ENDSEM IMP COMPUTER NETWORK SECURITY UNIT – 6

Q.1] Differentiate between Symmetric and Asymmetric Key Cryptography

ANS:
Symmetric Key Cryptography:
 Key Utilization: In symmetric key cryptography, the same key is used for both
encryption and decryption of the data.
 Efficiency: It's faster and more efficient for large data encryption due to its
simpler algorithms.
 Key Distribution: The primary challenge is securely distributing the key to
both the sender and receiver as any compromise in the key can jeopardize the
security of the entire communication.
 Examples: Common algorithms include DES (Data Encryption Standard), AES
(Advanced Encryption Standard), and 3DES.
Asymmetric Key Cryptography (Public Key Cryptography):
 Key Utilization: In asymmetric key cryptography, two different keys (public
and private) are used: the public key for encryption and the private key for
decryption.
 Security and Key Distribution: Offers enhanced security by not requiring the
exchange of secret keys. Users can freely share their public keys without
compromising security.
 Complexity: Asymmetric key algorithms are computationally intensive and
slower than symmetric key algorithms.
 Examples: Common algorithms include RSA, ECC (Elliptic Curve
Cryptography), and Diffie-Hellman key exchange.
Use Cases:
 Symmetric Cryptography: Often used for encrypting data in storage, bulk
data transmission, and within closed systems where secure key distribution is
manageable.
 Asymmetric Cryptography: Primarily used for secure data transmission over
insecure networks (like the internet), digital signatures, key exchange, and
secure communication between unknown parties.
Q.2] Explain model for network security
ANS: Network security follows a layered model to implement various measures and
protocols aimed at protecting the integrity, confidentiality, and availability of data
and resources within a network. The network security model typically involves the
following layers:
1. Perimeter Security:
 Firewalls: Placed at the network perimeter, firewalls monitor and control
incoming and outgoing network traffic based on predefined security rules.
They help prevent unauthorized access and potential threats.
2. Access Control:
 Authentication: Verifies the identity of users or devices before granting access
to the network. It can involve passwords, biometrics, two-factor
authentication, etc.
 Authorization: After authentication, authorization ensures that authenticated
entities only have access to the resources they are allowed to use.
3. Secure Communication:
 Encryption: Encodes data to prevent unauthorized access during transmission.
It ensures that even if intercepted, the data remains unreadable without the
decryption key.
4. Network Monitoring:
 Intrusion Detection and Prevention Systems (IDS/IPS): These systems monitor
network traffic for malicious activity or policy violations. They can detect and
react to potential threats.
5. Segmentation and Isolation:
 VLANs (Virtual Local Area Networks): Segment the network logically,
isolating different parts of the network. This limits the reach of potential
threats.
6. Endpoint Security:
 Antivirus/Anti-malware: Installed on individual devices to protect against
malicious software.
 Patch Management: Ensures that devices have up-to-date software and
security patches to prevent vulnerabilities.
7. Security Policies and Training:
 Establishing Policies: Clearly defined security policies guide the network's
security measures and the behavior expected from users.
 User Training: Educating users about best practices, potential threats, and the
importance of security protocols to minimize human error and vulnerabilities.
Q.3] Give short note on Security Policy and mechanisms.
ANS:
Security Policy: A security policy is a set of rules, guidelines, and practices created to
protect an organization's information, assets, and technology infrastructure. It
outlines the measures and procedures required to maintain security and addresses
the principles, rules, and practices governing an organization's overall security
approach.
Key Components of a Security Policy:
 Access Control: Rules and procedures governing who can access what resources
and under what conditions.
 Data Protection: Guidelines to secure sensitive data through encryption,
backups, and access controls.
 Incident Response: Protocols for responding to security incidents, including
reporting, investigation, and recovery.
 Security Training and Awareness: Outlines employee training, awareness, and
their responsibilities in maintaining security.

