Enable process isolation or sandboxing on critical servers and endpoints.
o Limit inter-device communication to essential traffic.
4. Auditing & Logging
o Enable auditing on sensitive resources.
o Track access attempts, failed logins, and anomalous behaviors.

Step 5: Recovery & Prevention

1. Clean & Restore Infected Systems
o Remove malware, restore from known-good backups.
o Reconnect systems only after verification.
2. Network Segmentation & Microsegmentation
o Apply VLANs, subnets, and firewall policies to reduce attack surface.
3. User Education
o Train students and staff on phishing, malware awareness, and secure practices.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
4. Deploy Advanced Security Tools
o Endpoint Detection & Response (EDR)
o Network Access Control (NAC)
o Next-gen firewalls with threat intelligence

Step 6: Continuous Improvement

• Conduct post-incident review and update LAN security policies.
• Implement regular penetration testing and simulated attack drills.
• Integrate Zero Trust monitoring into routine LAN management.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Assignment 3: Web Security, Digital Certificate, and PKI
1. Web Security:
a. Identify and explain three common web application vulnerabilities (e.g., XSS, SQL Injection,
CSRF).
Ans.
a. Common Web Application Vulnerabilities
1. Cross-Site Scripting (XSS)
• Definition: A vulnerability where an attacker injects malicious scripts into web pages viewed by
other users.
• Impact: Can steal cookies, session tokens, or perform actions on behalf of the user.
• Types:
o Stored XSS: Malicious script saved on server (e.g., forum post, database).
o Reflected XSS: Script reflected via URL or form input.
o DOM-based XSS: Script manipulated on client-side DOM.
• Example:
• <script>alert([Link])</script>
Injected into a comment field, executes when another user views it.
• Mitigation: Input validation, output encoding, Content Security Policy (CSP).

2. SQL Injection (SQLi)

• Definition: Attack where malicious SQL commands are injected into an application’s input fields,
manipulating the database.
• Impact: Unauthorized data access, data modification, deletion, or even administrative takeover.
• Example:
• ' OR '1'='1
Entered into a login field may bypass authentication.
• Mitigation: Parameterized queries / prepared statements, input validation, least-privilege database
accounts.

3. Cross-Site Request Forgery (CSRF)

• Definition: An attack that tricks an authenticated user into performing unintended actions on a web
application.
• Impact: Attacker can transfer funds, change passwords, or perform other actions without user
consent.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
• Example: Malicious link or hidden form on another site triggers a bank transfer when the user is
logged in.
• Mitigation: Use CSRF tokens, enforce same-site cookies, validate Referer headers.
b. For each, describe prevention strategies.
Ans.
Perfect! Let’s detail prevention strategies for XSS, SQL Injection, and CSRF in a clear, exam-ready
format.

b. Prevention Strategies for Common Web Vulnerabilities

Vulnerability Prevention Strategies

1. Input Validation: Only allow expected characters in user inputs.

2. Output Encoding/Escaping: Encode special characters before rendering
in HTML/JS.
Cross-Site Scripting (XSS) 3. Content Security Policy (CSP): Restrict execution of scripts from
untrusted sources.
4. Use Safe APIs: Avoid innerHTML, prefer textContent or templating
engines.

1. Parameterized Queries / Prepared Statements: Separate SQL code from

data.
2. Stored Procedures: When safely implemented.
3. Input Validation / Sanitization: Reject unexpected characters or patterns.
SQL Injection (SQLi)
4. Least Privilege Database Accounts: Limit access to only necessary
operations.
5. ORMs (Object-Relational Mapping): Automatically handle queries
safely.

1. CSRF Tokens: Include unique tokens in forms and verify on server.

2. SameSite Cookies: Restrict cookies to same-site requests only.
Cross-Site Request Forgery 3. Validate Referer / Origin Header: Ensure request originates from trusted
(CSRF) source.
4. Require Re-authentication: For sensitive actions like password change or
fund transfer.

2. Digital Certificate a and PKI:

a. Explain what a digital certificate is and how it is issued through Public Key Infrastructure (PKI).
Ans.
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
a. Digital Certificate and PKI
1. What is a Digital Certificate?
• A digital certificate is an electronic credential that binds a public key to an entity’s identity (person,
organization, or device).
• It ensures authentication, integrity, and non-repudiation in digital communications.
• Contents of a typical digital certificate:
o Owner’s name / organization
o Public key
o Certificate Authority (CA) information
o Validity period
o Digital signature of the CA
Example: Used in HTTPS websites (SSL/TLS) to prove the server’s identity.