Security Mechanisms: Security mechanisms are the technical means employed to

enforce a security policy. These mechanisms include technologies, tools, and
techniques that help enforce and maintain security in an organization's systems and
networks.
Types of Security Mechanisms:
 Encryption: Protects data by encoding it so only authorized parties can access
it.
 Firewalls: Control incoming and outgoing network traffic based on security
rules to prevent unauthorized access.
 Intrusion Detection/Prevention Systems (IDS/IPS): Monitor network traffic for
potential threats and take action against them.
 Access Control Systems: Restrict access to resources based on defined policies,
using technologies like biometrics, access cards, and authentication systems.
Q.4] Explain IPSec in detail.
ANS: IPsec (Internet Protocol Security) is a suite of protocols and algorithms used to
secure internet communications at the network layer. It provides a range of security
services, including authentication, integrity, confidentiality, and non-repudiation.
IPsec operates at the network layer (Layer 3) of the OSI model and can be used to
secure communications between devices or networks.
Components of IPsec:
1. Authentication Header (AH):
 Provides data integrity, authentication, and anti-replay protection for
the entire packet.
 Doesn’t offer encryption but ensures the packet’s integrity and
authentication.
2. Encapsulating Security Payload (ESP):
 Offers confidentiality, integrity, authentication, and anti-replay
protection for the packet’s payload (data).
 Provides encryption for the packet's payload to secure the actual
content of the communication.
Security Associations (SAs):
 An SA is a unidirectional connection between two parties, specifying the
security parameters for IPsec communication. It includes the algorithms, keys,
and security protocols agreed upon by both parties.
Modes of IPsec:
1. Transport Mode:
 Protects the payload of the IP packet. The original IP header remains
intact, while security measures are applied to the packet's payload.
 Typically used for end-to-end communication between two hosts.
2. Tunnel Mode:
 Protects the entire IP packet by encapsulating it within a new IP
packet. The original IP packet becomes the payload of the new IP
packet.
 Often used to establish secure communication between networks or
gateway-to-gateway connections.
Key Exchange:
 IPsec requires a secure method for establishing shared keys between
communicating entities. Common key exchange protocols include IKE
(Internet Key Exchange) and IKEv2.
Applications:
 IPsec is commonly used in VPNs (Virtual Private Networks) to secure remote
access, site-to-site connections, and ensure secure communication over
untrusted networks, such as the internet.
Q.5] Give short note on Firewalls
ANS: Firewalls are critical components of network security, acting as barriers
between a trusted internal network and untrusted external networks, such as the
internet. They function as gatekeepers, monitoring and controlling incoming and
outgoing traffic based on predetermined security rules.
Key Functions of Firewalls:
1. Packet Filtering:
 Examines packets of data entering or leaving a network and applies
predetermined rules to either block or allow them based on criteria like
source/destination IP addresses, port numbers, and protocols.
2. Stateful Inspection:
 Tracks the state of active connections by maintaining a state table. It
evaluates incoming packets not only on individual criteria but also
based on the context of the ongoing connection.
3. Proxying and Network Address Translation (NAT):
 Proxies act as intermediaries between internal and external networks,
examining and forwarding traffic. NAT translates internal IP addresses
to a single external address for outbound traffic, helping conceal
internal network structure.
4. Application Layer Filtering:
 Inspects data at the application layer of the OSI model, allowing deeper
analysis of the contents of the data packets. This enables filtering based
on specific applications or content.
5. Logging and Reporting:
 Maintains logs of allowed and denied traffic, aiding in security audits
and incident investigations.
Types of Firewalls:
1. Packet Filtering Firewalls:
 Filters packets based on predefined rules at the network layer.
2. Proxy Firewalls:
 Act as intermediaries between client and server communications,
inspecting data at the application layer.
3. Next-Generation Firewalls (NGFW):
 Combine traditional firewall capabilities with additional security
features such as intrusion prevention, deep packet inspection, and
application-level controls.
Use Cases:
 Protecting networks from unauthorized access, preventing cyber attacks,
filtering out malicious traffic, and regulating and controlling network traffic
based on security policies.
Q.6] Explain Types of Network Attacks.
ANS: Network attacks come in various forms, aiming to compromise the integrity,
confidentiality, or availability of data and systems. Here are several types of
network attacks:
1. Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) Attacks:
 DoS: Overwhelms a system or network by flooding it with traffic, rendering it
unavailable to legitimate users.
 DDoS: Employs multiple systems to launch a coordinated attack, amplifying
the impact and making mitigation more challenging.
2. Man-in-the-Middle (MitM) Attack:
 Intercepts communication between two parties, allowing the attacker to
eavesdrop, alter, or inject malicious content into the transmission without
either party's knowledge.
3. Phishing and Social Engineering:
 Phishing: Uses deceptive emails, messages, or websites to trick individuals into
disclosing sensitive information or performing certain actions.
 Social Engineering: Exploits human psychology to manipulate individuals into
revealing confidential information or performing actions that compromise
security.
4. Malware:
 Viruses: Self-replicating programs that attach themselves to files and spread
across systems.
 Worms: Spread independently without needing a host file and often exploit
network vulnerabilities.
 Trojans: Disguised as legitimate software but perform malicious activities
when activated.
 Ransomware: Encrypts files, demanding payment for decryption.
5. Spoofing Attacks:
 IP Spoofing: Forges source IP addresses in network packets to impersonate a
trusted entity or bypass security measures.
 DNS Spoofing: Redirects traffic by tampering with DNS records, leading users
to malicious websites.
6. Brute Force Attacks:
 Repeatedly tries various combinations of usernames and passwords to gain
unauthorized access to systems or accounts.
7. Insider Threats:
 Threats originating from within an organization, where employees,
contractors, or associates misuse their authorized access to cause harm or data
breaches.
8. Zero-Day Exploits:
 Attacks exploiting previously unknown vulnerabilities, often before a fix or
patch is available, making them more difficult to defend against.
9. Eavesdropping and Packet Sniffing:
 Intercepting and monitoring network traffic to gather sensitive information or
credentials.
Q.7] Give short note on S/MIME.
ANS: S/MIME (Secure/Multipurpose Internet Mail Extensions) is a protocol used to
secure and authenticate email communication. It's an industry-standard method for
securing email messages through encryption and digital signatures.
Key Aspects of S/MIME:
1. Encryption:
 S/MIME enables the encryption of email content, ensuring that only the
intended recipient can decrypt and read the message.
 It uses public-key cryptography to secure the email content, providing a
high level of confidentiality.
2. Digital Signatures:
 S/MIME allows users to digitally sign their emails, providing
authentication and integrity to the message.
 Signatures are created using the sender's private key and can be verified
using the sender's public key, ensuring the email's origin and content
haven't been altered.
3. Certificate-Based Approach:
 S/MIME relies on digital certificates issued by a trusted Certificate
Authority (CA) to establish the identity of the sender and recipient.
 Certificates contain public keys, email addresses, and other relevant
information.
4. Interoperability:
 It's widely supported across various email clients, making it accessible
and usable for a broad range of users and organizations.
5. Authentication and Confidentiality:
 Provides both authentication and confidentiality, ensuring that emails