2. How Digital Certificates are Issued through PKI

Step-by-Step PKI Process
1. Key Generation
o The entity (user/organization) generates a public-private key pair.
o Private key is kept secret; public key will be shared.
2. Certificate Signing Request (CSR)
o The entity creates a CSR containing its public key and identity details.
o The CSR is sent to a Certificate Authority (CA).
3. Verification by CA
o The CA verifies the entity’s identity (domain ownership, organization documents, etc.).
4. Certificate Issuance
o After verification, the CA signs the certificate with its private key, binding the public key to
the entity.
5. Certificate Usage
o The entity installs the certificate on a server or device.
o Other users verify the certificate using the CA’s public key to ensure authenticity.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
b. Illustrate with a diagram the process of establishing a secure SSL/TLS session between a client and
a server, including certificate validation steps.
Ans.
The TLS Handshake is a cryptographic dance between a client (like your web browser) and a server (like a
website) to securely set up an encrypted connection. It involves several steps to verify the server's identity,
agree on encryption methods, and exchange keys, ensuring that all subsequent communication is private and
secure. The core idea is: "Verify identity, agree on secrets, then talk privately."

SSL/TLS Secure Session Establishment

Goal: Establish a secure communication channel between a client and a server using encryption,
authentication, and integrity.

Step-by-Step Process

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
1. Client Hello
o Client sends a “Hello” message to the server.
o Includes: supported TLS version, cipher suites, and a random number.
2. Server Hello + Certificate
o Server responds with its chosen TLS version and cipher suite.
o Sends its digital certificate (signed by a trusted CA).
o Optionally sends server key exchange parameters if using ephemeral keys.
3. Certificate Validation by Client
o Client checks:
1. Certificate is signed by a trusted CA.
2. Certificate is valid (dates not expired).
3. Certificate matches the server domain name.
o If valid, the client proceeds; otherwise, connection is terminated.
4. Key Exchange & Session Key Generation
o Client generates a pre-master secret (or uses Diffie-Hellman ephemeral keys).
o Encrypts it with server’s public key from the certificate and sends it to the server.
o Both client and server compute the session key from this pre-master secret.
5. Finished Messages
o Both sides send “Finished” messages encrypted with the session key to confirm secure setup.
6. Secure Communication Established
o All subsequent data is encrypted using the session key.

3. Lab Task:
Using OpenSSL or an equivalent tool, generate a self signed certificate and use it to secure a
simple web server (e.g., Apache or Python HTTP server). Provide screenshots and a stepwise
command log.
Ans.

Steps to Generate Self-Signed SSL Certificate with OpenSSL

Step 1: Generate a Private Key

Creates a 2048-bit private key file named [Link].

Step 2: Generate a Certificate Signing Request (CSR)

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II

You will be asked details:

Step 3: Generate Self-Signed Certificate

Creates a certificate [Link] valid for 365 days.

Steps to Secure a Simple Python HTTPS Server

Step 4: Create a Test Python HTTPS Server
Save this as https_server.py:

Step 5: Run the HTTPS Server

python3 https_server.py

Terminal output:
Serving on [Link]

Step 6: Test in Browser

• Open browser → visit: [Link]
• Browser will show a “Self-signed certificate” warning (normal for self-signed certs).
• Proceed → see the directory listing or your web content.

4. Reflection: Discuss the importance of certificate authorities (CAs) and the risks posed by
compromised or rogue CAs.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Ans.
Reflection: Importance of Certificate Authorities (CAs) and Risks of Compromise
1. Importance of Certificate Authorities (CAs)
A Certificate Authority (CA) is a trusted third party that issues digital certificates, binding public keys to
entities’ identities. They play a crucial role in Public Key Infrastructure (PKI).
Key Roles of CAs:
1. Authentication: Verify the identity of organizations, websites, or individuals before issuing
certificates.
2. Trust Establishment: Serve as a trusted anchor for HTTPS and secure communications. Clients trust
certificates signed by recognized CAs.
3. Data Integrity & Confidentiality: Enable encrypted communication (SSL/TLS) to prevent
eavesdropping and tampering.
4. Non-repudiation: Ensure actions (like signing documents) can be traced and verified to the entity
owning the certificate.
Example: Browsers trust websites with certificates signed by recognized CAs (e.g., DigiCert, Let’s Encrypt).

2. Risks Posed by Compromised or Rogue CAs

If a CA is compromised or malicious, it can undermine the entire trust system.
Major Risks:
1. Man-in-the-Middle (MITM) Attacks:
o Attacker can issue fake certificates for legitimate domains.
o Users unknowingly communicate with the attacker instead of the real server.
2. Impersonation of Organizations:
o Rogue certificates allow attackers to pretend to be trusted websites or services.
3. Data Breaches & Privacy Violations:
o Confidential data (passwords, financial info) can be intercepted.
4. Erosion of Trust:
o Users and applications may no longer trust SSL/TLS if CAs are not reliable.
5. Revocation Issues:
o Detecting and revoking compromised certificates can be slow, leaving systems exposed.
Historical Example:
• DigiNotar hack (2011): Attacker issued fake Google certificates in Iran, enabling MITM attacks.

3. Reflection / Key Takeaways

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
• CAs are the backbone of digital trust; all SSL/TLS communication relies on their integrity.
• Compromised or rogue CAs can completely break internet security, allowing attackers to intercept
data, impersonate sites, or bypass authentication.
• Mitigation strategies:
o Use certificate pinning in apps.
o Regularly check certificate revocation lists (CRLs) or OCSP.
o Rely on reputable CAs with strong security practices.

Assignment 4: Firewalls, IDS/IPS, and VPNs

1. Firewalls: a. Define what a firewall is and enumerate at least three different types (e.g., packet-
filtering, stateful, application layer).
Ans.
Firewalls: Definition and Types :
1. Definition of a Firewall
A firewall is a network security device or software that monitors, filters, and controls incoming and outgoing
network traffic based on a set of predefined security rules.
• Purpose: Protect internal networks from unauthorized access, malware, and attacks while allowing
legitimate traffic.
• Acts as a barrier between trusted (internal) and untrusted (external) networks.

2. Types of Firewalls

Type Description Example / Use Case

Simple rule-based filtering on a

Packet-Filtering Inspects individual packets and filters them based on
router to block port 80 from
Firewall IP addresses, ports, and protocols.
external networks.

Tracks the state of active connections and makes Corporate network firewall
Stateful Firewall decisions based on connection context (e.g., is this allowing return traffic only for
packet part of an established session?). initiated connections.

Inspects traffic at the application layer (Layer 7), Web application firewall (WAF)
Application Layer
including content, URLs, and commands. Can block protecting against SQL Injection
(Proxy) Firewall
specific applications or malicious payloads. or XSS.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Type Description Example / Use Case

Palo Alto, Fortinet, or Cisco

Next-Generation Combines stateful inspection, application awareness,
NGFW securing enterprise
Firewall (NGFW) intrusion prevention, and deep packet inspection.
networks.

Circuit-Level Monitors TCP/UDP handshakes and ensures sessions Used in small VPNs or simple
Gateway are valid without inspecting packet content. proxy connections.

b. Draw a table comparing their strengths and limitations for securing an enterprise network.
Comparison of Firewall Types

Firewall Type Strengths Limitations

- Cannot inspect payload/content - Cannot

- Simple and fast - Low resource usage -
Packet-Filtering detect sophisticated attacks - No session
Easy to configure
awareness

- Tracks connection states - Blocks - Cannot inspect application data -

unauthorized packets from unestablished Vulnerable to application-layer attacks -
Stateful Firewall
sessions - Better security than packet- More resource intensive than packet-
filtering filtering

- Inspects full content and application

Application - Slower due to deep inspection - More
requests - Can block malware, SQLi, XSS,
Layer (Proxy) complex to configure - Higher resource
and specific apps - Provides granular
Firewall usage
control

- Combines stateful + application + IPS - - Expensive - Requires skilled

Next-Generation
Detects sophisticated threats - Centralized administrators - Can introduce latency
Firewall (NGFW)
management and reporting under heavy traffic

- Cannot inspect content - Limited security

Circuit-Level - Simple session validation - Lightweight
against modern attacks - Rarely used in
Gateway for small networks
large enterprises

3. Intrusion Detection and Prevention:

a. Differentiate between IDS and IPS.
Ans.