are from the claimed sender and that their content is secure.
Q.8] Explain model for network security
ANS: Network security operates on a model encompassing various layers and
strategies to protect the integrity, confidentiality, and availability of data and
resources within a network. The model involves several layers, each addressing
specific aspects of security:
1. Perimeter Security:
 Firewalls: Placed at the network's edge, firewalls examine incoming and
outgoing traffic, enforcing predefined security rules to prevent unauthorized
access and potential threats.
 Intrusion Prevention Systems (IPS): Monitors network traffic for suspicious
activity and takes action to prevent potential threats.
2. Access Control:
 Authentication: Verifies the identity of users or devices before granting access,
often using passwords, biometrics, or two-factor authentication.
 Authorization: Determines what resources authenticated users can access
based on their privileges.
3. Secure Communication:
 Encryption: Protects data during transmission, ensuring that even if
intercepted, the content remains unreadable without the decryption key.
4. Network Monitoring:
 Intrusion Detection Systems (IDS): Monitors network traffic for signs of
potential attacks or security policy violations.
 Security Information and Event Management (SIEM): Collects and analyzes
security data to detect and respond to threats.
5. Segmentation and Isolation:
 Virtual Local Area Networks (VLANs): Divides a network logically to enhance
security by separating different segments, limiting the spread of potential
threats.
6. Endpoint Security:
 Antivirus/Anti-malware: Installed on individual devices to protect against
malicious software.
 Patch Management: Ensures that devices are up-to-date with software and
security patches.
7. Security Policies and Training:
 Policies: Establish guidelines and rules for maintaining security.
 Training: Educate users about best practices, potential threats, and the
importance of security protocols to reduce human error and vulnerabilities.
Q.9] Explain SSL in detail.
ANS: SSL (Secure Sockets Layer) is a cryptographic protocol used to secure data
transmitted over a network, commonly used to secure internet communications,
especially web browsing. It ensures confidentiality, integrity, and authentication
between clients and servers.
Key Aspects of SSL:
1. Encryption:
 SSL encrypts data transmitted between a web server and a browser,
making it unreadable to anyone intercepting the transmission.
 It uses asymmetric encryption to exchange symmetric session keys, which
are then used to encrypt the data during the session.
2. Authentication:
 SSL provides a level of authentication, confirming the identity of the
server to the client. This helps users verify the authenticity of the website
they are visiting.
 Extended validation (EV) SSL certificates offer enhanced authentication
by displaying the organization's name in the browser's address bar.
3. Integrity:
 SSL ensures the data's integrity during transmission. It uses hash
functions to verify that the data has not been altered or corrupted
during transit.
SSL Handshake Process:
1. Client Hello: The client initiates the connection by sending a "Hello" message
to the server, specifying supported encryption algorithms and SSL/TLS versions.
2. Server Hello: The server responds with its chosen encryption settings and sends
its digital certificate to the client.
3. Authentication and Key Exchange: The client verifies the server's certificate
and generates a shared session key for encryption.
4. Establishment of Encrypted Connection: Using the shared session key, both the
client and server start an encrypted session for secure data transmission.
Evolution to TLS (Transport Layer Security):
 SSL has evolved into TLS, an updated and more secure version of the protocol,
although the terms SSL and TLS are often used interchangeably. TLS builds
upon SSL and offers improved security and additional cryptographic
algorithms.
Use Cases:
 SSL/TLS is used in web browsing, email, file transfers, and other applications
that require secure communication over the internet.
Q.10] Draw and explain Operational Model of Network Security.
ANS:
DIAGRAM :