Feature IDS (Intrusion Detection System) IPS (Intrusion Prevention System)

Primary Detects and alerts on suspicious activity Detects and blocks/prevents suspicious activity
Function or attacks in real-time

Action on Generates alerts; does not block traffic Can block, drop, or redirect malicious traffic
Threat automatically automatically

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Feature IDS (Intrusion Detection System) IPS (Intrusion Prevention System)

Position in Usually passive (out-of-band), monitors

Inline (in-band), directly in the traffic path
Network copies of traffic

Response Time Slower; relies on administrator action Faster; acts immediately to prevent attacks

Impact on Minimal, since it does not affect traffic Can introduce latency or disruption if
Network flow misconfigured

Snort in IPS mode, Cisco Firepower, Fortinet

Examples Snort in IDS mode, OSSEC, Suricata IDS
NGFW with IPS

Use Case Monitoring, alerting, forensic analysis Real-time prevention, automated defense

b. Compare network-based vs. host-based IDS/IPS using a table.

Ans.
b. Network-Based vs Host-Based IDS/IPS

Network-Based IDS/IPS
Feature Host-Based IDS/IPS (HIDS/HIPS)
(NIDS/NIPS)

Deployment Deployed on network segments; Installed on individual hosts/servers; monitors

Location monitors all traffic on the network local system activity

Monitors network traffic, protocols, and Monitors system files, logs, processes, and
Primary Focus
packets system calls

Detection Scope Can detect attacks across multiple hosts Detects attacks specific to the host

Examples of Port scans, DoS attacks, suspicious File integrity changes, unauthorized logins,
Monitored Activity packets, protocol anomalies malware, system policy violations

- Covers multiple devices- Can detect - Detects internal/host-specific attacks- Can

Advantages network-wide attacks- Centralized see attacks that bypass the network- Granular
monitoring monitoring

- Cannot see encrypted traffic easily-

- Must be installed on each host- Limited
Limitations May generate false positives from
visibility into network-wide threats
heavy traffic

Less impact on individual hosts; may Consumes host resources; may affect
Resource Usage
need dedicated appliance performance

c. Describe signature-based vs. anomaly-based detection, with one example of each.

Ans.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Feature Signature-Based Detection Anomaly-Based Detection

Compares network or system activity Detects activity that deviates from normal
Detection
against a database of known attack behavior (baseline of normal system/network
Method
signatures activity)

High for known attacks, low for Can detect unknown or zero-day attacks, but may
Accuracy
new/unknown attacks generate more false positives

Updates Requires constant signature updates from Requires continuous learning of normal behavior
Required vendor patterns

Resource Can be resource-intensive due to monitoring and

Usually lightweight, simple to implement
Usage analysis of patterns

Snort IDS using predefined attack OSSEC HIDS detecting unusual login attempts
Example
signatures or file changes

4. Virtual Private Networks:

a. Define VPN and describe at least two major types (e.g., site-to-site,
Ans.

a. Virtual Private Network (VPN) and Types

1. Definition of VPN
A Virtual Private Network (VPN) is a secure communication tunnel that allows users or sites to send and
receive data over a public network (like the Internet) as if connected to a private network.
Key Features:
• Provides encryption for data confidentiality.
• Ensures authentication of users or sites.
• Maintains data integrity to prevent tampering.
• Can provide remote access or site-to-site connectivity securely.

2. Major Types of VPN

Type Description Example / Use Case

Connects two or more fixed networks Company HQ network connected to

Site-to-Site
over the Internet. Devices at each site branch offices securely over the
VPN
communicate as if on the same LAN. Internet. Protocols: IPsec, MPLS VPN.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
Type Description Example / Use Case

Provides individual users with secure Employees working from home

Remote
access to a private network from a remote connect securely to corporate network.
Access VPN
location. Protocols: SSL/TLS VPN, IPsec VPN.