here's a simple and easy-to-understand explanation of the operational model of

network security:
1. Identification of Assets:
o Start by identifying all the assets in your network, including hardware,
software, data, and even personnel.
o This step helps you understand what needs protection and what
potential vulnerabilities exist.
2. Risk Assessment:
o Evaluate the potential risks and threats to your network assets.
o Determine the likelihood of these risks occurring and their potential
impact on your organization.
3. Security Policy Development:
o Create a set of rules and guidelines that define how your organization
will protect its network assets.
o This policy should cover areas such as access control, data protection,
incident response, and compliance.
4. Implementation of Security Controls:
o Deploy security measures based on your security policy to mitigate
identified risks.
o This includes implementing firewalls, encryption, access controls,
antivirus software, and other security technologies.
5. Monitoring and Detection:
o Continuously monitor the network for any unusual or suspicious
activities.
o Use intrusion detection systems (IDS), intrusion prevention systems (IPS),
and security information and event management (SIEM) tools to detect
and respond to security incidents in real-time.
6. Incident Response:
o Develop a plan for responding to security incidents when they occur.
o This plan should outline steps for containing the incident, mitigating its
impact, investigating the root cause, and restoring normal operations.
7. Security Awareness Training:
o Educate employees about best practices for maintaining network
security.
o This includes training on how to recognize phishing emails, the
importance of strong passwords, and the risks of downloading
unauthorized software.
8. Regular Testing and Evaluation:
o Conduct regular security assessments and penetration tests to identify
any weaknesses in your network defenses.
o Use the results of these tests to make improvements to your security
posture.
9. Continuous Improvement:
o Network security is an ongoing process that requires regular review and
adjustment.
o Stay up-to-date with the latest security threats and technologies, and be
prepared to adapt your security measures accordingly.
Q.11] Discuss the working of IPSec? What are the different security services
offered by IPSec?
ANS: IPSec (Internet Protocol Security) is a framework for securing Internet Protocol
(IP) communications by authenticating and encrypting each IP packet in a data
stream. Here's how it works and the security services it offers, simplified into easy-
to-understand points:
1. Authentication Header (AH):
o Provides data integrity, ensuring that the contents of the packet have
not been tampered with during transmission.
o Authenticates the sender's identity, verifying that the packet was
indeed sent by the claimed sender.
2. Encapsulating Security Payload (ESP):
o Provides confidentiality by encrypting the entire IP packet, protecting
its contents from unauthorized access.
o Optionally provides authentication and integrity services similar to AH,
ensuring data integrity and verifying the sender's identity.
3. Key Management:
o Establishes and manages cryptographic keys used for encryption and
authentication.
o Uses protocols like IKE (Internet Key Exchange) to negotiate and
exchange keys securely between communicating parties.
4. Data Confidentiality:
o Ensures that the data within the IP packet remains confidential and
cannot be understood by unauthorized parties.
o Achieved through encryption algorithms like AES (Advanced Encryption
Standard) or 3DES (Triple Data Encryption Standard).
5. Data Integrity:
o Guarantees that the data received is the same as what was sent,
preventing unauthorized modifications or tampering.
o Accomplished through hashing algorithms like SHA-1 or SHA-256, which
generate unique checksums for data verification.
6. Anti-Replay Protection:
o Prevents attackers from capturing and replaying old packets to gain
unauthorized access or disrupt communications.
o Achieved by assigning sequence numbers to packets and rejecting any
duplicate or out-of-sequence packets.
7. Traffic Flow Confidentiality:
o Protects sensitive information like the source, destination, and size of
data packets from being observed or inferred by eavesdroppers.
o Achieved through techniques like tunneling, where the entire IP packet
is encapsulated within another IP packet, obscuring its original
characteristics.
Q.12] Differentiate between Active attacks and Passive Attacks.
ANS: here's a simple breakdown differentiating between active attacks and passive
attacks:

Active Attacks:

1. Purpose: Active attacks involve actions where the attacker interacts directly
with the target system or network to disrupt, modify, or destroy data.
2. Examples:
o Sending malware or viruses to infect a system.
o Performing a denial-of-service (DoS) attack to overwhelm a network or
server.
o Tampering with data in transit, such as intercepting and modifying
messages.
3. Effect: Active attacks typically result in noticeable changes or disruptions to
the target system or network.
4. Detection: They are generally easier to detect compared to passive attacks
because they involve direct interaction with the target.

Passive Attacks:

1. Purpose: Passive attacks involve monitoring and eavesdropping on data

transmissions without altering the data or disrupting the communication.
2. Examples:
o Packet sniffing to intercept and read data packets being transmitted
over a network.
o Wiretapping telephone lines to listen in on conversations.
o Monitoring unencrypted emails or web traffic.
3. Effect: Passive attacks do not typically disrupt the target system or network
and may go unnoticed by the victim.
4. Detection: They are often more difficult to detect compared to active attacks
because they do not involve direct interaction with the target, making them
stealthier.
Q.13] List and explain various elements of Information Security.
ANS: Here are some key elements of information security explained in simple terms:
1. Confidentiality:
o It ensures that sensitive information is only accessible to authorized
individuals or systems.
o For example, encrypting data ensures that even if it's intercepted, it
remains unreadable to unauthorized parties.
2. Integrity:
o It guarantees that data remains accurate and trustworthy throughout
its lifecycle.
o Methods like checksums or digital signatures can help verify that data
hasn't been tampered with.
3. Availability:
o It ensures that information and resources are accessible when needed.
o This can involve measures like redundant systems or backup generators
to prevent downtime.
4. Authentication:
o It verifies the identity of users or systems trying to access information.
o Common methods include passwords, biometrics, or multi-factor
authentication (like using a password along with a fingerprint scan).
5. Authorization:
o Once a user or system is authenticated, authorization determines what
actions they're allowed to perform.
o For example, a user might be authorized to view certain files but not
modify them.
6. Non-repudiation:
o It ensures that a user cannot deny their actions or transactions.
o Digital signatures and audit trails are often used to provide evidence of
who performed specific actions.
7. Security Awareness:
o It involves educating users about security risks and best practices.
o Training programs and regular reminders help users understand how to
protect sensitive information and recognize potential threats.
8. Risk Management:
o It involves identifying, assessing, and prioritizing risks to minimize their
impact.
o This might include conducting risk assessments, implementing controls,
and having response plans in place for when incidents occur.
9. Incident Response:
o It outlines procedures for responding to security incidents promptly and
effectively.
o This includes steps like containing the incident, investigating its cause,
mitigating damage, and restoring normal operations.
10. Cryptography:
o It involves using mathematical techniques to secure communication and
data storage.
o Encryption, decryption, and key management are essential components
of cryptographic systems.
Q.14] Compare Symmetric Key and Asymmetric key encryption techniques.
ANS: let's break it down into simple points:
Symmetric Key Encryption:

1. Single Key: Both parties (sender and receiver) use the same key to encrypt and
decrypt messages.
2. Fast Processing: Encryption and decryption are typically faster compared to
asymmetric encryption because of the simplicity of using one key.
3. Less Secure for Key Exchange: Since the same key is used for encryption and
decryption, securely sharing the key between parties is crucial. If intercepted,
the communication can be compromised.
4. Examples: DES (Data Encryption Standard), AES (Advanced Encryption
Standard).

Asymmetric Key Encryption:

1. Key Pair: Involves two keys - a public key and a private key. The public key is
used for encryption, while the private key is used for decryption.
2. Slower Processing: Encryption and decryption are slower compared to
symmetric encryption due to the complexity of using two keys.
3. Secure Key Exchange: Asymmetric encryption solves the key exchange
problem. The public key can be freely shared, while the private key remains
secret. Even if the public key is intercepted, it cannot be used to decrypt
messages.
4. Examples: RSA (Rivest-Shamir-Adleman), ECC (Elliptic Curve Cryptography).

Comparison:

1. Key Usage: Symmetric encryption uses a single key, while asymmetric

encryption uses a pair of keys.
2. Processing Speed: Symmetric encryption is faster than asymmetric encryption.
3. Security: Asymmetric encryption provides better security for key exchange
since the public key can be freely shared.
4. Key Management: Symmetric encryption requires careful key management
and distribution, while asymmetric encryption simplifies key exchange.
Q.15] Explain Secure Socket Layer handshake Protocol.
ANS: Here's a simple breakdown of the Secure Socket Layer (SSL) handshake
protocol:
1. Client Hello:
o The client initiates the SSL handshake by sending a "Client Hello"
message to the server.
o This message includes information like the SSL version supported by the
client, encryption algorithms, and random data.
2. Server Hello:
o Upon receiving the "Client Hello," the server responds with a "Server
Hello" message.
o This message contains the SSL version selected by the server, the chosen
encryption algorithm, and its own random data.
3. Server Certificate:
o After the "Server Hello," the server sends its digital certificate to the
client.
o This certificate includes the server's public key and information about
the certificate issuer.
4. Client Key Exchange:
o Upon receiving the server's certificate, the client verifies it to ensure it
trusts the server.
o The client then generates a pre-master secret, encrypts it with the
server's public key obtained from the certificate, and sends it to the
server.
5. Server Key Exchange (optional):
o In some cases, the server may respond with a "Server Key Exchange"
message.
o This message contains additional information required for key
exchange, such as Diffie-Hellman parameters.
6. Change Cipher Spec:
o Both the client and server send a "Change Cipher Spec" message to
indicate that subsequent communication will be encrypted using the
negotiated algorithms.
7. Finished:
o Finally, both the client and server send a "Finished" message to confirm
that the handshake is complete.
o These messages contain a hash of all exchanged messages, ensuring that
they have not been tampered with during transmission.
Q.16] Draw and explain ITU-T X.800 Security Architecture for OSI.
ANS:
DIAGRAM:

ITU-T X.800 is a standard that defines the security architecture for OSI (Open
Systems Interconnection) networks. Here's a simplified explanation of its key
components:
1. Security Services:
o X.800 outlines various security services that protect network
communication.
o These services include authentication, access control, data
confidentiality, data integrity, non-repudiation, and availability.
2. Security Mechanisms:
o It describes the mechanisms used to implement the security services.
o Examples include encryption algorithms for confidentiality, digital
signatures for integrity and non-repudiation, and authentication
protocols like passwords or biometrics.
3. Security Architecture Model:
o X.800 presents a conceptual model for organizing security functions
within a network.
o It includes entities like security attack, security mechanism, security
service, and security association.
4. Security Domains:
o Networks are divided into security domains, each with its own security
policies and controls.
o These domains help in managing security within specific boundaries,
ensuring that resources are protected appropriately.
5. Security Management:
o X.800 addresses the management of security measures.
o This involves tasks like defining security policies, configuring security
mechanisms, monitoring security events, and responding to security
incidents.
6. Security Architecture Components:
o The architecture includes components like security labels, security audit
trails, and key management systems.
o Security labels are used to classify data, audit trails record security-
related events, and key management systems handle cryptographic
keys.
7. Interoperability and Consistency:
o X.800 aims to promote interoperability and consistency in security
implementations across different network environments.
o By providing a standardized framework, it facilitates the integration of
diverse security solutions.
8. Adaptability and Scalability:
o The architecture is designed to be adaptable to evolving security threats
and scalable to accommodate changes in network size and complexity.
o It allows for the addition or modification of security mechanisms and
policies as needed.
Q.17] Give short note on HTTPS AND IDS.
ANS: here's a simple and easy-to-understand explanation of HTTPS and IDS:

HTTPS (Hypertext Transfer Protocol Secure):

1. HTTPS is a protocol used for secure communication over a computer network.

2. It ensures that the data exchanged between a web browser and a website is
encrypted, making it difficult for attackers to intercept and read.
3. HTTPS uses encryption protocols like SSL (Secure Sockets Layer) or its successor
TLS (Transport Layer Security) to establish a secure connection.
4. Websites that use HTTPS have a padlock icon in the address bar, indicating
that the connection is secure.
5. It helps protect sensitive information such as login credentials, credit card
numbers, and personal details from being stolen by hackers.

Intrusion Detection System (IDS):

1. An Intrusion Detection System (IDS) is a security tool that monitors network or

system activities for malicious activities or policy violations.
2. It analyzes incoming network traffic and compares it against a database of
known attack signatures or abnormal patterns.
3. IDS can be either network-based or host-based. Network-based IDS monitors
network traffic, while host-based IDS monitors activities on individual
computers or devices.
4. When suspicious activity is detected, IDS generates alerts or triggers actions
such as logging the event, sending notifications to administrators, or blocking
the source of the attack.
5. IDS helps in detecting and mitigating various types of cyber threats, including
malware infections, unauthorized access attempts, and denial-of-service
attacks.