- Layer 2 Tunneling Protocol (L2TP Layer 2 VPN connects Ethernet

Other Types
VPN) - SSL VPN for browser-based frames, SSL VPN allows secure web
(Optional)
access access

b. Compare VPN protocols: IPSec vs. SSL/TLS (tabular format).

Ans.
Comparison of VPN Protocols: IPSec vs SSL/TLS

Feature IPSec VPN SSL/TLS VPN

Layer in OSI Transport Layer (Layer 4) / Application

Network Layer (Layer 3)
Model Layer (Layer 7)

Scope of Encrypts all IP traffic between Encrypts specific applications or sessions

Protection endpoints (usually web-based)

Client Requires VPN client software Can often use standard web browser;
Requirement installed on user device client software optional

Remote Access VPNs for web

Site-to-Site VPNs, Remote Access
Use Case applications, SSL-based access to internal
with full network access
apps

Authentication Pre-shared keys, digital Username/password, digital certificates,

Methods certificates, RSA signatures multi-factor authentication

Strong encryption at IP layer Strong encryption at transport layer

Encryption
(ESP/AH protocols) (TLS/SSL)

- Protects all traffic - Transparent

- Easy deployment - Browser-based access
Advantages to applications - Suitable for full
- No full client installation required
network access

- Requires client configuration - - Limited to application-level access -

Limitations Complex for remote users - May Cannot secure non-web traffic - Less
require firewall adjustments suitable for site-to-site VPNs

c. Diagram a secure remote access setup for employees using VPN.

Ans.

Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II

5. Scenario Analysis:
You are the security architect for a global company. Describe, with justification, a multi-
layered approach using firewalls, IDS/IPS, and VPNs to protect sensitive data as users connect
from branch offices and remote locations.

Ans.
Scenario: Multi-Layered Security for a Global Company

Context: Users connect from branch offices and remote locations; sensitive data must be protected
across the network.

1. Perimeter Defense with Firewalls

• Deploy firewalls at branch offices and corporate HQ:
o Packet-filtering/stateful firewalls at branch edges to control traffic by IP, port, and protocol.
o Application-layer firewalls / WAFs at corporate data centers to protect web applications.
• Justification:
o Blocks unauthorized access from the Internet.
Akhil Nautiyal E1 09
 TCS 795 - Security Audit and Compliance - II
o Filters malicious traffic before it reaches internal systems.

2. Intrusion Detection and Prevention (IDS/IPS)

• Deploy network-based IDS/IPS (NIDS/NIPS):
o Monitor traffic flowing between branches, HQ, and Internet.
o Detect anomalies, known attack signatures, or suspicious behavior.
• Deploy host-based IDS/IPS (HIDS/HIPS):
o Protect sensitive servers (databases, application servers) from internal or lateral attacks.
• Justification:
o Provides real-time detection and prevention of attacks that bypass firewalls.
o Layered monitoring ensures both network-wide and host-level protection.

3. Secure Remote Access with VPNs

• Remote users:
o Use SSL/TLS VPN for browser-based access to internal applications.
o Optionally use IPSec VPN for full network access from trusted devices.
• Branch offices:
o Use site-to-site IPSec VPNs connecting branch LANs to HQ securely over the Internet.
• Justification:
o Encrypts data in transit across public networks.
o Ensures confidentiality, integrity, and authentication for users connecting remotely or from
branches.

4. Multi-Layered Approach Overview

1. Firewall (Perimeter Security) → Filters traffic, blocks unauthorized access.
2. IDS/IPS (Detection & Prevention) → Detects attacks, prevents lateral movement.
3. VPN (Encrypted Tunnels) → Protects sensitive data in transit for remote and branch connections.
Additional Measures:
• Segment networks using VLANs to minimize lateral movement.
• Enforce least privilege access via authentication and role-based access control.
• Monitor logs and implement continuous auditing for compliance and forensic analysis.

5. Diagram (Textual Flow Example)

Remote Users ---> [SSL/TLS VPN] ---> Firewall ---> NIDS/NIPS ---> Corporate LAN / Servers
Branch Office ---> [Site-to-Site IPSec VPN] ---> Firewall ---> NIDS/NIPS ---> Corporate LAN /
Servers
• Sensitive data only flows through encrypted VPN tunnels.
• All traffic passes firewall and IDS/IPS inspection before reaching corporate resources.

Akhil Nautiyal E1 09